Top 23 Go Authorization Projects

Authorization

• Add a project

1. authentik

   1 188 25,837 10.0 Go

   The authentication glue you need.

   

   Project mention: authentik VS clavex - a user suggested alternative | libhunt.com/r/authentik | 2026-07-04

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. casbin

   2 41 20,412 8.0 Go

   Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

   

   Project mention: Permission Systems for Enterprise That Scale | news.ycombinator.com | 2025-12-24

   Worth mentioning Casbin as well (https://github.com/casbin/casbin) - it's been around for a while and takes a slightly different approach. Instead of being purely Zanzibar-inspired, it uses a PERM (Policy, Effect, Request, Matchers) metamodel that lets you implement RBAC, ABAC, or ReBAC depending on what fits your use case.

4. Ory Hydra

   3 40 17,586 9.3 Go

   Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

   

   Project mention: Show HN: Open-source OAuth2 server Ory Hydra 25.4 ships OAuth2.1 and Device Auth | news.ycombinator.com | 2025-11-11

5. zitadel

   4 93 15,180 9.7 Go

   ZITADEL - The best of Auth0 and Keycloak combined. Built for the serverless era.

   

   Project mention: zitadel VS clavex - a user suggested alternative | libhunt.com/r/zitadel | 2026-07-04

6. OPA (Open Policy Agent)

   5 121 12,297 9.8 Go

   Open Policy Agent (OPA) is an open source, general-purpose policy engine.

   

   Project mention: AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood | dev.to | 2026-10-07

   Relationship-based systems can evaluate how an identity relates to a resource. Cedar, the AWS open-source access control language, or Open Policy Agent, move those authorization decisions into centrally managed policy that can be evaluated consistently at runtime and represented as code or configuration.

7. spicedb

   6 45 7,119 9.5 Go

   Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

   

   Project mention: Go Analysis Framework: modular static analysis by go team | news.ycombinator.com | 2026-07-26

   For SpiceDB[0], we've found a lot of success using this framework to define our own analyzers; it's probably 10x easier now with LLMs. No need for tribal knowledge or more time wasted on code review if you can just turn it into a linter and move on.

   [0]: https://github.com/authzed/spicedb/tree/main/tools/analyzers

8. permify

   7 48 5,962 9.5 Go

   An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

   

   Project mention: We Built an Authorization Engine That the Fortune 100 Bet On | news.ycombinator.com | 2026-05-02

   We've had community members bring this up[0].

   While there are a variety of approaches, currently our recommended solution is to use the Watch API[1] to create Leopard-style (matrix) indexes in the client’s database to enable efficient permission filtering using schema and YAML-based index definitions.

   We started down the path of building an example watch consumer[2] but both the team and the interested community members were pulled off it for reasons, but not for technical ones.

   This FAQ may be helpful to learn more about leopard indexes[3].

   0: https://github.com/Permify/permify/issues/2681

   1: https://fusionauth.io/permify-docs/api-reference/watch/watch...

   2: https://github.com/Permify/indexer

   3: http://nil.csail.mit.edu/6.5840/2023/papers/zanzibar-faq.txt

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. openfga

    8 27 5,905 9.4 Go

    A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

    

    Project mention: ReBAC isn't the problem. The ReBAC tools I tried are. | dev.to | 2026-08-11

    It's a model I like, and I want to say that up front, because what follows isn't a criticism of ReBAC. I spent a few weeks integrating OpenFGA into a prototype to use it properly: declarative model, sixteen test scenarios, a hundred and twenty assertions running offline in two seconds with no database and no application. It worked well. I removed it anyway.

11. unkey

    9 5 5,454 9.9 Go

    The Developer Platform for Modern APIs

    

    Project mention: What I Look For When a Risky PR Lands | dev.to | 2026-06-29

    A few weeks ago I pointed a hand-built risk digest at unkey, a real open-source auth and API-keys codebase with 58 open pull requests, and asked it one question. If I were the senior on this team, which five would I want to look at before they merge?

12. Ory Keto

    10 37 5,407 9.2 Go

    The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.

    

    Project mention: Permission Systems for Enterprise That Scale | news.ycombinator.com | 2025-12-24

13. cerbos

    11 47 4,609 9.6 Go

    Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

    

    Project mention: cerbos VS onequery - a user suggested alternative | libhunt.com/r/cerbos | 2026-06-01

14. Ory Oathkeeper

    12 4 3,609 9.3 Go

    A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.

    

15. fosite

    13 6 2,624 5.0 Go

    Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.

    

    Project mention: Rewriting My MCP Server from PHP to Go | dev.to | 2026-04-15

    The PHP version also had a custom OAuth implementation. For Go, the common choice is fosite, but I decided to build the OAuth 2.1 authorization server from scratch again.

16. auth

    14 50 2,573 9.4 Go

    A JWT based API for managing users and issuing JWT tokens (by supabase)

    

    Project mention: Supabase Flutter deep link not working: scheme, Info.plist, AndroidManifest and the underscore bug | dev.to | 2026-09-04

    If app.scheme or app.host contains an underscore, for example my_app://callback, the redirect fails even when Info.plist, AndroidManifest and the Supabase allow-list all list it correctly. Google's OAuth redirect handling mangles underscores in redirect URLs: a scheme or host like my_app always fails Supabase's redirect-URL check and silently falls back to the Site URL. This is tracked upstream as supabase/auth#2447 and there is no server-side fix. The underscore itself is the bug, so rename it to a hyphen everywhere it appears.

17. caddy-security

    15 18 2,248 9.1 Go

    🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐

    

    Project mention: One login to rule them all: centralized auth for internal tools with Caddy | dev.to | 2026-07-20

    Caddy-security (also known as AuthCrunch) for authentication and authorization. It plugs directly into Caddy and adds an authentication portal with OAuth2/OIDC support.

18. authorizer

    16 11 2,107 9.7 Go

    Your data, your control. Fully open source, authentication and authorization. No lock-ins. Deployment in Railway in 120 seconds || Spin a docker image as a micro-service in your infra. Built in login page and Admin panel out of the box.

    

    Project mention: Show HN: Authorizer – open-source auth for enterprise apps and agents | news.ycombinator.com | 2026-09-02

19. rbac-manager

    17 4 1,670 6.1 Go

    A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.

    

20. rakkess

    18 3 1,401 0.0 Go

    Review Access - kubectl plugin to show an access matrix for k8s server resources

    

21. topaz

    19 9 1,363 8.6 Go

    Cloud-native authorization for modern applications and APIs (by aserto-dev)

    

22. warrant

    20 42 1,338 2.5 Go

    Warrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.

    

    Project mention: Permission Systems for Enterprise That Scale | news.ycombinator.com | 2025-12-24

23. audit2rbac

    21 2 1,111 0.0 Go

    Autogenerate RBAC policies based on Kubernetes audit logs

    

24. rbac-tool

    22 9 1,081 4.1 Go

    Rapid7 | insightCloudSec | Kubernetes RBAC Power Toys - Visualize, Analyze, Generate & Query

    

25. rbac-lookup

    23 3 981 0.0 Go

    Easily find roles and cluster roles attached to any user, service account, or group name in your Kubernetes cluster

    

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

Go Authorization related posts

• Supabase Flutter deep link not working: scheme, Info.plist, AndroidManifest and the underscore bug

  1 project | dev.to | 4 Sep 2026

• Show HN: Authorizer – open-source auth for enterprise apps and agents

  1 project | news.ycombinator.com | 2 Sep 2026

• Authorizer 2.4: Open-source auth for AI agents and modern enterprise apps

  1 project | dev.to | 1 Sep 2026

• ReBAC isn't the problem. The ReBAC tools I tried are.

  1 project | dev.to | 11 Aug 2026

• Better Auth is joining Vercel

  4 projects | news.ycombinator.com | 7 Jul 2026

• Show HN: I made Permission-aware RAG – fine-grained authz for vector search

  2 projects | news.ycombinator.com | 16 Jun 2026

• The Agent Security Stack: Transport, Identity, Policy, Runtime

  3 projects | dev.to | 15 May 2026
• A note from our sponsor - AppSignal
  www.appsignal.com | 7 Oct 2026

  Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com

Do not miss the trending Go projects with our weekly report!