Introduction

What is Authorizer?

Authorizer is an open-source authentication and authorization solution for your applications. Bring your database and have complete control over user information. You can self-host Authorizer instances and connect to any supported database.

Features

• Sign-in / Sign-up with email ID and password
• Secure session management with HTTP-only cookies
• Email verification
• OAuth2 and OpenID Connect compatible APIs
• APIs to update profile securely
• Forgot password flow using email
• Social logins (Google, GitHub, Facebook, LinkedIn, Apple, Discord, Twitter, Twitch, Roblox, Microsoft)
• Role-based access management and fine-grained authorization (FGA) via an embedded OpenFGA (Zanzibar ReBAC) engine
• Password-less login with magic link
• WebAuthn / passkey registration and login
• Multi-factor authentication: TOTP, email OTP, SMS OTP, and passkey as a second factor
• SMS OTP via Twilio
• Enterprise SSO — SAML 2.0 as Service Provider and Identity Provider, OIDC federation, verified email domains, and home realm discovery (SSO guide)
• SCIM 2.0 user and group provisioning (SCIM)
• Organizations and multi-tenancy with org-scoped admin roles
• Machine-to-machine auth (client_credentials) and secretless workload identity — RFC 7523 client assertions, SPIFFE JWT-SVIDs, Kubernetes TokenReview (Workload Identity)
• Agent delegation via RFC 8693 token exchange (Token Exchange)
• Email templating and webhooks
• Rate limiting, security hardening, and Prometheus metrics (Metrics & Monitoring)
• GraphQL, REST, and gRPC APIs
• MCP server for AI agents

Introduction Video

Watch the introduction video on YouTube: Introduction to Authorizer

---

Authorizer v2

Authorizer v2 focuses on simpler, more secure configuration and a cleaner operational model:

• Configuration via CLI flags only -- no persisted env in the database or cache
• More secure secret handling -- secrets are passed at process start, not stored in Authorizer-managed storage
• Stronger defaults and hardening flags -- better control over GraphQL introspection, admin access, and cookies
• Updated SDKs -- @authorizerdev/authorizer-js v3 and @authorizerdev/authorizer-react v2

Quick Start

./authorizer \
  --database-type=sqlite \
  --database-url=test.db \
  --jwt-type=HS256 \
  --jwt-secret=test \
  --encryption-key=test-encryption-key \
  --admin-secret=admin \
  --client-id=123456 \
  --client-secret=secret

Or with Docker:

docker run -p 8080:8080 quay.io/authorizer/authorizer:latest \
  --database-type=sqlite \
  --database-url=test.db \
  --jwt-type=HS256 \
  --jwt-secret=test \
  --encryption-key=test-encryption-key \
  --admin-secret=admin \
  --client-id=123456 \
  --client-secret=secret

Where to start

• New projects: Start with the Getting Started guide
• Migrating from v1: See Migration v1 to v2 for a complete guide
• Deployment: Choose from Docker, Kubernetes, Helm Chart, or one-click deploys
• SDK integration: See authorizer-js, authorizer-react, or authorizer-go

---

Supported Databases

Authorizer supports a wide range of databases:

• PostgreSQL, MySQL, MariaDB, SQLite, libSQL / Turso, SQL Server
• MongoDB, ArangoDB, Couchbase
• CassandraDB, ScyllaDB, DynamoDB
• Yugabyte, PlanetScale, CockroachDB

See Databases for connection string formats.

---

Supported SDKs

Frontend SDKs

• JavaScript / TypeScript — v3.3.0; user + admin client; GraphQL + REST protocols
• React — v2.x; protocol prop; pre-built login/signup/MFA components
• Vue — beta; no admin client or protocol selection yet
• Svelte — beta; no admin client or protocol selection yet
• Flutter — not released yet; no package on pub.dev

Backend SDKs

• Go — user + admin client; protocol selection (gRPC / REST / GraphQL); FGA helpers
• Python — v0.3.0 pre-release; sync + async; admin API (pip install --pre authorizer-py)
• Node.js — same package as the frontend SDK, works server-side

See the SDK reference for usage docs.

---

Roadmap

• React Native SDK
• Android Native SDK
• iOS Native SDK
• PHP SDK
• WordPress plugin
• AMI / Digital Ocean Droplet
• Azure deployment
• Vue / Svelte admin client and protocol parity with authorizer-js