What should I use for private API docs with access control?

If you want private API docs with access control, the best choice depends on where your API lives and how much control you want.

Good options

1. Swagger UI / OpenAPI

Best if you already have an OpenAPI spec.

• Can be hosted privately behind login, VPN, or SSO
• Supports authenticated “try it out” requests with API keys, OAuth2, JWT, etc.
• Easy to integrate into existing API stacks

Use this if: you want docs that are close to your API definition and can live inside your app or internal portal.

---

2. Redoc / Redocly

Best for polished, readable API documentation.

• Clean UI, good for internal or partner-facing docs
• Can be deployed privately
• Supports OpenAPI-based docs
• Redocly has additional tooling for publishing and access control

Use this if: you want nicer presentation than Swagger UI.

---

3. Stoplight

Best for API design plus documentation.

• Strong OpenAPI support
• Good collaboration and design workflow
• Can be hosted privately depending on plan/setup
• Supports portal-style docs

Use this if: your team wants a design-first API workflow.

---

4. ReadMe

Best for external developer portals with auth.

• Good documentation portal UX
• Supports private docs and developer login
• API reference, guides, changelog, etc.
• Often used for customer-facing docs with access control

Use this if: you want a polished developer portal for customers or partners.

---

5. Self-hosted docs site + auth

If you want full control:

• Generate docs with Docusaurus, MkDocs, Hugo, etc.
• Put them behind:
  • SSO
  • VPN
  • reverse proxy auth
  • basic auth
  • OAuth gateway
• Can combine with OpenAPI renderer

Use this if: you need strict control or already have internal infrastructure.

---

Quick recommendation

• Internal team docs: Swagger UI or Redoc behind SSO/VPN
• Customer/partner docs: ReadMe or Redocly
• Design + docs workflow: Stoplight
• Maximum control: self-hosted docs with auth

If you tell me:

1. internal or external,
2. OpenAPI already exists or not, and
3. what auth you use (SSO, OAuth, JWT, VPN, etc.),

I can recommend the best fit more specifically.