ory/oathkeeper
A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go. observed · 2026-08-28
Health v2 · maintenance only
80/100
- Activity 94
- Release rhythm 51
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-02. Adoption (stars, forks) is never an input.
- gap_med: 132
- age_days: 3264
- days_rel: 166
- days_push: 37
- n_releases_24m: 4
Adoption not part of the score
3597 stars · 415 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes, and mutates incoming HTTP requests based on configurable access rules. Inspired by Google's BeyondCorp model, it secures applications in Zero-Trust networks and integrates with API gateways like Envoy, Ambassador, Nginx, and AWS API Gateway.
Use cases
- secure microservices behind a zero-trust identity-aware proxy
- authenticate and authorize incoming HTTP requests without touching application code
- act as an access control decision API for Envoy or Nginx
- inject identity information into forwarded requests as a reverse proxy
- enforce OAuth2 and OpenID Connect token validation at the edge
- decouple authorization rules from backend services
When to choose
- you want BeyondCorp-style zero-trust access control for HTTP services
- you need to centralize authentication and authorization outside your application code
- you already use Ory Kratos, Hydra, or Keto and want a proxy/decision layer
- you need a reverse proxy or decision API that integrates with existing gateways
When to avoid
- you need a full-featured API gateway with rate limiting, transformations, and traffic management
- your stack is not HTTP-based
- you want a managed IAM suite without self-hosting any components
- you only need simple session auth inside a single monolithic app
Facets
service · maturity active
auth authorization proxy api-gateway middleware http-server security security apis backend microservices self-hosted windows cloud self-hosted go identity-access-proxy zero-trust beyondcorp oauth2 openid-connect decision-api reverse-proxy iam devops linux macos docker kubernetes web-server
7 sources
- readme: https://github.com/ory/oathkeeper · fetched 2026-08-28 · 7ed9f1343044
- homepage: https://www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra · fetched 2026-08-29 · 9cd75b156cd4
- site_page: https://www.ory.com/docs/welcome · fetched 2026-08-29 · e6f2747eb4d2
- site_page: https://www.ory.com/about · fetched 2026-08-29 · e44652fde9f9
- site_page: https://www.ory.com/pricing · fetched 2026-08-29 · 35c1d920fc8d
- site_page: https://changelog.ory.com/ · fetched 2026-08-29 · c8e6b35f30bb
- site_page: https://www.ory.com/integrations · fetched 2026-08-29 · 966475eed325
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| ory/oathkeeper | main | 80 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem