Hosted pages on your domain
Sign in, sign up, reset, invites, consent and an account page, with your branding, on microauth.dev or your own subdomain.
Sign in, AI access and API keys
MicroAuth gives your apps hosted sign in on your own domain, and lets AI clients use your MCP servers with only the access people approve. Your APIs get keys and rate limits, with billing through your own Stripe account when you sell them, or invite only keys when they are for your own teams.
Hosted sign in, OAuth 2.1, roles and user management for your web, single page and native apps.
Explore authenticationLet AI clients use your MCP server for a person, with only the permissions they approve.
Explore AI accessSell your API with a branded portal, keys, rate limits and billing through your own Stripe account.
Explore API monetizationProtect an API your teams or partners call, with keys you issue and limits for each team.
Explore internal APIsfrom fastapi import Depends, FastAPI
from microauth_fastapi import User, UserAuth
app = FastAPI()
auth = UserAuth(app) # adds /auth/login, /auth/callback and /auth/logout
@app.get("/dashboard")
async def dashboard(user: User = Depends(auth.login_required)):
return {"hello": user.name}
@app.post("/posts")
async def create_post(user: User = Depends(auth.require(permissions="posts:write"))):
...
from fastapi import FastAPI
from mcp.server.mcpserver import MCPServer
from microauth_fastapi import McpAuth, current_identity
mcp = MCPServer("Invoices", log_level="WARNING")
auth = McpAuth(scopes=["invoices:read"])
@mcp.tool()
@auth.tool("invoices:write")
def create_invoice(customer: str, amount_cents: int) -> dict:
return {"owner": current_identity().sub, "customer": customer, "amount_cents": amount_cents}
app = FastAPI()
auth.mount(app, mcp) # serves /mcp next to your other routes
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth
app = FastAPI()
auth = MicroAuth(app) # reads MICROAUTH_SECRET_KEY
@app.get("/forecast")
async def forecast(city: str, customer: Customer = Security(auth)):
# a 200 here charges this customer your price per request
return {"city": city, "credit_left_micro": customer.credit_balance_micro}
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth
app = FastAPI()
auth = MicroAuth(app) # reads your internal API's MICROAUTH_SECRET_KEY
@app.get("/reports")
async def reports(customer: Customer = Security(auth)):
return {"team": customer.id, "key": customer.key_id}
Authentication
Create a sign in service, register your app and add the SDK. MicroAuth runs the pages, the accounts and the OAuth server.
Sign in, sign up, password resets, invites, passkeys and two step verification, with your logo and colors.
Web apps, single page apps and native apps all use the code flow with PKCE, with any OpenID Connect library.
Your app reads roles from the session, and you invite, suspend and sign people out from the dashboard.
AI access
MicroAuth is the authorization server for your MCP server, following the MCP authorization spec. You keep your tools and your data. MicroAuth handles sign in, consent and tokens.
People sign in on your pages and see each permission the client asks for, in plain words.
The client gets a short lived token that only your MCP server accepts, with only what the person approved.
The SDK checks the scopes each tool needs. A client missing one is told which to ask for.
API monetization
Developers sign up on a portal with your name on it, create keys and pay you through your own Stripe account. Your traffic never goes through MicroAuth.
Sign up, keys, usage, credit and plans, live the moment you launch your API.
The SDK checks keys, rate limits and quotas from a cached copy, with no proxy in front of your API.
Prepaid credit, monthly plans and usage billing, with no revenue share.
Internal APIs
For an API your teams, services or partners use. You invite who gets in and issue their keys, and nobody pays.
Nobody can sign up on their own, and requests are counted, never charged.
Create a key for a team from the dashboard, with an expiry date for a contractor or a pilot.
Rate limits, monthly quotas and an activity log, with the same SDK and HTTP endpoints as a paid API.
Features
Sign in, sign up, reset, invites, consent and an account page, with your branding, on microauth.dev or your own subdomain.
Discovery, PKCE for every app, rotating refresh tokens, userinfo, revocation, introspection and sign out.
Permissions you name, roles that bundle them, and a users page to invite, suspend or sign people out everywhere.
Passkeys, authenticator apps and recovery codes, plus Google, GitHub and any OpenID Connect or OAuth 2.0 provider.
Protected resource metadata, consent, step up and per tool scopes for the MCP servers your users connect AI clients to.
People see and disconnect the apps they allowed. A client without OAuth can use a key the person creates.
Developers sign up, create keys, add credit or pick a plan, and watch their usage, on a portal with your name on it.
Keys, rate limits and quotas are checked inside your API from a cached copy, so known keys keep working if MicroAuth is unreachable.
Prepaid credit, monthly plans and usage billing, paid to your own Stripe account, with no revenue share.
Only the teams you invite get in. Their requests are counted for limits and usage, and never charged.
Create a key for a team from the dashboard. A key past its expiry date stops working, the same as a revoked one.
UserAuth, TokenAuth, McpAuth and MicroAuth in one package, and standard endpoints for any other language.
Questions
No. Sign in is standard OpenID Connect, so any OpenID Connect library works, in any language. APIs you sell or run for your teams check keys and report usage through three HTTP endpoints. FastAPI gets an SDK that does all of it in a few lines.
Only sign in does: the sign in pages and the OAuth endpoints run on MicroAuth. After that, your apps, APIs and MCP servers check tokens and keys themselves, so their requests never pass through us. For API services, the SDK checks keys from a cached copy and only sends usage counts.
Yes. A workspace can hold sign in services, APIs you sell and internal APIs side by side. Each service has its own settings and its own plan, and everyone you invite to the workspace can work on all of them.
You can start on a free plan without a credit card. Paid plans are a flat monthly price per service. When you sell an API, your developers pay you through your own Stripe account and we take no share. See pricing.
Create a free account, then add sign in for an app, AI access for an MCP server, or an API to sell or keep for your own teams.