Top 18 Rust Authorization Projects

Authorization

• Add a project

1. Ockam

   1 77 4,631 9.6 Rust

   Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale.

   

2. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. oso

   2 16 3,498 2.7 Rust

   Deprecated: See README

   

4. casbin-rs

   3 2 1,130 6.3 Rust

   An authorization library that supports access control models like ACL, RBAC, ABAC in Rust

   

5. axum-login

   4 5 1,017 3.9 Rust

   🪪 User identification, authentication, and authorization for Axum.

   

6. exograph

   5 2 350 9.6 Rust

   Build production-ready backends in minutes

   

7. inspektor

   6 8 285 0.0 Rust

   Inspektor is a protocol-aware proxy that is used to enforce access policies👮

   

8. biscuit-rust

   7 21 244 5.6 Rust

   Rust implementation of the Biscuit authorization token

   

   Project mention: Ask HN: What Are You Working On? (September 2025) | news.ycombinator.com | 2025-09-29

   biscuit-based identity and authorization

   I’m working on https://www.hessra.net/, an identity + authorization service built around [Biscuits](https://www.biscuitsec.org/) instead of JWTs. The goal is to decompose auth primitives so they’re easier to use in service-to-service cases, while also showing off what Biscuit tokens make possible.

   JWTs feel like problems waiting to happen. I think biscuits give stronger guarantees and are harder to get wrong.

   One piece I’ve shipped is an identity token that can be delegated offline. For example, “company:alice” can delegate to “company:alice:agent,” and that token can then be used to request an authorization token. This makes for a neat API key model: you can issue a simple opaque identity token to your customer (e.g. “customer123”) without having to maintain a DB of hashes/expirations, since those are encoded into the token. Later, you can upgrade security by exchanging the identity token for an authorization token, or let customers delegate access (e.g. “customer123:marketing”).

   I’ve also been experimenting with higher-order authorization flows:

9. yup-oauth2

   8 2 242 4.9 Rust

   An oauth2 client implementation providing the Device, Installed, Service Account, and several more flows.

   

10. keyhive

    9 1 238 8.1 Rust

    🗝️🐝✨ Rust workspace for Keyhive and related crates

    

11. protect-endpoints

    10 4 231 1.2 Rust

    Authorization extension for popular web-frameworks to protect your endpoints

    

12. trusted-remote-execution

    11 1 62 - Rust

    Sandboxed Rhai script execution engine with Cedar policy authorization for every system operation.

    

    Project mention: Rex is a secure script execution engine that uses Cedar policies | news.ycombinator.com | 2026-05-09

13. auth-rs

    12 1 19 8.6 Rust

    Authentication and authorization service, written in Rust

    

14. fga-rs

    13 1 15 2.5 Rust

    authorization/permission service, inspired by Google Zanzibar

    

15. authzen

    14 1 6 4.6 Rust

    A framework for easily integrating authorization into backend services.

    

16. tower-biscuit-auth

    15 1 3 0.0 Rust

    Integrating Biscuit authentication with the Tower ecosystem.

    

17. casbin-rust-yaml-adapter

    16 3 2 0.0 Rust

    YAML Adapter for Casbin-RS

    

18. oath-protocol

    17 1 2 5.2 Rust

    Open protocol for cryptographically verifiable human intent — AI agent authorization, local-first, offline-capable, no central authority.

    

    Project mention: Show HN: Oath – prove a human authorized each action before your AI agent acts | news.ycombinator.com | 2026-03-03

19. actra

    18 2 2 8.9 Rust

    Actra - control what runs before it runs, controls what actions are allowed before they execute. Evaluate policies across APIs, workflows and AI agents in real time. (by getactra)

    

    Project mention: The Claude Code Leak Is a Warning: AI Infrastructure Is Outpacing Control | dev.to | 2026-04-05

    Learn more: https://actra.dev

Rust Authorization related posts

• Show HN: Write SaaS apps where users control where their data is stored

  2 projects | news.ycombinator.com | 16 Jun 2026

• Authorization is still a nightmare for engineers

  6 projects | news.ycombinator.com | 16 Apr 2024

• Biscuit Authorization

  4 projects | news.ycombinator.com | 13 Dec 2023

• Biscuit – an authorization token with offline attenuation

  1 project | news.ycombinator.com | 30 Oct 2023

• Biscuit tokens 3.0 release! Decentralized authorization in Rust, wasm and a lot of other platforms

  2 projects | /r/rust | 4 Apr 2023

• Show HN: Biscuit Security Authorization

  1 project | news.ycombinator.com | 28 Mar 2023

• What's everyone working on this week (10/2023)?

  11 projects | /r/rust | 6 Mar 2023
• A note from our sponsor - SaaSHub
  www.saashub.com | 16 Aug 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Rust projects with our weekly report!