Identity-Aware Proxy & Zero Trust Gateway | Ory Oathkeeper
Ory Oathkeeper
Identify-aware proxy for Zero Trust & BeyondCorp
Authenticate, authorize, and mutate any incoming HTTP traffic using a Zero Trust / BeyondCorp security model — deployed on your infrastructure or fully managed via Ory Network.
Existing identity-aware proxy solutions lack flexibility and granular control, limiting adaptability to specific business needs. Ory Oathkeeper is an open-source Zero Trust proxy that integrates with your infrastructure, giving you complete control over authentication and access workflows.
Need control and support?
Run Ory Oathkeeper on your own infrastructure with the Ory Enterprise License — premium support, security patches, and direct engineering access for production deployments.
Need to move quickly?
Get Ory Oathkeeper as a fully-managed solution via Ory Network. Instant-on global Zero Trust gateway with no infrastructure to operate. Sign up for free!
An identity-aware proxy that fits your stack
Ory Oathkeeper forwards authorized requests and rejects unauthorized ones — as a standalone reverse proxy or as an authentication layer in front of your existing API gateway (Kong, Ambassador, Envoy, AWS API Gateway, Nginx...).
Identity and Access Proxy
Ory Oathkeeper is an open-source, cloud-native identity-aware proxy and access control decision API. Written in Go, it authenticates, authorizes, and mutates incoming HTTP(s) requests with sub-millisecond latency on any infrastructure.
Zero Trust gateway with BeyondCorp
Apply Zero Trust and BeyondCorp principles across your infrastructure. Oathkeeper enables secure, context-aware access for employees, partners, customers, and machine-to-machine workloads — replacing perimeter-based security with verified identity at every request.
Open source roots, with deployment flexibility
Oathkeeper is open source at its core — and unlike vendor-locked alternatives like Google Cloud IAP, you choose how to deploy it. Run the open-source build on your own infrastructure, upgrade to Ory Enterprise License for premium support & features, or use fully managed Ory Network for instant-on SaaS.
Identity and Access Proxy
Zero Trust gateway with BeyondCorp
Open source roots, with deployment flexibility
Identity-aware proxy capabilities at a glance
Identity-aware HTTP proxy
Authorize HTTP requests based on configurable access rules — verify identity, check permissions, enforce policy at every request.
API gateway integration
Deploy alongside existing API gateways. Ory Oathkeeper integrates with Ambassador, Envoy, AWS API Gateway, Kong, Nginx, Istio, and many more.
Identity context propagation
Aggregate identity data from multiple sources and propagate it downstream as custom headers, JSON Web Tokens (JWT), or X-User-ID values.
Flexible deployment for Ory Oathkeeper identity-aware proxy
Run Oathkeeper open-source on your own infrastructure, with enterprise support, or as a fully managed cloud service — full control over authentication and access workflows, your way.
- Open Source deployment — Run, try, and inspect Ory Oathkeeper open source. Perfect to proof-of-concept your next big idea.
- OEL deployment — Ory Oathkeeper on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date.
- Ory Network deployment — Ory Network includes Ory Oathkeeper powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.
Integrate Ory Oathkeeper with your stack
Amazon SES Reliably deliver critical identity-related transactional emails
AWS API Gateway Secure API front door with fine-grained authorization
AWS Infrastructure Leverage scalable AWS infrastructure for identity management
Discord Social Login Tap into Discord's large, engaged user base
Ory Oathkeeper FAQ
What is Ory Oathkeeper?
Ory Oathkeeper is an open-source Identity and Access Proxy (IAP) and Access Control Decision API. It sits in front of your services and evaluates every incoming HTTP request against a set of access rules. For each request, Ory Oathkeeper authenticates the caller, checks authorization, and optionally transforms the request (for example, by adding identity headers or a signed JWT) before forwarding it to your upstream service. Unauthorized requests are rejected at the proxy layer. Ory Oathkeeper follows the BeyondCorp/Zero Trust security model and is written in Go. It is available as open-source software (Apache 2.0), under the Ory Enterprise License, and as part of the Ory Network.
What business benefits does Ory Oathkeeper provide?
- Ory Oathkeeper allows businesses to adopt a Zero Trust security model. Instead of relying on a "secure perimeter" (like a VPN), it verifies every single request to your services, whether they come from employees, partners, or customers.
- Unlike rigid legacy systems, Ory Oathkeeper integrates with your existing infrastructure. It can act as a standalone reverse proxy or plug into your current API Gateways (like Envoy, AWS API Gateway, Nginx, or Ambassador).
- Provides a unified way to authenticate, authorize, and manage incoming HTTP(s) traffic across all your services, reducing the complexity of managing security rules in multiple different places.
- Ory Oathkeeper standardizes diverse user data into a single, secure source of truth. By delivering consistent identity context to every service, it eliminates security gaps and ensures your access policies are enforced with absolute precision across the enterprise.
How does Ory Oathkeeper process requests?
Ory Oathkeeper processes each request through a four-stage pipeline. First, it matches the request's URL, method, and host against its configured access rules. If no rule matches, the request is denied. Second, it runs the authenticator stage: validating credentials such as a Bearer token, session cookie, or API key. Third, it runs the authorizer stage: checking whether the authenticated subject has permission to access the resource. Fourth, it runs the mutator stage: transforming the request before forwarding it upstream, for example by injecting an X-User-ID header or generating a signed JWT as a Bearer token.
What authenticators, authorizers, and mutators does Ory Oathkeeper support?
Ory Oathkeeper supports multiple authenticators per rule, checked in order: cookie_session (validates session cookies against an external endpoint like Ory Kratos), bearer_token, oauth2_introspection, jwt, anonymous (treats unauthenticated requests as a guest subject), noop (bypasses authentication), and unauthorized (rejects all requests). Authorizers include allow (permit all), deny (reject all), and integration with Ory Keto for fine-grained permission checks. Mutators include header (adds custom HTTP headers using Go templates), id_token (generates a signed RS256 JWT), cookie (sets cookies), and noop (passes the request through unchanged). You can chain multiple mutators per rule.
Does Ory Oathkeeper require a database?
No. Ory Oathkeeper has no database dependency and no persistent storage requirement. Access rules are loaded from the filesystem (YAML or JSON files), environment variables, or HTTP(S) endpoints including S3, GCS, and Azure Blob storage. This makes Ory Oathkeeper simple to deploy and upgrade: there are no migrations. Install the new version and restart.
Why Ory for your IAM?
Zero Trust Performance at the Edge - Ory Oathkeeper is a cloud-native identity & access proxy built for "deploy-anywhere" environments and trillion-scale performance. Ory provides a modular, flexible bridge to secure your entire ecosystem, from legacy systems to AI agents, without vendor lock-in. By centralizing policy enforcement into high-performance building blocks, Ory reduces TCO and ensures mission-critical applications are protected by a hardened Zero Trust architecture.
How does Ory Oathkeeper fit into the Ory ecosystem?
Ory Oathkeeper is the enforcement layer. Ory Kratos handles identity (authentication, registration, MFA). Ory Hydra handles OAuth2/OIDC token issuance. Ory Keto handles fine-grained permissions. Ory Oathkeeper ties them together at the network edge: it validates sessions from Ory Kratos, checks permissions against Ory Keto, and can introspect OAuth2 tokens from Ory Hydra. On the Ory Network, all four services are pre-integrated.
How is Ory Oathkeeper different from an API gateway?
API gateways (Nginx, Kong, Envoy, AWS API Gateway) handle traffic routing, rate limiting, load balancing, and TLS termination. Ory Oathkeeper handles identity-aware access control: authenticating callers, checking permissions, and enriching requests with identity context. These are complementary, not competing. You can deploy Ory Oathkeeper as a standalone reverse proxy to replace a simple gateway, or deploy it alongside your existing gateway as a decision API sidecar. The key difference is that Ory Oathkeeper understands identity natively: it can validate Ory Kratos sessions, introspect OAuth2 tokens, check Ory Keto permissions, and emit signed JWTs, none of which a general-purpose API gateway does out of the box.
Is Ory Oathkeeper free? How does pricing work?
Ory Oathkeeper open source is free under the Apache 2.0 license. You can self-host it at no cost. On the Ory Network, Ory Oathkeeper capabilities are included as part of the platform. There is no separate per-request charge for Ory Oathkeeper itself; billing is based on aDAU (identity usage), M2M tokens, and permission checks from Ory Keto. The Ory Network free Developer tier is available for testing. For self-hosted production with SLAs and enterprise support, the Ory Enterprise License is available at custom pricing.