aicoolies logo
OpenFGA logo
OpenFGA logo

OpenFGA

Fine-grained authorization engine by Okta

open sourceupdated Jul 7, 2026

OpenFGA is an open-source authorization engine inspired by Google Zanzibar, built and maintained by Okta (Auth0). It provides relationship-based access control with a flexible modeling language, sub-millisecond permission checks, and SDKs for major languages. OpenFGA is used by companies including Grafana Labs, Canonical, and Docker for fine-grained access control in multi-tenant applications.

OpenFGA brings Google Zanzibar's relationship-based access control model to every developer through an open-source engine backed by Okta's Auth0 team. The system models authorization as a graph of relationships between users and objects, evaluating permission queries by traversing these relationships according to rules defined in an authorization model. This approach scales naturally from simple role-based access to complex scenarios involving shared folders, team hierarchies, and cross-organizational permissions.

The authorization modeling language uses a DSL that defines types, their relations, and how permissions compose. Developers write tuples that represent relationships — like 'user:anne is viewer of document:readme' — and the engine resolves whether a user has a specific permission by following the relationship graph. OpenFGA supports conditional relationships based on context, enabling time-based or attribute-based access decisions. The query engine is optimized for sub-millisecond latency even with millions of stored relationship tuples.

With over 5,000 GitHub stars and CNCF sandbox status, OpenFGA has established itself alongside SpiceDB as a leading open-source Zanzibar implementation. Okta provides official SDKs for JavaScript, Python, Go, Java, .NET, and Ruby, along with a visual playground for testing authorization models. The engine runs as a standalone service with PostgreSQL or MySQL backends and integrates with existing identity providers. Production users include Grafana Labs for dashboard permissions, Canonical for Ubuntu Pro access, and Docker for container registry authorization.

Pricing

Free and open source under Apache-2.0 license

Platforms

Docker — SDKs for JS, Python, Go, Java, .NET, Ruby

Categories

Tags

Use Cases

Related Tools

computed discovery: shared active categories · kept separate from editor-verified Alternatives

KTransformers parent kvcache-ai logo

KTransformers

Heterogeneous CPU-GPU inference and SFT for large MoE models

Open-source framework for running and fine-tuning large Mixture-of-Experts models with heterogeneous CPU-GPU execution, optimized kernels, limited VRAM and SGLang or LLaMA-Factory integrations.

Open Source
vLLM Production Stack parent vLLM logo

vLLM Production Stack

Official Kubernetes and Helm reference stack built on the vLLM inference engine

Official vLLM reference implementation for scaling the existing inference engine on Kubernetes with Helm, request routing, KV-cache offload, autoscaling and Prometheus/Grafana observability.

Open Source
Dynamo logo

NVIDIA Dynamo

Distributed inference orchestration above vLLM, SGLang and TensorRT-LLM

Open-source, datacenter-scale orchestration layer that coordinates vLLM, SGLang and TensorRT-LLM across nodes with disaggregated serving, KV-aware routing, multi-tier cache management and automatic scaling.

Open Source
GPUStack logo

GPUStack

Open-source GPU control plane for scalable AI model serving

Open-source GPU cluster manager that configures vLLM, SGLang, TensorRT-LLM or custom engines, serves models through compatible APIs, and provisions SSH-accessible GPU instances across on-premises, Kubernetes and cloud environments.

Open Source
Mooncake logo

Mooncake

Disaggregated KV cache storage and transfer for LLM serving

Open-source infrastructure for disaggregated LLM serving that pools KV caches across prefill and decode workers, with high-performance transfer, distributed storage and integrations for vLLM and SGLang.

Open Source
LMCache logo

LMCache

Reusable KV cache infrastructure for scalable LLM inference

Open-source KV cache management layer that persists, offloads and reuses model key-value caches across requests and serving engines to reduce repeated prefill work and improve inference throughput.

Open Source

Comparisons

SpiceDB vs OpenFGA — Google Zanzibar Authorization Engines Compared

SpiceDB and OpenFGA are the two leading open-source implementations of Google's Zanzibar authorization system. Both provide relationship-based access control at scale, but they differ in backing, ecosystem integration, and operational characteristics. This comparison helps teams choose the right Zanzibar implementation for their authorization infrastructure.

SpiceDBOpenFGA

FAQ

What is OpenFGA?

OpenFGA is an open-source authorization engine inspired by Google Zanzibar, built and maintained by Okta (Auth0). It provides relationship-based access control with a flexible modeling language, sub-millisecond permission checks, and SDKs for major languages. OpenFGA is used by companies including Grafana Labs, Canonical, and Docker for fine-grained access control in multi-tenant applications.

Is OpenFGA free?

Yes — OpenFGA is open source and free to use. Free and open source under Apache-2.0 license

Is OpenFGA open source?

Yes — OpenFGA is open source.

What are the best OpenFGA alternatives?

The top editor-verified OpenFGA alternatives are SpiceDB, Ory.