An open-source implementation of Google's Zanzibar authorization system, providing a scalable and customizable permission server.
Ory Keto is an open-source authorization server that implements Google's Zanzibar model for scalable and consistent permission management. It solves the problem of slow or broken permission systems by providing low-latency checks and horizontal scalability for billions of relationships. The server supports various access control models, including ACL, RBAC, and ReBAC, through its custom Ory Permission Language.
Developers and platform engineers building large-scale applications that require fine-grained, performant authorization, such as SaaS platforms, enterprise systems, and cloud-native services.
Developers choose Ory Keto for its proven Zanzibar architecture, which ensures high scalability and low latency, along with the flexibility of the Ory Permission Language to define complex policies without vendor lock-in.
The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements Google's Zanzibar model for scalable and consistent global authorization, as evidenced by its ability to handle billions of relationships with low latency, making it ideal for large-scale applications.
Uses the Ory Permission Language (OPL) to define complex access control models like ReBAC, ACL, and RBAC, providing high customization without vendor lock-in, as shown in the quickstart examples.
Delivers permission checks in sub-10ms, suitable for high-traffic applications requiring fast authorization decisions, a key feature highlighted in the README.
Built with cloud architecture best practices, supporting deployment on Kubernetes and modern orchestration platforms for easy scaling and management, as detailed in the deployment options.
Part of the Ory ecosystem, seamlessly integrating with Ory Kratos for identity management and Ory Hydra for OAuth2, offering a comprehensive security stack.
Self-hosting requires configuring databases like PostgreSQL and managing deployments, which adds operational overhead for teams without dedicated DevOps resources.
Critical production features such as advanced security patches, support, and multi-tenancy are only available with the Ory Enterprise License, limiting the open-source version.
Adopting the Ory Permission Language and Zanzibar concepts requires significant upfront investment, which can slow down initial development and integration.
Introducing a separate authorization server adds network latency and failure points compared to embedded libraries, complicating system architecture and reliability.