OpenFGA, Fine-grained Authorization on Your Server
Zanzibar-style permissions, next to your data instead of someone else's.
Every request asks it a question.
So it should be close, fast and yours.
us.kheeper.com/public/openfga
- OpenFGA, with its HTTP and gRPC APIs on loopback behind TLS
- Caddy, with automatic TLS on your domain
- Postgres on the same box, backed up continuously
- A preshared bearer key, so only your services can ask
- Grafana and a metrics stack, with an OpenFGA dashboard
Authorization sits on your hot path.
Where it runs decides your latency and your bill.
Priced by usage
Every permission check is a call to someone else's service, and your relationship data — who can see what — lives there too.
Free, plus Postgres
OpenFGA is a single binary. The work is everything around it: the database, its backups, TLS, migrations and metrics.
One box, flat
One image with OpenFGA, Postgres, backups, TLS and metrics. Kheeper charges for storage, bandwidth and hosts — not for checks.
Questions
What is OpenFGA?
An open-source authorization service, a CNCF project inspired by Google's Zanzibar. You describe your permissions as a model of relationships, and your services ask it whether a user can do something.
How do my services authenticate?
With a preshared key you set in the host's config, sent as a bearer token. The playground is off.
Is my data backed up?
Yes. OpenFGA stores its models and tuples in the local Postgres, which archives every WAL segment and takes a daily base backup to Kheeper's object store.
How do I upgrade?
Release a newer image. The host stages it, reboots into it, and OpenFGA runs its database migrations on start.