使用 Homebrew, Nix, scoop 安装 openfga

项目链接

• 主页
• 仓库

命令和别名

• openfga

项目历史

Auth0 announced OpenFGA on June 17, 2022 as the open-source engine powering Auth0 Fine Grained Authorization. The project was designed, built, and sponsored by Okta/Auth0, and its model follows the ideas in Google's Zanzibar paper while exposing a developer-facing modeling language and APIs for authorization checks.

The project moved quickly from initial release to a cloud-native operational shape. OpenFGA v1.0 was announced on April 14, 2023 for launch at KubeCon + CloudNativeCon Europe, with improvements such as a more readable authorization model language, ListObjects, OpenTelemetry tracing, Prometheus metrics, profiling, Helm-chart deployment, a PostgreSQL storage-adapter performance push, and expanded SDK support.

OpenFGA entered CNCF Sandbox status in September 2022 and was accepted as a CNCF Incubating project in November 2025. The CNCF incubation announcement describes the project as the foundation for Auth0 FGA and notes growing maintainer participation from companies beyond Okta/Auth0.

采用历史

OpenFGA's adoption story is tied to the cloud-native search for externalized authorization. Its own site lists adopters including Auth0, Canonical, Docker, Grafana, Headspace, OpenObserve, Read AI, Sourcegraph, and Zuplo, while the CNCF incubation announcement reports public production acknowledgements from 37 companies and broader use by hundreds of companies.

The ecosystem expanded beyond the server itself through SDKs, storage adapters, tooling, and integrations. By the v1.0 announcement, community work included a MySQL storage adapter, SDKs for additional languages, and integrations with projects such as Open Policy Agent, Keycloak, Kratos, and SCIM; the later CNCF announcement also highlights SQLite, Terraform, VS Code, and IntelliJ ecosystem work.

使用方式

Developers use OpenFGA by writing an authorization model and then storing relationship tuples that bind users, relations, objects, and optional conditions. The Check API answers whether a user has a relation to an object, while ListObjects and related APIs help ask reverse questions such as which resources a user may access.

The modeling language can be authored as JSON or as a DSL that compiles to JSON before reaching the API. This makes the same authorization graph usable through direct API calls, SDKs, the CLI, the playground, and IDE extensions, while keeping the stored model close to Zanzibar's tuple-to-userset concepts.

为什么软件包爱好者会关心

For package nerds, OpenFGA is notable because it turns a research lineage from Google's Zanzibar into a package-manager-installable service with operational batteries: binaries, containers, Helm charts, SDKs, adapters, and migration-managed storage backends.

Its metadata also captures a broader trend: authorization is moving from application libraries toward standalone infrastructure, sitting near identity providers, service meshes, policy engines, and databases in the developer toolbox.

时间线

• June 2022: Auth0 announced OpenFGA as the open-source engine behind Auth0 Fine Grained Authorization.
• September 2022: OpenFGA was accepted as a CNCF Sandbox project.
• April 2023: OpenFGA v1.0 was announced for launch at KubeCon + CloudNativeCon Europe.
• November 2025: CNCF accepted OpenFGA as an Incubating project.

Related projects

• OpenFGA is directly related to Google's Zanzibar paper and to the commercial Auth0 FGA service. In the wider authorization ecosystem it sits near Open Policy Agent, Keycloak, Kratos, SCIM integrations, and other ReBAC/RBAC/ABAC tooling.

来源

• https://auth0.com/blog/auth0s-openfga-open-source-fine-grained-authorization-system/
• https://auth0.com/blog/openfga-v10-a-new-milestone-in-cloud-native-authorization-systems/
• https://github.com/openfga/openfga
• https://openfga.dev/
• https://openfga.dev/docs/concepts
• https://openfga.dev/docs/configuration-language
• https://raw.githubusercontent.com/openfga/openfga/main/RELEASES.md
• https://www.cncf.io/blog/2025/11/11/openfga-becomes-a-cncf-incubating-project/