Get started

Internal APIs

Keys and rate limits for the APIs your teams call

Protect an API that your own teams, services or partners use. You invite each team and issue their keys, and their requests are counted, never charged.

Start free Read about internal APIs 
from fastapi import FastAPI, Security
from microauth_fastapi import Customer, MicroAuth

app = FastAPI()
auth = MicroAuth(app)  # reads MICROAUTH_SECRET_KEY from the Connect tab

@app.get("/reports")
async def reports(customer: Customer = Security(auth)):
    return {"team": customer.id, "key": customer.key_id}
The same code as an API you sell. Each customer is a team you invited, and a key past its expiry date stops working.

How it works

Set up once, then invite your teams

An internal API gets the same keys, rate limits and usage counts as an API you sell, without a public sign up page or billing.

  1. Create an internal API

    In the dashboard, choose Protect an internal API and give it a name and an address.

  2. Invite your teams

    Nobody can sign up on their own. Each team you invite gets the portal's keys, usage and team pages.

  3. Issue keys

    Teams create their own keys, or you issue one from the dashboard with an optional expiry date.

  4. Connect your API

    Add the SDK or call the HTTP endpoints. Keys are checked inside your app from a cached copy.

Invite only

Only the teams you invite, and no billing

You invite each team from the Customers tab. Pay as you go credit, plans and Stripe are hidden and turned off, so nobody is ever asked to pay.

Each team signs in at your API's address to get its keys and see its usage.

Keys you issue

Keys that expire on their own

Give a key you issue an expiry date when it's for a contractor, a pilot or a migration. A key past its date stops working, the same as a revoked one.

Teams see the date on their keys page, and you see it on the team's page in the dashboard. To extend access, issue a new key before the old one expires.

Limits and usage

Limits and usage for each team

Rate limits, monthly quotas and the activity log work the same as for an API you sell. Give one team higher limits than the rest with custom limits on its page.

Teams see their requests per day and per key, so they know what they use before they hit a limit.

Features

What an internal API includes

Invite only

No public sign up page. You invite each team, and they get keys, usage and team pages.

Keys you issue

Besides keys teams create themselves, create a key for a team from the dashboard, with an optional expiry date.

Billing switched off

Credit, plans and Stripe are hidden and turned off. Requests are counted for limits and usage, never charged.

Rate limits and quotas

Requests a second and requests a month for every team, with custom limits for the ones that need more.

Usage and activity

Usage per team and per key, and the same activity log as an API you sell.

The same SDK and endpoints

The FastAPI SDK and the three HTTP endpoints work exactly as they do for an API you sell.

Which one fits

Two ways to protect an API

Pick by who calls it.

An internal API

For other teams, services and partners, each with their own key. You invite them and issue keys, and set limits per team.

Read about internal APIs

A sign in service

For people who sign in to your apps, or scripts acting for them. Your API checks their access tokens and the API keys they make for their own accounts.

See authentication

Questions

About internal APIs

How is an internal API different from one I sell?

In three ways. It's invite only, so nobody can sign up. Billing is off, so requests are counted and never charged. And you can issue keys to a team from the dashboard, with an optional expiry date. Everything else works the same.

Can a key expire?

Yes. Keys you issue can have an expiry date. After it, the key stops working in the SDK and the HTTP endpoints, the same as a revoked one. To extend access, issue a new key before the old one expires.

Do requests go through MicroAuth?

No. The SDK checks keys inside your app from a cached copy, with no call to MicroAuth on the request path, and sends only usage counts.

How is an internal API priced?

It uses the same MicroAuth plans as an API you sell, with a monthly request allowance and a limit on teams. See pricing.

Protect your internal API

Create an internal API, invite your first team and connect your API with the same few lines of code.

Start free Read about internal APIs