What is the top free pick among authorization (AuthZ) tools?

Cerbos leads the Stack Gems list for authorization (AuthZ) tools. Verdict: Apache-2.0 authorization PDP. Free to run; not an IdP.

How many authorization (AuthZ) tools does Stack Gems review?

4: 4 free or open source. Each review has a verdict and an honest Catch; no tool pays for its spot.

Which authorization (AuthZ) tools can I self-host for free?

Cerbos, OpenFGA, Topaz and SpiceDB.

Which authorization (AuthZ) tools have the most GitHub stars?

SpiceDB (7.2k), OpenFGA (6k), Cerbos (4.6k), per GitHub on 2026-10-19. Stars measure attention, not fit; read the Catch.

What is the catch with Cerbos?

authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP.

Best of · Auth

Best authorization (AuthZ) tools (2026)

Stack Gems reviews 4 authorization (AuthZ) tools: 4 free or open source. These are the top 4, each with its verdict and the Catch we would want to know before installing it.

Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.

4 reviewed · 4 shown in full

1.CerbosApache-2.0 authZ PDP: YAML policies, run anywhere
Free / OSS · Apache-2.0 · 4.6k GitHub stars
VerdictApache-2.0 authorization PDP. Free to run; not an IdP.
CatchauthZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Check current Hub prices on the vendor site; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.
2.OpenFGAApache-2.0 Zanzibar-style ReBAC with a Check API
Free / OSS · Apache-2.0 · 6k GitHub stars
VerdictApache-2.0 ReBAC. Self-host free. Not Cerbos YAML.
CatchZanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.
3.TopazApache-2.0 authZ: OPA Rego + embedded Zanzibar in one container
Free / OSS · Apache-2.0 · 1.4k GitHub stars
VerdictApache-2.0 combined authZ. Self-host free; not a single-model PDP.
CatchOne container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.
4.SpiceDBApache-2.0 Google Zanzibar permissions DB; AuthZed Cloud optional
Free / OSS · Freemium · 7.2k GitHub stars
VerdictApache-2.0 Zanzibar permissions DB. Self-host free; AuthZed Cloud optional.
CatchVs OpenFGA/Cerbos/Topaz: AuthZed production Zanzibar + ZedTokens/Cloud — not OpenFGA CNCF Check API twin, not Cerbos YAML PDP, not Topaz Rego+ReBAC bundle. Free path is self-host; Cloud is paid usage.

FAQ

What is the top free pick among authorization (AuthZ) tools?: Cerbos leads the Stack Gems list for authorization (AuthZ) tools. Verdict: Apache-2.0 authorization PDP. Free to run; not an IdP.
How many authorization (AuthZ) tools does Stack Gems review?: 4: 4 free or open source. Each review has a verdict and an honest Catch; no tool pays for its spot.
Which authorization (AuthZ) tools can I self-host for free?: Cerbos, OpenFGA, Topaz and SpiceDB.
Which authorization (AuthZ) tools have the most GitHub stars?: SpiceDB (7.2k), OpenFGA (6k), Cerbos (4.6k), per GitHub on 2026-10-19. Stars measure attention, not fit; read the Catch.
What is the catch with Cerbos?: authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP.

Tags in this list

Related lists

Best auth tools

JSON: /api/gems?subcategory=authz · MCP: best_for on /api/mcp