What is the main technical difference between SpiceDB and OpenFGA?

Consistency. SpiceDB implements ZedTokens, which its documentation calls the equivalent of Zanzibar's Zookie, and exposes four per-request modes: minimize latency, at least as fresh, at exact snapshot, and fully consistent. OpenFGA offers two modes, MINIMIZE_LATENCY (the default, served from cache when possible) and HIGHER_CONSISTENCY (skips the cache), and its documentation says a Zookie-like token is being considered for future releases. If the New Enemy Problem matters to your design, SpiceDB has the stronger answer today.

Which datastores do SpiceDB and OpenFGA support?

SpiceDB supports CockroachDB (recommended for high-throughput and multi-region self-hosting), Cloud Spanner, PostgreSQL (recommended for single-region), MySQL (not recommended unless PostgreSQL is impossible) and an in-memory store for testing. OpenFGA supports memory, PostgreSQL, MySQL and SQLite. Only SpiceDB documents a multi-region-native datastore path.

Is OpenFGA still a CNCF sandbox project?

No. The CNCF Technical Oversight Committee accepted OpenFGA as an Incubating project, announced on 11 November 2025, with the maturity change dated 28 October 2025. Graduation is the next stage. SpiceDB is not a CNCF project; it is Apache 2.0 software stewarded by AuthZed.

Can I migrate between SpiceDB and OpenFGA?

Conceptually yes, mechanically it is a rewrite of the model. Both store relationship tuples of the form object, relation, subject, so the data maps. The schema languages differ: SpiceDB uses its own schema language with permissions and caveats, OpenFGA uses its modeling DSL with type restrictions and conditions. Plan to rewrite the model, re-run your test assertions against it, then bulk-load tuples and shadow-check both engines before cutting traffic.

How do the managed options compare on price?

As checked on 5 November 2026, AuthZed Cloud publishes one figure, deploying a permissions system from 2 dollars per hour with resource-based billing, while SpiceDB Enterprise is an annual licence per region and per vCPU and Dedicated is based on reserved vCPU capacity. Auth0 FGA, the managed service built on OpenFGA, shows no pricing on its product page, only a sign-up and a contact form. Self-hosting either engine is free under Apache 2.0.

AuthZed vs OpenFGA

CapabilityAuthZedOpenFGA

Overall

4.3

4.2

Authentication: 2.0; 1.5
SSO & Federation: 2.0; 1.5
Authorization: 5.0; 4.7
Lifecycle & Provisioning: 2.5; 3.0
MFA & Passwordless: 1.5; 1.0
Governance & Audit: 3.5; 3.5
Developer Experience: 4.5; 4.3
Deployment Flexibility: 4.5; 4.5
Pricing Transparency: 3.5; 4.5
Support & Ecosystem: 3.0; 3.5

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

At a glance

AuthZed (SpiceDB) and OpenFGA are the two serious open-source implementations of Google Zanzibar-style relationship-based access control. Both are Apache 2.0, both model permissions as tuples like "user X is editor of document Y", and both answer checks in milliseconds. Choose SpiceDB when consistency guarantees, multi-region datastores or a vendor-run managed tier priced on capacity matter most. Choose OpenFGA when foundation governance matters more than Zanzibar fidelity, or when you already buy from Okta and want Auth0 FGA as the managed path.

Where each wins

Decision factor	AuthZed / SpiceDB	OpenFGA
Consistency model	ZedTokens, four per-request modes	Two modes, no Zookie equivalent yet
Datastores	CockroachDB, Spanner, PostgreSQL, MySQL, memdb	PostgreSQL, MySQL, SQLite, memory
Governance	Single vendor, AuthZed	CNCF Incubating
Managed option	AuthZed Cloud and Dedicated, run by the maintainer	Auth0 FGA, run by Okta
Deep nested graphs	Materialize GA on Dedicated (September 2026)	Tune store design and caching yourself
Security disclosure	Enterprise customers get embargoed advance notice	Public disclosure for everyone

Pricing reality (checked 2026-11-05)

Both engines are free to self-host. AuthZed's pricing page lists four options: open source (free, "best for evaluation and test environments"), Cloud at "$2/hr" with resource-based billing, Self-Hosted Enterprise as an "annual license per-region and per-vCPU" by quote, and Dedicated Cloud "based on reserved-vCPU capacity". The structural point is that AuthZed meters compute, not tuples or checks, so storing more relationships does not raise the bill by itself. Support tiers differ sharply: Enterprise gets a 1-hour P1 response against 12 hours on Premium.

OpenFGA has no commercial owner. The managed route is Auth0 FGA, which its product page confirms is "built on OpenFGA" and which shows no public pricing. Our OpenFGA profile calls it Okta FGA; the product page uses the Auth0 FGA name. Model both paths in the TCO calculator, including the engineer time a self-hosted relationship store needs.

Ownership changes

No acquisitions touch either project. AuthZed is private and VC-backed, last raising a 12 million dollar Series A in June 2024. OpenFGA originated at Auth0/Okta and was donated to the CNCF, which moved it to Incubating in October 2025. Okta, through the Auth0 brand, still sells the managed version, so its influence on the roadmap is real even with neutral governance. The nearest consolidation in this category is WorkOS buying Warrant in 2024 (the product is now WorkOS FGA); see the acquisitions tracker.

Deployment and architecture

Both run as a stateful service you call over gRPC or HTTP. SpiceDB adds dispatch across cluster nodes and a choice of globally consistent datastores, which is why its multi-region story is stronger. Four SpiceDB capabilities are Enterprise-only: restricted API access, audit logging, rate limiting and security embargo. OpenFGA keeps every feature in the open build but leaves audit and change management thinner than a packaged product.

Migration notes

Tuples port, models do not. Expect to rewrite the schema, since SpiceDB permissions and caveats do not map one-to-one onto OpenFGA conditions and type restrictions. Rewrite the model, port your assertion tests, bulk-load tuples, then shadow-check both engines on live traffic before cutover. Teams coming from flat roles should read RBAC to ReBAC first.

Who should pick which

AuthZed: sharing-heavy SaaS with deep hierarchies, multi-region deployments, and teams that want the maintainer on the support contract.
OpenFGA: teams that require foundation governance, Okta customers who want Auth0 FGA, and single-region apps on PostgreSQL.

If policy-as-code fits better than a relationship store, compare OpenFGA vs Cerbos and the three-way OpenFGA vs AuthZed vs Cerbos, or see best authorization tools.

Frequently asked questions

What is the main technical difference between SpiceDB and OpenFGA?: Consistency. SpiceDB implements ZedTokens, which its documentation calls the equivalent of Zanzibar's Zookie, and exposes four per-request modes: minimize latency, at least as fresh, at exact snapshot, and fully consistent. OpenFGA offers two modes, MINIMIZE_LATENCY (the default, served from cache when possible) and HIGHER_CONSISTENCY (skips the cache), and its documentation says a Zookie-like token is being considered for future releases. If the New Enemy Problem matters to your design, SpiceDB has the stronger answer today.
Which datastores do SpiceDB and OpenFGA support?: SpiceDB supports CockroachDB (recommended for high-throughput and multi-region self-hosting), Cloud Spanner, PostgreSQL (recommended for single-region), MySQL (not recommended unless PostgreSQL is impossible) and an in-memory store for testing. OpenFGA supports memory, PostgreSQL, MySQL and SQLite. Only SpiceDB documents a multi-region-native datastore path.
Is OpenFGA still a CNCF sandbox project?: No. The CNCF Technical Oversight Committee accepted OpenFGA as an Incubating project, announced on 11 November 2025, with the maturity change dated 28 October 2025. Graduation is the next stage. SpiceDB is not a CNCF project; it is Apache 2.0 software stewarded by AuthZed.
Can I migrate between SpiceDB and OpenFGA?: Conceptually yes, mechanically it is a rewrite of the model. Both store relationship tuples of the form object, relation, subject, so the data maps. The schema languages differ: SpiceDB uses its own schema language with permissions and caveats, OpenFGA uses its modeling DSL with type restrictions and conditions. Plan to rewrite the model, re-run your test assertions against it, then bulk-load tuples and shadow-check both engines before cutting traffic.
How do the managed options compare on price?: As checked on 5 November 2026, AuthZed Cloud publishes one figure, deploying a permissions system from 2 dollars per hour with resource-based billing, while SpiceDB Enterprise is an annual licence per region and per vCPU and Dedicated is based on reserved vCPU capacity. Auth0 FGA, the managed service built on OpenFGA, shows no pricing on its product page, only a sign-up and a contact form. Self-hosting either engine is free under Apache 2.0.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.