A branded developer portal
Sign up, keys, usage, billing and account pages, with your logo and color, on microauth.dev or your own domain.
API monetization
Sell your API with keys, rate limits and billing
Developers sign up on a portal with your name on it, create keys and pay you through your own Stripe account. The SDK checks every key inside your API, so your traffic never goes through MicroAuth.
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth
app = FastAPI()
auth = MicroAuth(app) # reads MICROAUTH_SECRET_KEY
@app.get("/forecast")
async def forecast(city: str, customer: Customer = Security(auth)):
return {"city": city, "billing": customer.billing_model}
@app.get("/status")
async def status(customer: Customer | None = Security(auth.optional)):
return {"authenticated": customer is not None}Routes that ask for a customer get key checks, rate limits, quotas and billing. Routes that don't are left alone.
from fastapi import FastAPI
from microauth_fastapi import MicroAuth
app = FastAPI()
auth = MicroAuth(app, redis_url="redis://localhost:6379/0") # pip install "microauth-fastapi[redis]"With Redis, every worker shares one exact limit per customer, one snapshot and one usage queue.
- GET
/sdk/v1/snapshotCache customers, keys and limits locally - GET
/sdk/v1/keys/verifyLook up a key created seconds ago - POST
/sdk/v1/usageReport usage in idempotent batches
These three endpoints are the whole integration, in Node, Go, Rails or anything else. Read the HTTP guide
How it works
From launch to a first paid request
It takes about five minutes to launch an API, add the SDK and send a request with a test key.
Launch your API
Pick pay as you go, free with a quota or monthly plans. Your portal is live at once, at an address like weather-api.microauth.dev.
Add the SDK
One dependency on the routes you want to protect. Keys and limits are cached in your app and refreshed every 30 seconds.
Developers sign up
They create keys on your portal, add credit or pick a plan, and see their usage.
Usage is billed
Each billable response is charged at your price, with a receipt, and payments go to your Stripe account.
Developer portal
A portal with your name on it
Every API gets a portal, live the moment you create it, with your logo, tagline and color. Customers sign up, create and revoke keys, add credit or pick a plan, and see their requests per day and per key.
Let anyone sign up, approve each customer first, or invite only. On plans that include them, serve the portal from your own domain and let customers invite their teammates.
No proxy
Checked inside your API, not in front of it
The SDK keeps a snapshot of your customers, keys and limits in memory, so checking a key costs one SHA-256 and a couple of lookups. A key created seconds ago is looked up once.
Usage is written to disk, or to Redis, before the response finishes and sent in batches. If MicroAuth is briefly unreachable, known keys keep working from the cache.
Terminal
$ curl https://api.example.com/forecast?city=Lima -H "X-API-Key: map_..."
200charged at the customer's price, with a receipt
# the same key once the prepaid balance runs out
402Prepaid balance used up
# faster than the customer's requests a second
429Rate limit reached, with Retry-After
# a revoked key
401Missing or invalid API key
Payments
Paid to your own Stripe account
Charge per request from prepaid credit, sell monthly plans, or do both. Customers pay through Stripe Checkout with your business name on it, and can save a card for automatic top ups.
To connect Stripe, you sign in to Stripe and approve. There are no keys to copy and no webhooks to set up, and MicroAuth takes no share of what your customers pay you.
Features
What selling an API includes
Keys checked locally
Keys are checked from a cached copy in your app, with no proxy and no call to MicroAuth on the request path.
Rate limits and quotas
Requests a second and requests a month per customer, from your defaults, their plan or custom limits you set.
Prepaid credit
Welcome credit, top ups, automatic top ups and a low balance email. Customers out of credit get a 402.
Monthly plans
Public or private plans with their own limits and prices, paid through Stripe, with prorated changes.
Usage billing with receipts
Only billable status codes are charged, and every charge comes back with a receipt the SDK checks against your price.
Moving off a gateway? MicroAuth replaces the proxy, the portal and the billing system. Read Coming from Kong
Questions
About selling an API
Does my API traffic go through MicroAuth?
No. MicroAuth isn't a gateway or a proxy. The SDK inside your API caches customer limits and reports usage counts in batches. Request bodies, headers, query parameters and responses never leave your servers.
Do you take a revenue share?
No. Your customers pay you through your own Stripe account. Stripe's own fees are the only cost per transaction, and our price stays the same whatever you earn.
What happens if MicroAuth is unreachable?
Known keys keep working from the cached copy, and usage waits on disk or in Redis until it can be sent. A key the SDK has never seen gets a 503 rather than a false 401.
I run several workers. Does that work?
Yes. Install microauth-fastapi[redis] and pass redis_url so every worker shares one exact limit. Vercel and AWS Lambda work too.
My API isn't written in Python. Can I still use it?
Yes. The SDK is a careful client of three HTTP endpoints, and the HTTP guide documents them, with a Node example.
Start selling your API
Launch an API, add one dependency and send a first request with a test key. Your portal is live right away.