OryKeto

Fine-grained access control: Global, granular, and lightning fast

Authorization server based on Google Zanzibar — supporting RBAC and ReBAC patterns at scale.

Access control systems often falter under heavy load, struggling with consistency and responsiveness. Ory Keto, based on Google Zanzibar, addresses this by delivering fine-grained authorization with minimal latency and strong consistency, even at high request volumes.

Need support?

Run Ory Keto on your own infrastructure with commercial support, SLA-backed responses, and CVE patching from the team that builds it.

Need to move quickly?

Skip the operational overhead — get fine-grained access control as a fully managed service with global edge latency and 99.99% availability.

Fine-grained permissions, built for split-second decisions

Ory Keto is a distributed authorization server built on Google Zanzibar, supporting RBAC and ReBAC patterns from a single permissions API.

SDKs for any language and framework

Ory Keto is written in Go with official SDKs for every major language: Node.js, Python, Java, .NET, PHP, Ruby, and more. It works behind any framework and integrates with your existing data structures and identifiers without forcing a rewrite, so engineers can add fine-grained permissions fast.

Permission management & policy decision point

Resolve authorization decisions in real time through Keto's permissions API. Determine whether an entity (user, service, or IoT) is allowed to perform an action via HTTP/REST or gRPC, with Keto acting as the policy decision point for every microservice in your stack.

Authorization server powered by open-source

Ory Keto offers deployment flexibility. With open source roots, Ory Keto has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features and support, or use the fully managed Ory Network for a seamless SaaS experience.

Ory Keto features for fine-grained permissions at scale

• Sub-10ms permission checks

Ory Keto is built on Google Zanzibar's principles and has sustained 95th-percentile latency under 10ms with greater than 99.99% availability across years of production use — fast enough to run synchronous authorization in the request path of every API call.

• RBAC and ReBAC from one API

Mix authorization patterns within the same application without managing separate engines. Express role-based, attribute-based, list-based, and relationship-based access through a unified permissions API.

• Global access control

Distribute permission checks across regions and clouds with consistency — write a permission update in one region and have it visible correctly anywhere in the world. Ory Network operates Ory Keto across global edge locations so authorization checks resolve close to your users, regardless of where you're deployed.

How to de-risk identity at scale with Ory

OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.

Deploy Ory Keto on your preferred infrastructure

Run the same authorization engine three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same Zanzibar-based engine, same permission semantics across all three.

• Open Source deployment — Run, try, and inspect Ory Keto open source. Perfect to proof-of-concept your next big idea.
• OEL deployment — Ory Keto on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date.
• Ory Network deployment — Ory Network includes Ory Keto powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.

Integrate Ory Keto with your stack

Integrate Ory Keto with your existing stack in minutes. Quickstarts for Docker and Kubernetes, SDKs for every major language, and reference architectures for RBAC modeling.

Ory Keto FAQ

What is Ory Keto?

Ory Keto is an authorization server that implements Google's Zanzibar research paper. It provides low-latency, relationship-based permission checks at scale.

What business benefits does Ory Keto provide?

• Global Performance & Reliability - Ory Keto is designed for "split-second decision making," maintaining a 95th-percentile latency of less than 10ms and 99.99% availability.
• Operational Efficiency - By decoupling authorization from your application code, your developers can focus on building core product features rather than patching and maintaining homegrown identity infrastructure.
• De-Risking Identity at Scale - Ory Keto reduces the risk of security breaches and inconsistent permission checks.
• Compliance Readiness - The platform is built to be audit-ready for global standards including GDPR, SOC 2, PCI-DSS, and PSD2.

What permission models does Ory Keto support?

Ory Keto supports multiple permission models through its relationship-based data structure. Relationship-Based Access Control (ReBAC) is the core model.

How is Ory Keto different from OPA or Casbin?

OPA (Open Policy Agent) and Casbin use a policy-as-code approach, while Ory Keto uses a relationship-based approach.

Can I model complex permission hierarchies like Google Drive sharing?

Yes. Ory Keto's relation tuple model naturally supports hierarchical permissions.