# ory/oathkeeper

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.

Repository: https://github.com/ory/oathkeeper
Canonical: https://ross.abutalabs.com/products/oathkeeper
Homepage: https://www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra
Language: Go
License: Apache-2.0
License Family: permissive
Topics: api-gateway, oauth2, openid-connect, reverse-proxy, golang, ory, ory-oathkeeper, hacktoberfest
Last push: 2026-07-27T15:23:59+00:00

## Health v2 (maintenance only)
Score: 80/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 51, longevity 100
- inputs: {"age_days": 3264, "days_push": 37, "days_rel": 166, "gap_med": 132, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3597, forks 415 (observed 2026-08-28T04:08:11.363158+00:00)

## What it is
Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes, and mutates incoming HTTP requests based on configurable access rules. Inspired by Google's BeyondCorp model, it secures applications in Zero-Trust networks and integrates with API gateways like Envoy, Ambassador, Nginx, and AWS API Gateway.

## Use cases
- secure microservices behind a zero-trust identity-aware proxy
- authenticate and authorize incoming HTTP requests without touching application code
- act as an access control decision API for Envoy or Nginx
- inject identity information into forwarded requests as a reverse proxy
- enforce OAuth2 and OpenID Connect token validation at the edge
- decouple authorization rules from backend services

## When to choose
- you want BeyondCorp-style zero-trust access control for HTTP services
- you need to centralize authentication and authorization outside your application code
- you already use Ory Kratos, Hydra, or Keto and want a proxy/decision layer
- you need a reverse proxy or decision API that integrates with existing gateways

## When to avoid
- you need a full-featured API gateway with rate limiting, transformations, and traffic management
- your stack is not HTTP-based
- you want a managed IAM suite without self-hosting any components
- you only need simple session auth inside a single monolithic app

## Facets
- artifact type: service
- maturity: active
- function: auth, authorization, proxy, api-gateway, middleware, http-server, security
- domain: security, apis, backend, microservices, self-hosted
- platform: windows, cloud, self-hosted, go
- tags: identity-access-proxy, zero-trust, beyondcorp, oauth2, openid-connect, decision-api, reverse-proxy, iam, devops, linux, macos, docker, kubernetes, web-server

## Member repositories
- ory/oathkeeper (main) score 80

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:11.363158+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:33:47.093818+00:00, confidence not recorded.
  - readme: https://github.com/ory/oathkeeper (fetched 2026-08-28T04:08:11.363158+00:00, sha 7ed9f1343044)
  - homepage: https://www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra (fetched 2026-08-29T09:27:09.983416+00:00, sha 9cd75b156cd4)
  - site_page: https://www.ory.com/docs/welcome (fetched 2026-08-29T09:27:09.995041+00:00, sha e6f2747eb4d2)
  - site_page: https://www.ory.com/about (fetched 2026-08-29T09:27:09.999094+00:00, sha e44652fde9f9)
  - site_page: https://www.ory.com/pricing (fetched 2026-08-29T09:27:09.992674+00:00, sha 35c1d920fc8d)
  - site_page: https://changelog.ory.com/ (fetched 2026-08-29T09:27:09.997125+00:00, sha c8e6b35f30bb)
  - site_page: https://www.ory.com/integrations (fetched 2026-08-29T09:27:10.000907+00:00, sha 966475eed325)
- Data as of 2026-08-30T08:39:29.467469+00:00.