Keyring

Keyring is access-control infrastructure for software products. You define the actions a user can take, such as refunding an invoice or inviting a member, bundle them into named roles like Editor, Support or Finance, and grant those roles to your product's users. A single API call then answers whether a given user may perform a given action.

Permission checks are a GET request that takes a subject and a permission and returns an allowed boolean, authenticated with a bearer key. All reads and writes are checked against the grant graph, which lives in the database, so a client cannot talk its way into an action it lacks. Users are referenced by your own IDs, and console accounts stay out of the graph. When someone holds several roles, access is the union of all of them.

A console lets your team manage actions, roles, members, users and settings, and a full activity log records every grant, revocation and policy change. New workspaces start empty, with no seeded roles or demo actions, and membership begins with an approved join request. Keyring is offered as a hosted service with docs and a pricing page.