eclipse-biscuit/biscuit

Health v2 · maintenance only

Adoption not part of the score

1142 stars · 33 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Biscuit is a specification and reference implementation for a delegated, decentralized, capability-based authorization token, written in Rust. Tokens can be created, attenuated (restricted), and verified offline using cryptographic signatures and a Datalog-based policy language.

Use cases

• issue delegated authorization tokens with offline verification
• attenuate tokens to restrict permissions for downstream services
• replace JWTs with revocable, capability-based tokens
• implement decentralized access control across microservices
• add third-party blocks to tokens for multi-party authorization

When to choose

• you need decentralized authorization without a central token introspection service
• you want tokens that can be safely attenuated by holders
• you need offline verification of credentials and policies

When to avoid

• you only need simple session cookies or basic JWT workflows
• your stack relies on a language without a mature Biscuit implementation (e.g. Go lacks v3.1+ features)
• you require a formally audited security design (audit is still pending)

Facets

library · maturity active

auth authorization cryptography serialization security apis developer-tools rust cross-platform biscuit-tokens capability-tokens decentralized-authorization token-attenuation datalog

Member repositories

For agents

markdown · JSON · MCP: product_card(name="eclipse-biscuit/biscuit")