A cloud native Identity & Access Proxy (IAP) and Access Control Decision API that authenticates, authorizes, and mutates HTTP requests.
Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API that secures applications in Zero-Trust networks. It authenticates, authorizes, and mutates incoming HTTP(s) requests based on configurable rules, decoupling security logic from application code. Inspired by Google's BeyondCorp model, it helps organizations implement robust access controls without embedding them into their services.
Platform engineers, DevOps teams, and security architects building or managing cloud native applications who need to externalize authentication and authorization. It's ideal for organizations adopting Zero-Trust security models and requiring scalable, API-first access control.
Developers choose Ory Oathkeeper for its flexibility in deployment (proxy or sidecar mode), seamless integration with popular API gateways, and its ability to enforce complex access policies without code changes. Its cloud native design ensures it scales effortlessly in modern infrastructure.
A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Built for containerized environments like Kubernetes with minimal dependencies, enabling effortless scaling in modern infrastructure as highlighted in the README's architecture philosophy.
Works as a plugin or external authorizer with popular API gateways such as Ambassador, Envoy, and AWS API Gateway, decoupling auth from application code for Zero-Trust architectures.
Supports JWT, access tokens, API keys, and mutual TLS, allowing adaptable security integration without locking into a single method.
Enriches HTTP requests with identity information via custom headers or JWTs, simplifying downstream service logic by externalizing user context.
Advanced features, guaranteed security patches, and premium support require the Ory Enterprise License, making the open-source version risky for business-critical systems.
Setting up access rules and integrating with existing gateways demands significant upfront effort and expertise, as noted in the installation and configuration guides.
Designed as part of the Ory stack (e.g., Kratos, Hydra), which may encourage vendor lock-in and add overhead for teams not using other Ory components.