# OpenFGA

> Apache-2.0 Zanzibar-style ReBAC with a Check API

**Category:** Next.js  
**Pricing:** open-source  
**URL:** https://openfga.dev  
**GitHub:** https://github.com/openfga/openfga  
**Added:** 2026-09-04

---

## The Hook

OpenFGA is Google Zanzibar-shaped authorization when YAML ABAC is the wrong model.

## What's Good

Apache-2.0. Relationship-based access control, Check API, modeling language. Self-host the authorization service. CNCF-flavored ReBAC without inventing your own graph.

## The Catch

Zanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.

## Verdict

Apache-2.0 ReBAC. Self-host free. Not Cerbos YAML.