Tag
Authz tools
4 reviewed tools: 4 free or open source.
Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.
4 tools
- CerbosApache-2.0 authZ PDP: YAML policies, run anywhere
Free / OSS · Apache-2.0 · 4.6k GitHub stars
VerdictApache-2.0 authorization PDP. Free to run; not an IdP.
CatchauthZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Check current Hub prices on the vendor site; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.
- OpenFGAApache-2.0 Zanzibar-style ReBAC with a Check API
Free / OSS · Apache-2.0 · 6k GitHub stars
VerdictApache-2.0 ReBAC. Self-host free. Not Cerbos YAML.
CatchZanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.
- TopazApache-2.0 authZ: OPA Rego + embedded Zanzibar in one container
Free / OSS · Apache-2.0 · 1.4k GitHub stars
VerdictApache-2.0 combined authZ. Self-host free; not a single-model PDP.
CatchOne container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.
- SpiceDBApache-2.0 Google Zanzibar permissions DB; AuthZed Cloud optional
Free / OSS · Freemium · 7.2k GitHub stars
VerdictApache-2.0 Zanzibar permissions DB. Self-host free; AuthZed Cloud optional.
CatchVs OpenFGA/Cerbos/Topaz: AuthZed production Zanzibar + ZedTokens/Cloud — not OpenFGA CNCF Check API twin, not Cerbos YAML PDP, not Topaz Rego+ReBAC bundle. Free path is self-host; Cloud is paid usage.
FAQ
- What is the top free pick among Authz tools?
- Cerbos leads the Stack Gems list for Authz tools. Verdict: Apache-2.0 authorization PDP. Free to run; not an IdP.
- How many Authz tools does Stack Gems review?
- 4: 4 free or open source. Each review has a verdict and an honest Catch; no tool pays for its spot.
- Which Authz tools can I self-host for free?
- Cerbos, OpenFGA, Topaz and SpiceDB.
- Which Authz tools have the most GitHub stars?
- SpiceDB (7.2k), OpenFGA (6k), Cerbos (4.6k), per GitHub on 2026-10-21. Stars measure attention, not fit; read the Catch.
- What is the catch with Cerbos?
- authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP.