Keto

Authorization server based on Google Zanzibar — supporting RBAC and ReBAC patterns at scale.

Access control systems often falter under heavy load, struggling with consistency and responsiveness. Ory Keto, based on Google Zanzibar, addresses this by delivering fine-grained authorization with minimal latency and strong consistency , even at high request volumes.

Run Ory Keto on your own infrastructure with commercial support, SLA-backed responses, and CVE patching from the team that builds it.

Need to move quickly?

Skip the operational overhead — get fine-grained access control as a fully managed service with global edge latency and 99.99% availability.

Fine-grained permissions, built for split-second decisions

Ory Keto is a distributed authorization server built on Google Zanzibar, supporting RBAC and ReBAC patterns from a single permissions API.

SDKs for any language and framework

Ory Keto is written in Go with official SDKs for every major language: Node.js, Python, Java, .NET, PHP, Ruby, and more. It works behind any framework and integrates with your existing data structures and identifiers without forcing a rewrite, so engineers can add fine-grained permissions fast.

Permission management & policy decision point

Resolve authorization decisions in real time through Keto's permissions API. Determine whether an entity (user, service, or Iot) is allowed to perform an action via HTTP/REST or gRPC, with Keto acting as the policy decision point for every microservice in your stack.

Authorization server powered by open-source

Ory Keto offers deployment flexibility. With open source roots, Ory Keto has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features and support, or use the fully managed Ory Network for a seamless SaaS experience.

SDKs for any language and framework

Ory Keto is written in Go with official SDKs for every major language: Node.js, Python, Java, .NET, PHP, Ruby, and more. It works behind any framework and integrates with your existing data structures and identifiers without forcing a rewrite, so engineers can add fine-grained permissions fast.

Permission management & policy decision point

Resolve authorization decisions in real time through Keto's permissions API. Determine whether an entity (user, service, or Iot) is allowed to perform an action via HTTP/REST or gRPC, with Keto acting as the policy decision point for every microservice in your stack.

Authorization server powered by open-source

Ory Keto offers deployment flexibility. With open source roots, Ory Keto has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features and support, or use the fully managed Ory Network for a seamless SaaS experience.

Ory components met modern technical standards, seamlessly integrated into our system, and were easily customizable to our needs.

Ory Keto features for fine-grained permissions at scale

Sub-10ms permission checks Ory Keto is built on Google Zanzibar's principles and has sustained 95th-percentile latency under 10ms with greater than 99.99% availability across years of production use — fast enough to run synchronous authorization in the request path of every API call.

Sub-10ms permission checks

Ory Keto is built on Google Zanzibar's principles and has sustained 95th-percentile latency under 10ms with greater than 99.99% availability across years of production use — fast enough to run synchronous authorization in the request path of every API call.

RBAC and ReBAC from one API Mix authorization patterns within the same application without managing separate engines. Express role-based, attribute-based, list-based, and relationship-based access through a unified permissions API.

RBAC and ReBAC from one API

Mix authorization patterns within the same application without managing separate engines. Express role-based, attribute-based, list-based, and relationship-based access through a unified permissions API.

Global access control Distribute permission checks across regions and clouds with consistency — write a permission update in one region and have it visible correctly anywhere in the world. Ory Network operates Ory Keto across global edge locations so authorization checks resolve close to your users, regardless of where you're deployed.

Global access control

Distribute permission checks across regions and clouds with consistency — write a permission update in one region and have it visible correctly anywhere in the world. Ory Network operates Ory Keto across global edge locations so authorization checks resolve close to your users, regardless of where you're deployed.

How to de-risk identity at scale with Ory

OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.

Deploy Ory Keto on your preferred infrastructure

Run the same authorization engine three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same Zanzibar-based engine, same permission semantics across all three.

Open Source deployment — Run, try, and inspect Ory Keto open source. Perfect to proof-of-concept your big idea.

OEL deployment — Ory Keto on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date.

Ory Network deployment — Ory Network includes Ory Keto powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.

Integrate Ory Keto with your stack

Amazon SES Reliably deliver critical identity-related transactional emails

Reliably deliver critical identity-related transactional emails

AWS API Gateway Secure API front door with fine-grained authorization

Secure API front door with fine-grained authorization

AWS Infrastructure Leverage scalable AWS infrastructure for identity management

Leverage scalable AWS infrastructure for identity management

Discord Social Login Tap into Discord's large, engaged user base

Tap into Discord's large, engaged user base

Ready to try Ory Keto ?

Integrate Ory Keto with your existing stack in minutes. Quickstarts for Docker and Kubernetes, SDKs for every major language, and reference architectures for RBAC modeling.

Claude Fable 5 can find your vulnerabilities. What authorizes its move?

Claude Fable 5 makes vulnerability discovery an API call, guarded by a probabilistic classifier. Why agent authorization must be deterministic, in-loop, and expert-built.

Agentic AI is already in production. Identity and access controls are not.

Relationship-based permissions are hard to reason in your head. The Keto Playground renders permission graphs as interactive visualizations so you can see exactly how relationships resolve to ALLOWED or DENIED. It ships with seven bundled examples you can explore and edit in the browser with zero setup.

Ory OSS v25.4.0 launch recap: The future of secure Identity & Access Management

Ory OSS 25.4.0 brings OAuth 2.0 device authorization flow, SMS login, token chain revocation and more — giving developers and IAM builders a solid foundation for IAM.

Ory Keto & Oathkeeper v25.4.0: Security and Observability Upgrades

Ory Keto and Ory Oathkeeper v25.4.0 deliver encrypted pagination tokens, better observability, and ecosystem consistency through monorepo migration and shared tooling.

Global Performance & Reliability - Ory Keto is designed for "split-second decision making," maintaining a 95th-percentile latency of less than 10ms and 99.99% availability. This ensures your application remains responsive and reliable even during massive traffic spikes, so you don’t miss opportunities.

Operational Efficiency - By decoupling authorization from your application code, your developers can focus on building core product features rather than patching and maintaining homegrown identity infrastructure.

De-Risking Identity at Scale - Ory Keto reduces the risk of security breaches and inconsistent permission checks. It provides a "unified control plane" that ensures consistent access policies across your entire ecosystem (users, AI agents, services, and IoT).

Compliance Readiness - The platform is built to be audit-ready for global standards including GDPR, SOC 2, PCI-DSS, and PSD2, helping businesses meet regulatory requirements more easily.

Try Ory today Start for free