Open-source authorization software
526 open-source libraries, tools and applications tagged authorization, ranked by how closely authorization is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
526 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Vaultwarden Vaultwarden is an unofficial, lightweight Bitwarden-compatible server written in Rust. It provides a self‑hosted password‑manager service t… | 99 | 68819 | active |
| Keycloak Keycloak is an open source identity and access management server that provides authentication, authorization, and user federation for moder… | 100 | 37423 | active |
| Tailscale Tailscale is an open‑source zero‑trust networking platform built on WireGuard that provides secure, identity‑based connectivity across devi… | 98 | 37016 | active |
| Vault Vault is a HashiCorp service for secure secret storage, dynamic secret generation, and privileged access management. It provides a unified … | 100 | 36390 | active |
| Hasura GraphQL Engine Hasura GraphQL Engine is an open-source engine that auto-generates instant, realtime GraphQL APIs (and REST endpoints) over existing databa… | 98 | 32132 | active |
| JumpServer JumpServer is an open-source Privileged Access Management (PAM) platform that provides a unified workspace for secure access to SSH, RDP, K… | 100 | 31794 | active |
| JumpServer JumpServer is an open-source Privileged Access Management (PAM) platform and bastion host that provides secure, audited access to SSH, RDP,… | 100 | 31794 | stable |
| Better Auth Better Auth is a framework‑agnostic authentication and authorization library for TypeScript. It provides a rich set of built‑in features an… | 88 | 30360 | active |
| Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript that ships with comprehensive features like e… | 88 | 30360 | active |
| Infisical/infisical Infisical is an open‑source platform for managing secrets, certificates, and privileged access across environments. It provides a web UI, C… | 95 | 29809 | active |
| NetBird NetBird is an open‑source zero‑trust networking platform that creates a WireGuard‑based overlay network for secure private connectivity. It… | 92 | 29443 | active |
| Authelia Authelia is an open‑source authentication and authorization server that provides single sign‑on (SSO) and multi‑factor authentication (MFA)… | 98 | 29294 | active |
| Authelia Authelia is an open-source authentication and authorization server and portal providing single sign-on (SSO) and multi-factor authenticatio… | 98 | 29294 | active |
| authentik authentik is an open‑source identity provider and single sign‑on platform that supports SAML, OAuth2/OIDC, LDAP, RADIUS, SCIM and more. It … | 95 | 25962 | active |
| authentik authentik is an open-source Identity Provider (IdP) and Single Sign-On (SSO) platform supporting SAML, OAuth2/OIDC, LDAP, SCIM, RADIUS, and… | 95 | 25962 | active |
| flipped-aurora/gin-vue-admin Gin-Vue-Admin is a full‑stack admin platform that combines a Go Gin backend with a Vite+Vue3 frontend. It provides out‑of‑the‑box features … | 90 | 25063 | active |
| nocobase/nocobase NocoBase is an open‑source AI‑enhanced no‑code platform that lets you build internal business systems quickly via a WYSIWYG interface or AI… | 95 | 24615 | active |
| Passport Passport is a lightweight authentication middleware for Node.js that works with Express. It provides a simple, extensible API and a large c… | 32 | 23521 | active |
| Pangolin Pangolin is an open‑source SASE platform that unifies a WireGuard‑based VPN, zero‑trust reverse proxy, privileged access management, and an… | 85 | 23082 | active |
| Teleport Teleport is a self‑hosted identity‑aware access proxy that provides secure, short‑lived certificate authentication for SSH, Kubernetes, dat… | 88 | 20995 | active |
| Teleport Teleport is an identity-aware access proxy and certificate authority that provides unified, credential-free access to SSH servers, Kubernet… | 88 | 20995 | stable |
| Apache Casbin Apache Casbin is an open‑source authorization library that enforces access control policies across multiple programming languages. It suppo… | 96 | 20433 | active |
| Apache Casbin Apache Casbin is an open-source authorization library that enforces access control using models such as ACL, RBAC, ABAC, ReBAC, and MAC, de… | 96 | 20433 | stable |
| kortix-ai/suna Kortix is an open-source AI operating system that lets teams build, run, and govern AI agents from a single git‑based repository. It provid… | 86 | 20288 | active |
| tiann/KernelSU KernelSU is a kernel-based root solution for Android that runs inside the Linux kernel to grant root access. It provides stealthy, permissi… | 95 | 19399 | active |
| dromara/Sa-Token Sa-Token is a lightweight Java authentication and authorization library that provides login, permission, SSO, OAuth2 and token management o… | 91 | 19071 | active |
| ory/hydra Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider server written in Go, handling token issuance, client management, an… | 72 | 17563 | stable |
| ZITADEL ZITADEL is an open-source identity and access management (IAM) platform providing authentication and authorization out of the box, includin… | 94 | 15193 | active |
| Casdoor Casdoor is an open-source, self-hosted Identity and Access Management (IAM) and single sign-on (SSO) platform with a web UI, written in Go.… | 94 | 14524 | active |
| ABP Framework ABP Framework is an open-source, opinionated application framework for building enterprise web applications on .NET and ASP.NET Core. It pr… | 97 | 14441 | active |
| spatie/laravel-permission A Laravel package that lets you associate users (and other Eloquent models) with roles and permissions stored in the database. Permissions … | 91 | 12965 | stable |
| go-admin go-admin is a front-end/back-end separated admin management system scaffold built on Gin (Go) and Vue 3 with Element UI, Arco Design, and A… | 98 | 12800 | active |
| open-policy-agent/opa Open Policy Agent (OPA) is a general-purpose, open-source policy engine that unifies policy enforcement across the stack using a high-level… | 96 | 12264 | stable |
| Apereo CAS (Central Authentication Service) Apereo CAS is an enterprise open-source identity provider and single sign-on server implemented in Java on Spring Boot. It centralizes auth… | 99 | 11390 | stable |
| dexidp/dex Dex is a federated OpenID Connect (OIDC) and OAuth 2.0 identity provider that issues signed ID tokens (JWTs) for applications. It acts as a… | 94 | 11183 | stable |
| pennersr/django-allauth django-allauth is an integrated set of Django applications covering authentication, registration, account management, and third-party (soci… | 75 | 10373 | stable |
| spring-projects/spring-security Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications, and the de-facto s… | 97 | 9650 | stable |
| pocket-id/pocket-id Pocket ID is a self-hosted, OpenID Connect Certified identity provider that lets users sign in to applications using passkeys instead of pa… | 86 | 9626 | active |
| teamhanko/hanko Hanko is an open-source authentication and user management platform built in Go, offering passwords, passkeys (WebAuthn/FIDO2), MFA, OAuth … | 95 | 9041 | active |
| AdminJS AdminJS is an open-source admin panel library for Node.js applications that auto-generates a customizable React-based admin UI from your da… | 40 | 8998 | active |
| sitaramc/gitolite Gitolite is a self-hosted Git repository hosting tool for Unix servers that provides fine-grained, file-based access control over repositor… | 72 | 8595 | stable |
| varvet/pundit Pundit is a Ruby gem that provides minimal authorization for Rails applications using plain Ruby policy classes and object-oriented design.… | 74 | 8521 | stable |
| tinyauthapp/tinyauth Tinyauth is a lightweight, OpenID Certified™ authentication and authorization server written in Go, shipped as a single static binary. It w… | 86 | 8366 | active |
| Solid Solid is a set of open standards and tools for building decentralized web applications where users store their data in personal online data… | 10 | 8091 | active |
| warp-tech/warpgate Warpgate is an open-source, clientless bastion host and privileged access management (PAM) tool written in Rust that transparently proxies … | 98 | 8038 | active |
| SpiceDB SpiceDB is an open-source, Google Zanzibar-inspired database for storing, computing, and validating fine-grained authorization data at scal… | 97 | 7124 | stable |
| CASL CASL is an isomorphic JavaScript authorization library that restricts what resources a user is allowed to access, using declarative rules t… | 100 | 7100 | stable |
| hexclave/hexclave Open-source user infrastructure platform handling authentication, teams, RBAC, payments, emails, and analytics for SaaS apps. Deployable as… | 89 | 6868 | active |
| Pig Pig is an enterprise-grade RBAC rapid development platform built on Spring Cloud, Spring Boot 4, and OAuth2 (Spring Authorization Server), … | 81 | 6690 | active |
| Ferry Ferry is an open-source ticketing and workflow engine built with Gin (Go) and Vue + Element UI. It supports configurable approval flows, te… | 34 | 6616 | active |
| redmine/redmine Redmine is a flexible, self-hosted project management web application written in Ruby on Rails. It provides issue tracking, wikis, forums, … | 77 | 6050 | stable |
| OpenFGA OpenFGA is a high-performance, open-source fine-grained authorization and permission engine inspired by Google's Zanzibar, owned by the CNC… | 97 | 5846 | stable |
| CanCanCommunity/cancancan CanCanCan is an authorization library for Ruby and Ruby on Rails that restricts which resources a user can access. Permissions are defined … | 65 | 5683 | stable |
| next-terminal/next-terminal Next Terminal is an open-source bastion host (jump server) and interactive session auditing system supporting SSH, RDP, VNC, Telnet, HTTP, … | 96 | 5647 | active |
| Doorkeeper Doorkeeper is a Ruby gem (Rails engine) that adds OAuth 2.0 provider functionality to Ruby on Rails or Grape applications. It implements th… | 94 | 5523 | stable |
| permitio/opal OPAL (Open Policy Administration Layer) is an administration layer for policy engines such as Open Policy Agent (OPA) and Cedar Agent. It d… | 95 | 5513 | active |
| kanidm/kanidm Kanidm is a simple, secure, and fast identity management platform written in Rust that acts as a complete identity provider for other appli… | 98 | 5481 | active |
| unkeyed/unkey Unkey is an open-source, source-available developer platform for modern APIs that combines instant deployments, a globally distributed gate… | 92 | 5462 | active |
| Authlib Authlib is a Python library for building OAuth 1.0/2.0 and OpenID Connect clients, authorization servers, and protected resource servers, w… | 97 | 5430 | stable |
| ory/keto Ory Keto is an open-source authorization server implementing Google's Zanzibar model for scalable, low-latency permission checks. It suppor… | 74 | 5402 | active |
| OpenIddict OpenIddict is a flexible OAuth 2.0/OpenID Connect framework for .NET, providing server, client, and token validation stacks. It supports st… | 96 | 5257 | stable |
| homarr-labs/homarr Homarr is a self-hosted web dashboard for organizing and monitoring your apps and services, with 40+ integrations, built-in icons, and drag… | 90 | 5118 | active |
| Pomerium Pomerium is an open-source, identity- and context-aware reverse proxy that provides clientless, zero-trust access to internal applications … | 99 | 5056 | active |
| dpgaspar/Flask-AppBuilder Flask-AppBuilder is a rapid application development framework built on top of Flask, providing automatic CRUD generation for SQLAlchemy mod… | 97 | 4962 | stable |
| Orchid Laravel Admin Platform Orchid is a free, open-source Laravel package for rapid code-driven development of back-office applications, admin panels, and dashboards. … | 87 | 4797 | active |
| Heeexy/SpringBoot-Shiro-Vue A full-stack reference project demonstrating fine-grained RBAC permission management using Spring Boot on the backend and Vue with ElementU… | 65 | 4654 | active |
| build-trust/ockam Ockam is a Rust library and CLI toolkit for building secure-by-design distributed applications with end-to-end encryption, cryptographic id… | 57 | 4637 | active |
| Cerbos Cerbos is an open-core, language-agnostic policy decision point (PDP) that externalizes authorization from application code using context-a… | 94 | 4616 | stable |
| apache/shiro Apache Shiro is a comprehensive Java security framework providing authentication, authorization, cryptography, and enterprise session manag… | 92 | 4460 | active |
| zoontek/react-native-permissions A React Native library providing a unified permissions API across iOS, Android, and Windows. It lets apps check, request, and manage device… | 96 | 4375 | active |
| open-policy-agent/gatekeeper Gatekeeper is a CNCF policy controller for Kubernetes built on Open Policy Agent (OPA). It enforces admission policies via customizable con… | 97 | 4303 | stable |
| marmotedu/iam IAM is an enterprise-grade identity and access management system written in Go, used to authenticate users and authorize access to resource… | 25 | 4213 | active |
| Authboss Authboss is a modular authentication system for Go web applications, providing pluggable modules for common auth features like login, regis… | 64 | 4198 | active |
| simov/grant Grant is an OAuth proxy middleware for Node.js supporting 200+ OAuth providers across OAuth 1.0a, OAuth 2.0, and OpenID Connect. It integra… | 32 | 4165 | stable |
| Boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 10 | 4067 | active |
| OAuth2 Server A Node.js module for implementing a fully RFC 6749/6750 compliant OAuth2 server/provider, framework-agnostic with official wrappers for Exp… | 23 | 4063 | active |
| stylefeng/Guns Guns is a modern Java application development framework built on Spring Boot 3, Vue 3, and JDK 17, providing a full-stack admin scaffold wi… | 52 | 3974 | active |
| django-guardian/django-guardian django-guardian is a Python library that implements per-object (row-level) permissions on top of Django's built-in authorization backend. I… | 97 | 3920 | stable |
| node-oidc-provider A Node.js library implementing an OpenID Certified OAuth 2.0 Authorization Server with full OpenID Connect support. It is highly configurab… | 95 | 3816 | active |
| go-oauth2/oauth2 A Go library for building OAuth 2.0 authorization servers that issue and manage access tokens. It supports the standard OAuth 2.0 protocol … | 83 | 3623 | stable |
| ory/oathkeeper Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes… | 74 | 3605 | active |
| JosephSilber/bouncer Bouncer is a PHP library for managing roles and abilities on Eloquent models, with support for ownership checks, forbidden abilities, cachi… | 61 | 3578 | stable |
| maticzav/graphql-shield GraphQL Shield is a TypeScript library that lets you build a permission layer for GraphQL servers using an intuitive rule-based API. It wor… | 66 | 3576 | stable |
| guildxyz/guild.xyz Guild.xyz is an open-source web application for token-curated community membership management, providing token-gated access to Discord, Tel… | 52 | 3478 | active |
| Blitz.js Blitz.js is a fullstack toolkit built on top of Next.js that adds a typesafe RPC data layer, authentication/authorization, and code scaffol… | 54 | 14125 | maintenance |
| Metorial Metorial is an open-source identity and access control plane for AI agents, providing 1200+ verified MCP integrations with centralized auth… | 63 | 3356 | active |
| workos/authkit AuthKit is WorkOS's authentication UI and User Management platform, offering a fully themeable hosted login box or a headless API for build… | 70 | 3346 | active |
| django-oauth/django-oauth-toolkit Django OAuth Toolkit is an OAuth 2.0 authorization server and resource server library for Django projects, built on OAuthLib and RFC 6749 c… | 92 | 3344 | active |
| RolifyCommunity/rolify rolify is a Ruby gem providing simple role management for Rails applications, with support for scoping roles to specific resource objects. … | 48 | 3174 | stable |
| kite-org/kite Kite is a lightweight, modern web-based Kubernetes dashboard that unifies multi-cluster management, resource operations, observability, ent… | 86 | 3172 | active |
| ContainerSSH ContainerSSH is an SSH server written in Go that launches on-demand containers in Docker or Kubernetes for each connecting user. It support… | 77 | 3087 | active |
| jeremykenedy/laravel-auth A complete Laravel 12 starter application with email registration verification, social authentication via Socialite, user roles and permiss… | 98 | 3041 | active |
| oauthlib/oauthlib OAuthLib is a Python framework implementing the OAuth 1.0 (RFC 5849) and OAuth 2.0 (RFC 6749) request-signing and authorization logic in a … | 72 | 2982 | stable |
| ZenStack ZenStack is a TypeScript data layer toolkit providing a schema-first, type-safe ORM with a Prisma-compatible API built on Kysely, plus buil… | 95 | 2954 | active |
| Apache Casbin Node-Casbin is an open-source authorization library for Node.js and Browser that enforces access control based on configurable models such … | 91 | 2918 | stable |
| voidauth/voidauth VoidAuth is an open-source single sign-on (SSO) and user management provider for self-hosted applications, acting as an OIDC provider, prox… | 86 | 2870 | active |
| ArgoZhang/BootstrapAdmin BootstrapAdmin is a free, premium-looking admin control panel built on Bootstrap 4.x and .NET (C#). It provides a ready-made management bac… | 54 | 2868 | active |
| defguard Defguard is a self-hosted zero-trust access management platform combining WireGuard VPN with built-in MFA/2FA, identity and access manageme… | 99 | 2866 | active |
| bezhanSalleh/filament-shield A Filament plugin that adds role and permission-based access management to Filament admin panels, built on spatie/laravel-permission. It ge… | 95 | 2828 | active |
| PowerDNS-Admin/PowerDNS-Admin PowerDNS-Admin is a self-hosted web interface for managing the PowerDNS Authoritative Server. It provides DNS zone and record management wi… | 96 | 2819 | active |
page 1 / 6 next →