{"data":{"slug":"cerbos","name":"Cerbos","tagline":"Apache-2.0 authZ PDP: YAML policies, run anywhere","category":"nextjs","categoryName":"Next.js","url":"https://cerbos.dev","github":"https://github.com/cerbos/cerbos","pricing":"open-source","hook":"Cerbos is the YAML policy decision point when your IdP should not also be your authorization brain.","whatsGood":"Apache-2.0. Free forever Run anywhere — verified on cerbos.dev/pricing. YAML policies, PDP you embed or sidecars. Decouples authZ from whatever issues the tokens.","theCatch":"authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Do not reprint Hub prices; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.","verdict":"Apache-2.0 authorization PDP. Free to run; not an IdP.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","capabilities":["authz","policies","auth"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":4568},"related":[{"slug":"vercel","name":"Vercel","tagline":"The platform that made Next.js deployment trivial"},{"slug":"prisma","name":"Prisma","tagline":"Type-safe database access with killer DX"},{"slug":"drizzle","name":"Drizzle ORM","tagline":"TypeScript ORM that feels like SQL"},{"slug":"trpc","name":"tRPC","tagline":"End-to-end typesafe APIs without codegen"},{"slug":"clerk","name":"Clerk","tagline":"Auth that actually ships with your UI"}],"links":{"self":"/api/gems/cerbos","html":"/gems/cerbos","markdown":"/gems/cerbos.md","category":"/api/gems?category=nextjs","categoryPage":"/stacks/nextjs"}}