Authorizer

Authorizer is an open-source (Apache-2.0) authentication and authorization server you deploy on your own infrastructure, keeping every user record in a database you control. Built in Go, it combines OAuth2/OIDC identity, relationship-based fine-grained authorization via an embedded OpenFGA engine, and a built-in MCP server for AI agents—all in a single binary. The project has accumulated over 2,000 GitHub stars and reached version 2.4.1 as of September 2026.

What It Is

Authorizer is a self-hosted alternative to hosted identity platforms such as Auth0 or Okta. Rather than storing user data on a vendor's servers and paying per-seat fees, teams deploy Authorizer on their own cloud, VPC, or one-click platform (Railway, Heroku, Render, Koyeb) and connect it to whichever database their application already uses. It handles the full authentication and authorization lifecycle—login, sessions, MFA, enterprise SSO, fine-grained permissions, and AI-aware access control—without requiring separate services.

Core Authentication Capabilities

Authorizer ships a broad set of auth recipes out of the box:

• Login methods: Email/password, magic link, social logins (Google, GitHub, Facebook, LinkedIn, Apple, Discord, Twitter, Twitch, Roblox, Microsoft), and WebAuthn passkeys (Touch ID, Face ID, Windows Hello, FIDO2 hardware keys)
• MFA: TOTP authenticator apps, email OTP, SMS OTP via Twilio, and passkeys as a second factor, with brute-force lockout and admin recovery
• Enterprise SSO: SAML 2.0 as both Service Provider and Identity Provider, OIDC federation, SCIM 2.0 provisioning, verified email domains, and home-realm discovery
• Machine-to-machine: client_credentials grant, secretless workload identity (RFC 7523, SPIFFE JWT-SVIDs, Kubernetes TokenReview), and RFC 8693 token exchange for agent delegation
• Session security: HTTP-only cookies, CSRF/CORS/HSTS/CSP defaults, rate limiting, brute-force protection, and a dedicated at-rest encryption key

Fine-Grained Authorization and Permission-Aware AI

Authorizer embeds an OpenFGA engine—the open-source implementation of Google's Zanzibar relationship-based access control—directly in the same Go binary that handles login. This means check_permissions and list_permissions run in-process with no extra service to deploy.

For AI and RAG pipelines, this architecture enables permission-aware retrieval: the application fetches the current user's allow-list using their own token, then pre-filters the vector search so the model only ever sees documents that user is permitted to read. Forbidden chunks are never scored, never placed in the prompt, and the pipeline fails closed if authorization is unavailable. Revoking access takes effect on the user's next query with no re-indexing required.

The built-in MCP server exposes a curated, read-only subset of the API (profile, check_permissions, list_permissions) to AI hosts including Claude Desktop, Claude Code, Cursor, and any MCP-compatible client. It is stdio-only and cannot be exposed over the network; credential-issuing and destructive operations are never exposed.

Database and Deployment Flexibility

Authorizer supports 13+ databases across SQL, NoSQL, and graph backends: PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, MongoDB, Cassandra, ScyllaDB, ArangoDB, YugabyteDB, PlanetScale, AWS DynamoDB, and Couchbase. Users can request additional database support via GitHub issues.

Deployment options include:

• Docker (single command, SQLite or external DB)
• Kubernetes with a Helm chart (v2.2.1, appVersion 2.3.0)
• One-click platforms: Railway, Heroku, Render, Koyeb, RepoCloud, Alibaba Cloud
• Binaries for macOS (amd64/arm64) and Linux (amd64/arm64)

APIs, SDKs, and Integration

Authorizer exposes GraphQL, REST, and gRPC APIs over standard OAuth2 and OpenID Connect flows. Official SDKs are available for Go, JavaScript/TypeScript, and React; the Python SDK is in pre-release; Vue and Svelte SDKs are in beta; and a Flutter SDK is in progress. The fine-grained authorization helpers (check_permissions and list_permissions) ship in the Go, JavaScript, and Python SDKs. A built-in login page is included, and a React SDK enables custom UI embedding in three lines of code.

Update: Version 2.4.1

The latest release is 2.4.1, published on September 3, 2026. Authorizer v2 introduced a significant architectural change: all configuration is now passed as CLI arguments at startup rather than read from .env files or set via the dashboard. Required flags include --url, --client-id, --client-secret, --admin-secret, --jwt-*, and --encryption-key. A migration guide (MIGRATION.md) covers the full mapping from v1 environment variables to v2 CLI flags. The roadmap includes React Native, Android, iOS, and PHP SDKs, a WordPress plugin, and additional cloud deployment targets.