Nothing goes unseen - control all incoming traffic

Authenticate, authorize and mutate any incoming network traffic, using a Zero Trust / BeyondCorp security model.

Identity and Access Proxy (IAP)

Easy Integration

Ory Oathkeeper is an Open Source cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API. It authenticates, authorizes, and mutates incoming HTTP(s) requests, and is written in Go. Implementation is straightforward on any system.

Your language, our SDK

Oathkeeper is polyglot

Ory Oathkeeper is written in Go and we provide SDKs for almost every language including Dart, .NET, Go, Java, PHP, Python, Ruby, Rust and Typescript. Our documentation makes integrating Ory Oathkeeper a snap.

access-rules.ymlconfig.yml

---
- upstream:
url: http://my-backend-service
match:
url: http://my-app/some-route/<.*>
methods:
- GET
authenticators:
- handler: jwt
authorizer:
handler: allow
mutators:
- handler: headers
config:
headers:
X-User: "{{ print .Subject }}"
# ...---
daemon:
proxy:
port: 4455
access_rules:
repositories:
- access-rules.yml
authenticators:
jwt:
enabled: true
config:
jwks_urls:
- https://my-website.com/.well-known/jwks.json
# ...

Features

Forward authorized requests and reject unauthorized ones. Ory Oathkeeper can act as a reverse proxy or interface with your existing API Gateway.

Identity and Access Proxy

Authorize HTTP requests to your server based on sets of Access Rules.

Zero Trust Architecture

Apply Zero Trust / BeyondCorp security in your tech stack. Ory Oathkeeper enables secure access for all users (e.g. employees, partners, customers).

Carefree Integration

Deploy alongside your existing API Gateways. Ory Oathkeeper plugs into Ambassador, Envoy, AWS API Gateway, Nginx and many more.

Enrich Data

Accumulate data from multiple sources and parse it into custom headers: X-User-ID, JSON Web Tokens and more.

Next Generation Oathkeeper

Coming soon: The next generation of Ory Oathkeeper. Learn more and submit feedback on GitHub.

Customer Feedback

The following reviews were collected on our website.

4 stars based on 110 reviews

Seamless API Security Integration

With Ory Oathkeeper, we saw a 30% reduction in unauthorized access attempts within the first month. Highly recommend for secure API management.

Reviewed by Aidan Brenton (Chief Technology Officer)

Improved Access Control Efficiency

Our team experienced a 40% improvement in access control enforcement accuracy since adopting Ory Oathkeeper.

Reviewed by Clive Randford (IT Security Manager)

Reliable and Scalable Solution

Ory Oathkeeper scaled seamlessly with our growing traffic, reducing latency by 15%. Great for high-volume environments.

Reviewed by Selina Castor (Head of Infrastructure)

Enhanced Security Monitoring

We've reduced incident response time by 25% using Ory Oathkeeper's centralized logging features.

Reviewed by Damien Clovelle (Cybersecurity Analyst)

Customizable Policy Management

Ory Oathkeeper allowed us to implement custom policies that fit our specific needs, boosting compliance by 20%.

Reviewed by Marina Densworth (Compliance Officer)

Game-Changer for API Security

After integrating Ory Oathkeeper, our API downtime due to security issues dropped by 35%. A must-have tool.

Reviewed by Quincy Paldin (Product Manager)

Streamlined Identity Verification

Identity verification processes have become 20% faster since we adopted Ory Oathkeeper.

Reviewed by Victor Glennon (Identity Management Specialist)

Effective for Large Enterprises

Ory Oathkeeper handled our large-scale operations flawlessly, improving data access efficiency by 30%.

Reviewed by Norah Ellington (Enterprise Architect)

Highly Reliable Access Proxy

We've reduced API access errors by 15% using Ory Oathkeeper. Reliable, though initial setup took some time.

Reviewed by Ethan Larrick (DevOps Engineer)

Exceptional Support and Features

Customer support has been top-notch, helping us achieve a 25% boost in API response time efficiency.

Reviewed by Gavin Lorne (Technical Support Lead)

Outstanding Access Control Solutions

Ory Oathkeeper has transformed our API security—35% improvement in access control efficiency in the first quarter alone!

Reviewed by Dante Livingston (Chief Information Security Officer)

Got Questions? Find Answers Below!

Our Most Frequently Asked Questions

Ory Oathkeeper is a powerful access proxy designed to protect your APIs and microservices. It intercepts incoming requests, verifies authentication, and enforces access control policies before passing the requests to backend services. By doing so, it ensures secure communication and controlled access.

Ory Oathkeeper acts as a gatekeeper, validating each request against defined access rules. It ensures only authorized users can access specific resources, mitigating risks like unauthorized data access and API abuse.

Yes, Ory Oathkeeper seamlessly integrates with various identity providers, including OAuth2, OpenID Connect, and custom authentication systems, enabling flexible and secure identity management across your applications.

Absolutely. Ory Oathkeeper is built for scalability, making it ideal for both startups and large enterprises. Its architecture supports high-traffic environments, ensuring reliable and secure API management even under heavy loads.