API Portal & MCP Hub overview¶
The API Portal & MCP Hub is a self-hosted web application that acts as the front door between your APIs and the developers who consume them. API publishers register APIs and MCP servers in the portal, and developers discover, subscribe, and generate credentials—all without needing direct access to the underlying gateway or infrastructure.
New to the portal's building blocks? See Concepts for a glossary of the organization, views, labels, APIs, MCP servers, API workflows, subscription plans, applications, subscriptions, and API keys.
What the API Portal & MCP Hub manages¶
API and MCP catalog¶
Browse and search REST, GraphQL, SOAP, WebSocket, and WebSub APIs, as well as MCP servers, with full documentation and a try-out console.
- Full-text search by name, type, version, and description
- Per-API documentation, landing page content, icons, and banners
- Machine-readable discovery (
llms.txt, per-API Markdown, OpenAPI/AsyncAPI specs) built for AI agent consumption
Learn more in Discover APIs, MCP Servers, and AI Agent Discovery.
MCP servers¶
Publish Model Context Protocol servers alongside your APIs, each with its tools, resources, and prompts listed, an MCP Playground for invoking them, and a ready-made client configuration snippet. Servers arrive either through the admin UI or through the portal's implementation of the MCP registry specification.
Learn more in MCP Servers and the MCP Registry API.
Developer applications¶
Logical containers for OAuth2 credentials. A developer can create multiple applications—for example, one per client or environment—each linked to independent OAuth2 client IDs.
Learn more in Manage Applications.
Subscriptions and plans¶
Developers subscribe directly to an API or MCP server under a named plan (for example, Gold or Bronze) that enforces rate limits and quotas. No application is required to subscribe.
Learn more in Manage Subscriptions and, for admins, Subscription Plans.
API keys and OAuth2 credentials¶
Generate, rotate, and revoke API keys bound to a specific API or MCP server. For OAuth2-secured APIs, link a client ID created in a key manager to an application and generate access tokens through the portal.
Learn more in Manage API Keys, Consume an API Secured with OAuth2, and, for admins, Key Manager Integration.
API workflows¶
Multi-step API call sequences authored in Arazzo format and published for both human developers and AI agents to discover and follow.
Learn more in API Workflows.
Theming¶
Give a view its own colors, page shell, header, footer, and page markup by uploading a theme. A theme is a partial copy of the default template tree, so a re-color is one file and everything you omit falls back to the default.
Learn more in Theming, and Apply a Theme for the upload panel.
Admin settings¶
The Settings page is where admins configure everything above from one place: organization details, views, labels, subscription plans, key managers, the API and MCP catalog, webhooks, LLM instructions, and API workflows.
| Section | Configure |
|---|---|
| Organization Settings | Display name, business owner contact, IDP reference ID |
| Manage Views | Filtered, branded subsets of the catalog for different audiences |
| Manage Labels | Tags that control which views an API or MCP server appears in |
| Subscription Plans | Rate/quota tiers applications can subscribe to |
| Key Manager Integration | OAuth2 authorization servers used to issue access tokens |
| Manage APIs | Add, edit, publish, deprecate, and delete APIs |
| Manage MCP Servers | Add, edit, publish, deprecate, and delete MCP servers |
| Webhook Integration | Endpoints notified when API keys or subscriptions change |
| LLM Instructions | Portal-level context published to llms.txt for AI agents |
| Managing API Workflows | Author, publish, and control visibility of API workflows |
| Apply a Theme | Upload, download, and reset a view's custom theme |
Gateway-agnostic, unified developer experience¶
The portal doesn't embed gateway-specific logic. Instead, it emits signed webhook events: whenever a developer generates an API key, subscribes, or revokes a key, the portal fires a signed HTTP POST to every registered gateway subscriber, and each gateway adapter enforces access in its own way.
This means you can:
- Connect multiple gateways of different types to the same portal simultaneously
- Replace or swap a gateway without changing how developers interact with the portal
- Run the portal standalone, with no live gateway required
Views¶
Within your organization you can define multiple views for different audiences—for example, one for internal teams and one for external partners.
Setting up¶
Beyond the Docker Compose quick start, a production deployment typically needs:
| Topic | Covers |
|---|---|
| Authentication | Local and OIDC authentication modes, with an Asgardeo identity-provider walkthrough |
| Artifact types | Choose which artifact types—APIs, MCP servers, and API workflows—the portal serves |
| Design Mode | Develop and preview themes/layouts offline, without a database or IDP |
References¶
| Topic | Covers |
|---|---|
| Management API | Full reference for every API Portal REST API resource |
| Get a Bearer Token via curl | Scripted/CI access to the REST API under IDP mode |
| Configurations | Full config.toml field reference and environment interpolation |
Getting started¶
To start using the API Portal & MCP Hub, follow the Getting Started guide.
For a summary of what this release includes, see About this release.