Sign in, AI access and API keys

Sign in for your apps, and keys and billing for your APIs

MicroAuth gives your apps hosted sign in on your own domain, and lets AI clients use your MCP servers with only the access people approve. Your APIs get keys and rate limits, with billing through your own Stripe account when you sell them, or invite only keys when they are for your own teams.

from fastapi import Depends, FastAPI
from microauth_fastapi import User, UserAuth

app = FastAPI()
auth = UserAuth(app)  # adds /auth/login, /auth/callback and /auth/logout

@app.get("/dashboard")
async def dashboard(user: User = Depends(auth.login_required)):
    return {"hello": user.name}

@app.post("/posts")
async def create_post(user: User = Depends(auth.require(permissions="posts:write"))):
    ...
Sessions live in an encrypted, HttpOnly cookie, so browser JavaScript never holds a token.

Authentication

Sign in for your apps, without running it yourself

Create a sign in service, register your app and add the SDK. MicroAuth runs the pages, the accounts and the OAuth server.

  • Hosted pages on your domain

    Sign in, sign up, password resets, invites, passkeys and two step verification, with your logo and colors.

  • OAuth 2.1 and OpenID Connect

    Web apps, single page apps and native apps all use the code flow with PKCE, with any OpenID Connect library.

  • Roles, permissions and your users

    Your app reads roles from the session, and you invite, suspend and sign people out from the dashboard.

See everything in authentication

AI access

Let AI clients act for your users, within limits they approve

MicroAuth is the authorization server for your MCP server, following the MCP authorization spec. You keep your tools and your data. MicroAuth handles sign in, consent and tokens.

  • Consent for each permission

    People sign in on your pages and see each permission the client asks for, in plain words.

  • A token for one server

    The client gets a short lived token that only your MCP server accepts, with only what the person approved.

  • Scopes checked on every tool call

    The SDK checks the scopes each tool needs. A client missing one is told which to ask for.

See how AI access works

API monetization

Sell your API with keys, limits and billing

Developers sign up on a portal with your name on it, create keys and pay you through your own Stripe account. Your traffic never goes through MicroAuth.

  • A branded developer portal

    Sign up, keys, usage, credit and plans, live the moment you launch your API.

  • Checked inside your API

    The SDK checks keys, rate limits and quotas from a cached copy, with no proxy in front of your API.

  • Paid to your own Stripe account

    Prepaid credit, monthly plans and usage billing, with no revenue share.

See how selling an API works

Internal APIs

Protect the APIs your own teams call

For an API your teams, services or partners use. You invite who gets in and issue their keys, and nobody pays.

  • Invite only, with billing off

    Nobody can sign up on their own, and requests are counted, never charged.

  • Keys you issue

    Create a key for a team from the dashboard, with an expiry date for a contractor or a pilot.

  • Limits and usage for each team

    Rate limits, monthly quotas and an activity log, with the same SDK and HTTP endpoints as a paid API.

See how internal APIs work

Features

What each product includes

Authentication

Hosted pages on your domain

Sign in, sign up, reset, invites, consent and an account page, with your branding, on microauth.dev or your own subdomain.

Authentication

OAuth 2.1 and OpenID Connect

Discovery, PKCE for every app, rotating refresh tokens, userinfo, revocation, introspection and sign out.

Authentication

Roles, permissions and users

Permissions you name, roles that bundle them, and a users page to invite, suspend or sign people out everywhere.

Authentication

Passkeys and external sign in

Passkeys, authenticator apps and recovery codes, plus Google, GitHub and any OpenID Connect or OAuth 2.0 provider.

AI access

MCP authorization

Protected resource metadata, consent, step up and per tool scopes for the MCP servers your users connect AI clients to.

AI access

Connected apps and keys

People see and disconnect the apps they allowed. A client without OAuth can use a key the person creates.

API monetization

A branded developer portal

Developers sign up, create keys, add credit or pick a plan, and watch their usage, on a portal with your name on it.

API monetization

Keys and limits without a proxy

Keys, rate limits and quotas are checked inside your API from a cached copy, so known keys keep working if MicroAuth is unreachable.

API monetization

Billing through your Stripe

Prepaid credit, monthly plans and usage billing, paid to your own Stripe account, with no revenue share.

Internal APIs

Invite only, with billing off

Only the teams you invite get in. Their requests are counted for limits and usage, and never charged.

Internal APIs

Keys you issue, with expiry

Create a key for a team from the dashboard. A key past its expiry date stops working, the same as a revoked one.

Every product

One FastAPI SDK, or plain HTTP

UserAuth, TokenAuth, McpAuth and MicroAuth in one package, and standard endpoints for any other language.

One flat monthly price per service

Start free with sign in for up to 1K users, or an API with 1M requests a month. No revenue share: when you sell an API, your developers pay you through your own Stripe account.

See pricing

Questions

What developers ask us

Do I have to use FastAPI?

No. Sign in is standard OpenID Connect, so any OpenID Connect library works, in any language. APIs you sell or run for your teams check keys and report usage through three HTTP endpoints. FastAPI gets an SDK that does all of it in a few lines.

Do requests to my apps and APIs go through MicroAuth?

Only sign in does: the sign in pages and the OAuth endpoints run on MicroAuth. After that, your apps, APIs and MCP servers check tokens and keys themselves, so their requests never pass through us. For API services, the SDK checks keys from a cached copy and only sends usage counts.

Can one account run sign in and APIs?

Yes. A workspace can hold sign in services, APIs you sell and internal APIs side by side. Each service has its own settings and its own plan, and everyone you invite to the workspace can work on all of them.

What does MicroAuth cost?

You can start on a free plan without a credit card. Paid plans are a flat monthly price per service. When you sell an API, your developers pay you through your own Stripe account and we take no share. See pricing.

Start with the product you need

Create a free account, then add sign in for an app, AI access for an MCP server, or an API to sell or keep for your own teams.