OpenFGA Project
OpenFGA is an open source, CNCF Incubating project for building fine-grained authorization systems.
Why OpenFGA exists
Modern applications need permissions that can express relationships between users and resources, adapt as products evolve, and remain consistent across services. OpenFGA provides a centralized authorization system with an easy-to-read modeling language and consistent APIs, so application teams do not have to build and maintain a separate permissions system for every product.
OpenFGA was inspired by Google's Zanzibar paper. It was originally developed by Auth0/Okta, open sourced in June 2022, and donated to the Cloud Native Computing Foundation. OpenFGA joined CNCF as a Sandbox project in 2022 and moved to the Incubating maturity level on October 28, 2025. Read more about the project's history in the Incubation announcement.
Where project work happens
| Area | Repository or resource | What you will find there |
|---|---|---|
| Server | openfga/openfga | The OpenFGA server, release artifacts, runtime issues, and feature development. |
| API | openfga/api | The API definition shared by the server, SDKs, and other tooling. |
| Website and documentation | openfga/openfga.dev | This website, guides, modeling examples, and API documentation. |
| Design proposals | openfga/rfcs | Requests for Comments for significant changes to OpenFGA. |
| Community and governance | openfga/community | Governance, maintainers, adopters, community projects, and meeting information. |
| Roadmap | OpenFGA roadmap | Planned and in-progress project work. |
| SDKs and tools | OpenFGA repositories | Official SDKs, the CLI, IDE extensions, the Terraform provider, and other integrations. |
| Example models | openfga/sample-stores | Sample authorization models and a list of models used by open source projects. |
Get OpenFGA
Follow the OpenFGA setup guide to run the server with Docker, Docker Compose, or Kubernetes. You can also download a binary from the OpenFGA releases page.
Ask questions and give feedback
Use the kapa.ai-powered Ask AI widget in the site navigation to ask questions about OpenFGA. For AI-assisted implementation, install the OpenFGA Best Practices Skill or connect an MCP-compatible client to the OpenFGA kapa.ai MCP server. AI-generated answers may be inaccurate, so verify them against the project documentation and code.
- Ask usage questions and suggest product ideas in GitHub Discussions.
- Join the
#openfgachannel in CNCF Slack to talk with users and maintainers or attend a community meeting. - Report server bugs in the
openfga/openfgaissue tracker, and report website or documentation problems in theopenfga/openfga.devissue tracker.
When reporting a problem, include a minimal example or FGA Playground link, the result you expected, the result you observed, and the steps you already tried.
Contribute
Contributions of code, documentation, issue triage, RFC feedback, examples, and community support are all welcome.
- Read the contribution guide and Code of Conduct.
- Look for an issue in the relevant repository, including issues labeled
good first issue. - For a substantial design change, start a discussion with the maintainers and review the RFC process.
- Fork the affected repository, make and test the change, and open a pull request.
Report a security vulnerability
Do not disclose security vulnerabilities in a public issue or discussion. Email [email protected] and review the OpenFGA security policy for scope and reporting guidance. The project strives to reply within five business days.
Thank you
OpenFGA was created by the Auth0 FGA team with support from Auth0 Labs and Auth0's Office of the CTO, and its development continued at Okta before the project was donated to CNCF. We are grateful to the people who shaped the project there, to the CNCF community, and to every maintainer, contributor, early design partner, and adopter who has shared code and feedback.
The Incubation announcement recognizes many of the people and organizations that helped OpenFGA reach this milestone. The community repository maintains the broader list of OpenFGA adopters.