Oathkeeper

<h1 align="center"> <img src="https://raw.githubusercontent.com/ory/meta/master/static/banners/oathkeeper.svg" alt="Ory Oathkeeper - Cloud Native Identity & Access Proxy"> </h1> <h4 align="center"> <a href="https://www.ory.com/chat">Chat</a> · <a href="https://github.com/ory/oathkeeper/discussions">Discussions</a> · <a href="https://www.ory.com/l/sign-up-newsletter">Newsletter</a> · <a href="https://www.ory.com/docs/">Docs</a> · <a href="https://console.ory.sh/">Try Ory Network</a> · <a href="https://www.ory.com/jobs/">Jobs</a> </h4>

Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It follows the BeyondCorp model designed by Google and secures applications in Zero-Trust networks.

---

<!-- START doctoc generated TOC please keep comment here to allow auto update --> <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->

• What is Ory Oathkeeper?
  • Why Ory Oathkeeper
• Deployment options
  • Installation
• Quickstart
• Who is using Ory Oathkeeper
• Ecosystem
  • Ory Kratos: Identity and User Infrastructure and Management
  • Ory Hydra: OAuth2 & OpenID Connect Server
  • Ory Oathkeeper: Identity & Access Proxy
  • Ory Keto: Access Control Policies as a Server
• Documentation
• Developing Ory Oathkeeper
• Security
  • Disclosing vulnerabilities
• Telemetry

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

What is Ory Oathkeeper?

Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API. It follows cloud architecture best practices and focuses on:

• Authenticating and authorizing HTTP requests
• Acting as a reverse proxy or decision API
• Mutating requests with identity information
• Integrating with existing API gateways and proxies
• Supporting multiple authentication and authorization strategies
• Working in Zero-Trust network architectures

We recommend starting with the Ory Oathkeeper introduction docs to learn more about its architecture, feature set, and how it compares to other systems.

Why Ory Oathkeeper

Ory Oathkeeper is designed to:

• Decouple authentication and authorization from application code
• Work as an API Gateway plugin or standalone proxy
• Support flexible access rules for different endpoints
• Integrate with Ambassador, Envoy, AWS API Gateway, Nginx, and more
• Provide both proxy and sidecar deployment modes
• Scale without effort in cloud native environments

Oathkeeper works with:

• Ambassador via auth service
• Envoy via the External Authorization HTTP Filter
• AWS API Gateway via Custom Authorizers
• Nginx via Authentication Based on Subrequest Result

Deployment options

You can run Ory Oathkeeper in two main ways:

• As a managed service on the Ory Network
• As a self hosted service under your own control, with or without the Ory Enterprise License

Installation

You can run Ory Oathkeeper yourself for full control over infrastructure, deployment, and customization.

The install guide explains how to:

• Install Oathkeeper on Linux, macOS, Windows, and Docker
• Configure access rules and authentication strategies
• Deploy to Kubernetes and other orchestration systems

This guide uses the open source distribution to get you started without license requirements. It is a great fit for individuals, researchers, hackers, and companies that want to experiment, prototype, or run unimportant workloads without SLAs. You get the full core engine, and you are free to inspect, extend, and build it from source.

If you run Oathkeeper as part of a business-critical system, you should use a commercial agreement to reduce operational and security risk. The Ory Enterprise License (OEL) layers on top of self-hosted Oathkeeper and provides:

• Additional enterprise features that are not available in the open source version
• Regular security releases, including CVE patches, with service level agreements
• Support for advanced scaling, multi-tenancy, and complex deployments
• Premium support options with SLAs, direct access to engineers, and onboarding help
• Access to a private Docker registry with frequent and vetted, up-to-date enterprise builds

For guaranteed CVE fixes, current enterprise builds, advanced features, and support in production, you need a valid Ory Enterprise License and access to the Ory Enterprise Docker registry. To learn more, contact the Ory team.

Quickstart

Head over to the Ory Developer Documentation to learn how to install Ory Oathkeeper on Linux, macOS, Windows, and Docker and how to build Ory Oathkeeper from source.

Who is using Ory Oathkeeper

<!--BEGIN ADOPTERS-->

The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 50.000 members and is growing. The Ory stack protects 7.000.000.000+ API requests every day across thousands of companies. None of this would have been possible without each and everyone of you!

The following list represents companies that have accompanied us along the way and that have made outstanding contributions to our ecosystem. If you think that your company deserves a spot here, reach out to <a href="mailto:office@ory.com">office@ory.com</a> now!

<table> <thead> <tr> <th>Name</th> <th>Logo</th> <th>Website</th> <th>Case Study</th> </tr> </thead> <tbody> <tr> <td>OpenAI</td> <td align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ory/meta/master/static/adopters/light/openai.svg" /> <img height="32px" src="https://raw.githubusercontent.com/ory/meta/master/static/adopters/dark/openai.svg" alt="OpenAI"> </picture> </td> <td><a href="https://openai.com/">openai.com</a></td> <td><a href="https://www.ory.com/case-studies/openai">OpenAI Case Study</a></td> </tr> <tr> <td>Fandom</td> <td align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ory/meta/master/static/adopters/light/fandom.svg" /> <img height="32px" src="https://raw.githubusercontent.com/ory/meta/master/static/adopters/dark/fandom.svg" alt="Fandom"> </picture> </td> <td><a href="https://www.fandom.com/">fandom.com</a></td> <td><a href="https://www.ory.com/case-studies/fandom">Fandom Case Study</a></td> </tr> <tr> <td>Lumin</td> <td align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ory/meta/master/static/adopters/light/lumin.svg" /> <img height="32px" src="https://raw.githubusercontent.com/ory/meta/master/static/adopters/dark/lumin.svg" alt="Lumin"> </picture> </td> <td><a href="https://www.luminpdf.com/">luminpdf.com</a></td> <td><a href="https://www.ory.com/case-studies/lumin">Lumin Case Study</a></td> </tr> <tr> <td>Sencrop</td> <td align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ory/meta/master/static/adopters/light/sencrop.svg" /> <img height="32px" src="https://raw.githubusercontent.com/ory/meta/master/static/adopters/dark/sencrop.svg" alt="Sencrop"> </picture> </td> <td><a href="https://sencrop.com/">sencrop.com</a></td> <td><a href="https://www.ory.com/case-studies/sencrop">Sencrop Case Study</a></td> </tr> <tr> <td>OSINT Industries</td> <td align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ory/meta/master/static/adopters/light/osint.svg" /> <img height="32px" src="https://raw.githubusercontent.com/ory/meta/master/static/adopters/dark/osint.svg" alt="OSINT Industries"> </picture> </td> <td><a href="https://www.osint.industries/">osint.industries</a></td> <td><a href="https://www.ory.com/case-studies/osint">OSINT Industries Case Study</a></td> </tr>