Authorizer: Open-source authentication and authorization for your apps

Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface for AI agents into the same Go program that logs users in, so a chatbot can ask whether a user may see a document before it fetches that document.

This affects any team that connects an AI assistant to company files. A vector search, which is the lookup that finds text similar to a question, returns close matches without checking who asked. Authorizer gives the search a list of documents the user is allowed to see, and everything else is dropped before it is scored.

Authorizer covers the usual login options: email and password, magic links, passkeys, social login through 10 providers, and one-time codes for multifactor authentication. It also supports single sign-on through SAML 2.0 and OpenID Connect, the protocols corporate identity systems such as Okta use. The server works with 13 or more databases, including PostgreSQL, MySQL, MongoDB and DynamoDB.

For detailed permissions, the server embeds OpenFGA, an open-source take on Google’s Zanzibar system. OpenFGA records access as relationships, such as a given user being able to view a given file. The built-in MCP server, which is the interface tools like Claude Code and Cursor use to call outside services, exposes three read-only functions: profile, check_permissions and list_permissions. The maintainers say it runs only over local stdio and cannot be reached over a network. They also say an agent acting for a user gets only the overlap of its own permissions and that user’s.

Authorizer is available for free on GitHub.

Must read:

• 20 open-source cybersecurity tools to keep your team ready for anything
• GitHub CISO on security strategy and collaborating with the open-source community

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!