Logo
Deploy Now

Categories

Developer Tools Security API Identity Management Authorization CNCF Access Control

Stars

5,640

Forks

468

Watchers

38

Developer links

Last Updated: 08-22-2026 06:22 PM (UTC)

OpenFGA

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

OpenFGA
OpenFGA
OpenFGA
OpenFGA
OpenFGA

Benefits

  • Sub-Millisecond Authorization Checks
  • Zanzibar-inspired resolution engine evaluates fine-grained access control decisions in single-digit milliseconds with BatchCheck API deduplication processing multiple checks per single request.
  • Flexible Multi-Model Access Control
  • Combines relationship-based, role-based, and attribute-based access control patterns through a purpose-built DSL with contextual tuples and CEL conditional expressions for complex policies.
  • CNCF Incubating Project Governance
  • Cloud Native Computing Foundation incubating project with open RFC process, transparent governance model, and production adoption by Auth0, Grafana Labs, Canonical, and Docker organizations.
  • Comprehensive Developer Tooling
  • Official SDKs for five languages, Terraform provider for infrastructure-as-code, VS Code extension with syntax validation, GitHub Actions for CI/CD, and Helm charts for Kubernetes deployment.

Features

  • gRPC and HTTP APIs
  • Dual-protocol server exposing Check, ListObjects, ListUsers, Expand, and BatchCheck endpoints with pre-shared key and granular store-level authentication.
  • Browser Authorization Playground
  • Built-in interactive playground for visually modeling authorization schemas, writing relationship tuples, and testing access control queries before production deployment.
  • Multiple Storage Backends
  • Production-grade persistence with PostgreSQL 14+, MySQL 8, and SQLite beta, plus an in-memory adapter for rapid development and automated testing.
  • Conditional Relationship Tuples
  • CEL expression-based conditions on relationship tuples enabling attribute-based access control patterns alongside relationship-based and role-based models.
  • OpenTelemetry Instrumentation
  • Native OpenTelemetry support for tracing and metrics integration with existing monitoring infrastructure including Prometheus, Jaeger, and Grafana stacks.