SpiceDB
SpiceDB from Authzed is an open-source, Google Zanzibar-inspired database for storing and querying fine-grained authorization data, answering whether a subject can perform an action on a resource.
- GitHub stars
- 7.1k
- Last commit
- yesterday
- Latest release
- v1.56.2
- Licence
- Apache-2.0
- Self-hosted
- Yes
This entry covers SpiceDB, the open-source authorization database from Authzed. It is inspired by Google's Zanzibar paper and lets platform and product teams answer questions such as whether a given subject can perform an action on a given resource, which addresses broken access control, a major web security risk.
Like a relational database, you define a schema, write data as relationships and then use client libraries to issue permission checks from your application. Other queries are possible too, such as what a subject can do or who can access a resource. SpiceDB typically runs as one central service used by several products and microservices, and it focuses purely on authorization, staying agnostic to authentication and identity providers. Topics mention RBAC, ABAC, ReBAC and fine-grained access control.
SpiceDB is written in Go, runs on Kubernetes and elsewhere, and is licensed under Apache-2.0. Authzed also offers commercial products around it. It suits engineering teams that need consistent, scalable permissions for multi-tenant or collaborative applications.
Key features
- Zanzibar-style relationship-based permissions
- Schema language for authorization models
- Permission check and lookup queries
- Centralized authorization service
- Independent of identity providers
- Distributed, cloud-native design
Pricing: Free and open source under the Apache-2.0 licence.
