🚀 Introducing Usage-Based API Access: A New Layer Between Stripe and Your API Gateway

We didn’t start by trying to reinvent authentication. We started by trying to protect and commercialize our own APIs. What began as a side project to issue secure API keys quickly turned into a much bigger realization: there’s a missing layer between Stripe and your API Gateway—and nobody’s owning it.
Picture of Nick Forsberg
Nick Forsberg
By the founders of The Auth API

We didn’t start by trying to reinvent authentication. We started by trying to protect and commercialize our own APIs. What began as a side project to issue secure API keys quickly turned into a much bigger realization: there’s a missing layer between Stripe and your API Gateway—and nobody’s owning it.

Today, we’re introducing that layer. We call it The Auth API.

🧱 Stripe handles the money. Kong handles the traffic. But who handles the business logic?

If you run an API product, you’ve likely duct-taped together some version of:

  • Stripe for subscriptions
  • A rate-limiter at the edge
  • Basic API key auth
  • Logging in your backend
  • Maybe some manual usage tracking

But here’s the problem: none of these systems talk to each other. There’s no canonical source of truth about who’s calling your API, how often, whether they’ve paid, or what plan they’re on. You’re left guessing—or building a brittle internal dashboard just to keep track.

That’s where The Auth API comes in.

We sit between your users and your API gateway, offering:

🔐 The Auth API is the missing business layer for your API

  • 🔑 Per-customer API key management
  • 📊 Real-time usage tracking
  • 📉 Built-in rate limits per key
  • 💸 Usage-based billing (Stripe integration launching soon—get early access)

We’re not a replacement for Kong, Unkey, or Zuplo—we’re a new kind of layer.

Call it “API Monetization as a Service,” if you like.

🆚 How we compare

PlatformWhat it solvesWhat it misses
StripePayments, billing, invoicesNo native support for per-key usage metering
Kong / Tyk / API GatewaysTraffic routing, rate limitingNo monetization layer, no customer-level tracking
UnkeyDeveloper-first API key issuanceNo billing or advanced usage insights
ZuploEdge auth and rate limitingExcellent edge control, but monetization is DIY
The Auth APIUsage-based API monetization + observabilityNo OAuth/user login (by design)

We’re not trying to be everything. We’re trying to be the best way to sell, secure, and scale your API access.

👋 Our backstory

We’re API builders ourselves. We created TheDogAPI.com and a few internal tools for dev teams. At some point we realized we were spending way too much time building infrastructure just to know who’s using our APIs, how often, and whether they should be.

That pain led to a prototype. That prototype turned into a product.

Today, The Auth API is used to protect and monetize thousands of API calls per day—and we’re just getting started.

⚙️ What’s live today

  • ✅ Instant API key issuance
  • ✅ Per-key usage logs & analytics
  • ✅ Rate limiting
  • ✅ Organization/team support
  • ✅ Admin dashboard
  • ✅ Webhooks, secrets, and metadata support
  • ✅ Open-source client libraries – GO, TypeScript, PHP

🛣️ What’s next (we’re building in public)

  • 🚧 Stripe metered billing integration (early access now—launching soon)
  • 🚧 SDKs for popular frameworks
  • 🚧 Partner API and embedded analytics
  • 🚧 Self-hosted / BYOK edition

📢 Want to help shape this?

We’re opening up early access to the usage-based billing layer right now. If you’re running a public API, building a dev tool, or want to stop duct-taping your monetization layer—we’d love to hear from you.

Picture of a blac and white guarding your keys

What safeguards have you implemented to protect your API from malicious actors?

Take the first step today on your journey to secure API access.