Internal APIs

Not every API is for sale. An internal API is one your own teams, services or partners call. MicroAuth gives it the same keys, rate limits and usage counts as an API you sell, without a public sign up page or billing.

There are two ways to protect one. Pick by who is calling:

Who calls it	Use
Other teams, services and partners, each with their own key	An internal API service, below
People who sign in to your apps, or scripts acting for them	A sign in service with access tokens and API keys for your users

Create an internal API service

In the dashboard, click New service and choose Protect an internal API. Give it a name and an address. The address is where the teams you invite sign in to get their keys and see their usage.

An internal API differs from an API you sell in three ways:

• Invite only. Nobody can sign up. You invite each team from the Customers tab, and they get the portal's keys, usage and team pages.
• No billing. Pay as you go credit, plans and Stripe Connect are hidden and turned off. Requests are counted, never charged.
• Keys you issue. Besides keys teams create themselves, you can create a key for a team from the dashboard, with an optional expiry date.

Rate limits, monthly quotas and the activity log work the same as for an API you sell. See customers and limits.

Connect your API

The code is the same as for an API you sell. Use the SDK secret key from the Connect tab:

from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth

app = FastAPI()
auth = MicroAuth(app)  # reads MICROAUTH_SECRET_KEY


@app.get("/reports")
async def reports(customer: Customer = Security(auth)):
    return {"team": customer.id}

Keys are checked inside your app from a cached copy, with no call to MicroAuth on the request path. A key past its expiry date stops working, the same as a revoked one. Other languages use the HTTP API, which honors expiry dates too.

Keys that expire

Give keys you issue an expiry date when they're for a contractor, a pilot or a migration. Teams see the date on their keys page, and you see it on the team's page in the dashboard. To extend access, issue a new key before the old one expires.

Your plan

Internal APIs use the same MicroAuth plans as APIs you sell, with a monthly request allowance and a limit on teams. See pricing.