Hosted API Reference

Publish your OpenAPI document as a reference your partners and teams can read — public, or private behind the login you already run.

Private reference

https://docs.acme.com
  → not signed in
  → your hosted login (Okta, Entra ID…)
  → back to the reference

Who can read it

Connections enabled:
  ✓ Acme Okta
  ✗ Password sign-up

→ Acme staff only

Docs that shouldn't be public

A partner API, an internal platform, a beta you are not ready to announce. The reference exists, but putting it on the open web is not an option — and building a login in front of a static docs site is a project nobody wants.

AuthAction already runs your login. Mark a reference private and readers sign in through the same connections your users do. Who can read it is simply which connections you enable.

Read the guide

How it works

A reference is its own application. Give it a name, publish a document, choose who can read it.

1. Publish your document

Load an OpenAPI 3 or Swagger 2 JSON document from a URL or a file in the dashboard, or push it from CI with the Management API.

2. Choose who can read it

Public for anyone with the link, or private behind your hosted login — limited to the connections you enable, such as your company's Okta or Entra ID.

3. Serve it on your domain

It is live on AuthAction straight away. Point a domain such as docs.acme.com at it, with certificates issued and renewed automatically.

Published from your pipeline

The document is a field on the application, so the step that builds your API can publish its reference too. Nothing drifts out of date because someone forgot to upload it.

We never fetch your document — a spec on an internal host works
OpenAPI 3 and Swagger 2, up to 5 MB
Private references withhold the document too
Renderer served from our origin, not a third-party CDN
Kept off the origin that holds login sessions
EU-hosted and EU-operated

# After your API builds its OpenAPI document
jq -n --slurpfile spec openapi.json \
  '{docsSpecDocument: $spec[0]}' |
curl -X PATCH \
  "https://acme.eu.authaction.com/api/v1/applications/$DOCS_APP_ID" \
  -H "Authorization: Bearer $MANAGEMENT_API_TOKEN" \
  -H 'Content-Type: application/json' \
  --data @-

Readers sign in with

Okta Entra ID Google Workspace SAML Passkeys Social

Access is a connection, not a password list

A private reference has no separate accounts to manage. Enable your enterprise connection only, and the reference is readable by people in your directory — someone removed from it can no longer sign in to read it.

Publishing for partners instead? Enable a connection they can sign up through. The reference, the document behind it, and the sign-in all follow the same rule.

See visibility options

# Live as soon as you publish
https://acme--docs.eu.authaction.com/<client-id>

# Or on your own domain
docs.acme.com   CNAME   acme.eu.authaction.com

Your domain, kept apart

Every reference gets an address the moment it is published. Add a custom domain, choose API reference, and it is served at your domain's root, with TLS handled for you.

References are never rendered on the host that holds your users' login session. Documentation content stays on its own origin, and for a private reference the sign-in callback is registered and removed with the domain.

Custom domain setup

Publish your API reference

Public for everyone, or private for the people who should see it. Completely free, no credit card required.

Get Started View Pricing