# Cerbos

> Apache-2.0 authZ PDP: YAML policies, run anywhere

**Category:** Next.js  
**Pricing:** open-source  
**URL:** https://cerbos.dev  
**GitHub:** https://github.com/cerbos/cerbos  
**Added:** 2026-09-04

---

## The Hook

Cerbos is the YAML policy decision point when your IdP should not also be your authorization brain.

## What's Good

Apache-2.0. Free forever Run anywhere — verified on cerbos.dev/pricing. YAML policies, PDP you embed or sidecars. Decouples authZ from whatever issues the tokens.

## The Catch

authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Do not reprint Hub prices; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.

## Verdict

Apache-2.0 authorization PDP. Free to run; not an IdP.