Ory Oathkeeper is an Identity & Access Proxy and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP requests based on configurable access rules.
The tool solves the problem of decoupling authentication and authorization logic from application code by acting as a reverse proxy or decision API in front of protected services. It implements the BeyondCorp zero-trust security model, evaluating HTTP requests against sets of access rules and either allowing them through with identity information attached or rejecting them. This approach lets organizations enforce consistent security policies across multiple applications without modifying application code itself.
Oathkeeper suits teams building cloud-native systems who need flexible, centralized access control. It works well for organizations adopting zero-trust architectures and those wanting to integrate authentication and authorization at the infrastructure layer rather than embedding it in each service. The tool can function as a standalone reverse proxy or integrate with existing API gateways and proxies including Ambassador, Envoy, AWS API Gateway, and Nginx. It supports multiple authentication and authorization strategies and offers both proxy and sidecar deployment modes for different infrastructure patterns.
The project maintains active discussion channels and documentation resources. Development activity shows consistent engagement with the codebase and community interaction through multiple communication platforms.
