No proxy in front of your API
Keys, limits and quotas are checked inside your API from a cached copy, so known keys keep working if MicroAuth is unreachable.
Sign in, AI access and API keys
Hosted sign in and MCP authorization for your apps, plus keys, rate limits and billing through your own Stripe account for the APIs you sell or run for your teams.
from fastapi import Depends, FastAPI
from microauth_fastapi import User, UserAuth
app = FastAPI()
# adds /auth/login, /auth/callback and /auth/logout
auth = UserAuth(app)
writers = auth.require(permissions="posts:write")
@app.get("/dashboard")
async def dashboard(user: User = Depends(auth.login_required)):
return {"hello": user.name}
@app.post("/posts")
async def create_post(user: User = Depends(writers)):
...
from fastapi import FastAPI
from mcp.server.mcpserver import MCPServer
from microauth_fastapi import McpAuth, current_identity
mcp = MCPServer("Invoices", log_level="WARNING")
auth = McpAuth(scopes=["invoices:read"])
@mcp.tool()
@auth.tool("invoices:write")
def create_invoice(customer: str, amount_cents: int) -> dict:
owner = current_identity().sub
return {"owner": owner, "customer": customer}
app = FastAPI()
auth.mount(app, mcp) # serves /mcp next to your other routes
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth
app = FastAPI()
auth = MicroAuth(app) # reads MICROAUTH_SECRET_KEY
@app.get("/forecast")
async def forecast(city: str, customer: Customer = Security(auth)):
# a 200 here charges this customer your price per request
credit = customer.credit_balance_micro
return {"city": city, "credit_left_micro": credit}
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth
app = FastAPI()
# reads your internal API's MICROAUTH_SECRET_KEY
auth = MicroAuth(app)
@app.get("/reports")
async def reports(customer: Customer = Security(auth)):
return {"team": customer.id, "key": customer.key_id}
Products
Run sign in services, AI access, APIs you sell and internal APIs side by side in one workspace. Each has its own settings and its own plan.
Hosted sign in, OAuth 2.1, roles and user management for your web, single page and native apps.
Explore authenticationLet AI clients use your MCP server for a person, with only the permissions they approve.
Explore AI accessSell your API with a branded portal, keys, rate limits and billing through your own Stripe account.
Explore API monetizationProtect an API your teams or partners call, with keys you issue and limits for each team.
Explore internal APIsWhy MicroAuth
MicroAuth runs the parts that are easy to get wrong, and stays out of the way of everything else.
Keys, limits and quotas are checked inside your API from a cached copy, so known keys keep working if MicroAuth is unreachable.
When you sell an API, developers pay you through your own Stripe account. We take no share of it.
Sign in is OAuth 2.1 and OpenID Connect, and AI access follows the MCP authorization spec, so standard libraries work in any language.
Sign in pages and developer portals carry your logo and colors, on microauth.dev or your own domain.
Authentication
Create a sign in service, register your app and add the SDK. MicroAuth runs the pages, the accounts and the OAuth server.
Sign in, sign up, password resets, invites, passkeys and two step verification, with your logo and colors.
Web apps, single page apps and native apps all use the code flow with PKCE, with any OpenID Connect library.
Your app reads roles from the session, and you invite, suspend and sign people out from the dashboard.
Passkeys, authenticator apps and recovery codes, plus Google, GitHub and any OpenID Connect or OAuth 2.0 provider.
AI access
MicroAuth is the authorization server for your MCP server, following the MCP authorization spec. You keep your tools and your data. MicroAuth handles sign in, consent and tokens.
People sign in on your pages and see each permission the client asks for, in plain words.
The client gets a short lived token that only your MCP server accepts, with only what the person approved.
The SDK checks the scopes each tool needs. A client missing one is told which to ask for.
People see and disconnect the apps they allowed. A client without OAuth can use a key the person creates.
API monetization
Developers sign up on a portal with your name on it, create keys and pay you through your own Stripe account. Your traffic never goes through MicroAuth.
Sign up, keys, usage, credit and plans, live the moment you launch your API.
The SDK checks keys, rate limits and quotas from a cached copy, with no proxy in front of your API.
Prepaid credit, monthly plans and usage billing, with no revenue share.
Internal APIs
For an API your teams, services or partners use. You invite who gets in and issue their keys, and nobody pays.
Nobody can sign up on their own, and requests are counted, never charged.
Create a key for a team from the dashboard, with an expiry date for a contractor or a pilot.
Rate limits, monthly quotas and an activity log, with the same SDK and HTTP endpoints as a paid API.
Getting started
Add a sign in service or an API from the dashboard. No credit card needed.
Install microauth-fastapi, or use any OpenID Connect library and three HTTP endpoints from other languages.
Your sign in pages or developer portal are live right away on microauth.dev, or on your own domain.
Questions
No. Sign in is standard OpenID Connect, so any OpenID Connect library works, in any language. APIs you sell or run for your teams check keys and report usage through three HTTP endpoints. FastAPI gets an SDK that does all of it in a few lines.
Only sign in does: the sign in pages and the OAuth endpoints run on MicroAuth. After that, your apps, APIs and MCP servers check tokens and keys themselves, so their requests never pass through us. For API services, the SDK checks keys from a cached copy and only sends usage counts.
Yes. A workspace can hold sign in services, APIs you sell and internal APIs side by side. Each service has its own settings and its own plan, and everyone you invite to the workspace can work on all of them.
You can start on a free plan without a credit card. Paid plans are a flat monthly price per service. When you sell an API, your developers pay you through your own Stripe account and we take no share. See pricing.
Create a free account, then add sign in for an app, AI access for an MCP server, or an API to sell or keep for your own teams.