OpenFGA vs SpiceDB: what is the difference?

Both implement Google Zanzibar-style relationship-based access control. SpiceDB, built by AuthZed, implements Zanzibar's point-in-time consistency through ZedTokens with four per-request consistency modes; OpenFGA offers an opt-in higher-consistency flag instead. OpenFGA is a CNCF Incubating project with Okta's Auth0 FGA as the managed version; SpiceDB is Apache 2.0 with AuthZed selling Cloud, Dedicated and Enterprise editions.

Cerbos vs OpenFGA: which should I use?

Use OpenFGA when permissions follow relationships, such as folders containing documents or teams owning projects, and you can keep a relationship store in sync. Use Cerbos when decisions depend on attributes of the user, resource and request, and you prefer stateless YAML policies in version control with no relationship database to run.

Is OpenFGA production ready?

Its governance is maturing: the CNCF accepted OpenFGA on 14 September 2022 and moved it to the Incubating level on 28 October 2025. It is free under Apache 2.0, and Auth0 FGA is the commercial managed service built on it, with support and SLAs.

How much do AuthZed and Cerbos cost?

Checked 2026-11-05: AuthZed Cloud starts at 2 dollars an hour, billed hourly, with Dedicated and self-hosted Enterprise priced on reserved vCPU and region. Cerbos Hub is free up to 100 monthly active principals, Development starts at 25 dollars a month and Production at 933 dollars a month with 5,000 principals included. The SpiceDB, OpenFGA and Cerbos engines themselves are free.

What are the best OpenFGA alternatives?

AuthZed SpiceDB for a stricter Zanzibar implementation with commercial support, Cerbos for stateless attribute-based policy, Open Policy Agent for general-purpose policy across infrastructure, and Oso or Permit.io for a more managed developer experience.

OpenFGA vs AuthZed (SpiceDB) vs Cerbos in 2026, Comparison

OpenFGA vs AuthZed (SpiceDB) vs Cerbos in 2026

CapabilityOpenFGAAuthZed

Overall

4.2

4.3

Authentication: 1.5; 2.0
SSO & Federation: 1.5; 2.0
Authorization: 4.7; 5.0
Lifecycle & Provisioning: 3.0; 2.5
MFA & Passwordless: 1.0; 1.5
Governance & Audit: 3.5; 3.5
Developer Experience: 4.3; 4.5
Deployment Flexibility: 4.5; 4.5
Pricing Transparency: 4.5; 3.5
Support & Ecosystem: 3.5; 3.0

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

Verdict

OpenFGA vs AuthZed vs Cerbos splits on your permission model. If permissions are relationships ("members of this team can edit these docs"), choose a ReBAC engine: OpenFGA for CNCF-governed open source with Okta's managed option, or AuthZed (SpiceDB) for the most faithful Zanzibar implementation with a commercial vendor. If decisions hinge on attributes and context ("managers in the EU region during business hours"), Cerbos fits better and avoids running a relationship store. Profile scores: AuthZed 4.3, OpenFGA 4.2, Cerbos 4.0.

Where each wins

Decision factor	OpenFGA	AuthZed (SpiceDB)	Cerbos
Model	ReBAC (Zanzibar)	ReBAC (Zanzibar)	Policy-as-code (ABAC, RBAC)
State	Stores relationship tuples	Stores relationship tuples	Wins: stateless evaluation
Consistency guarantees	Opt-in higher consistency	Wins: ZedTokens, four modes	Not applicable
Governance	Wins: CNCF Incubating	Single vendor, Apache 2.0	Single vendor, Apache 2.0
Managed option	Auth0 FGA, no public price	AuthZed Cloud from $2/hr	Cerbos Hub, free tier
Deep nested graphs at scale	Capable	Wins: Materialize (Dedicated)	Needs extra modeling

Pricing reality (checked 2026-11-05)

All three engines are free under Apache 2.0. The money is in managed control planes.

AuthZed: the pricing page advertises AuthZed Cloud from $2 an hour, billed hourly. Dedicated Cloud is priced on reserved vCPU capacity, and self-hosted SpiceDB Enterprise is an annual license per region and per vCPU. Cost tracks compute, not how many relationships you store.
Cerbos: the pricing page bills Cerbos Hub on monthly active principals (users or non-human identities). Proof of Concept is free to 100; Development starts at $25 a month; Production starts at $933 a month with 5,000 included. Per-principal rates fall from $0.25 to $0.062 at 100,000, with 15% off yearly.
OpenFGA: no vendor price. Auth0 FGA is the managed version, quote-based.

Ownership and status changes

The CNCF moved OpenFGA from Sandbox to Incubating on 28 October 2025, three years after accepting it. OpenFGA originated at Auth0 and Okta, which sells Auth0 FGA on top of it. AuthZed and Cerbos Inc. are private, open-core companies. AuthZed made Materialize, which precomputes transitive relationships, generally available on 10 September 2026 for Dedicated customers only.

Deployment and architecture

OpenFGA and SpiceDB are services backed by a database. You define a schema of object types and relations, write tuples whenever application data changes, and call Check or list APIs. The hard part is keeping tuples in sync with your source of truth. Cerbos runs a stateless policy decision point as a sidecar or service; your application sends principal and resource attributes on every request, and query plans let you filter lists. Nothing to sync, but every attribute must be available at decision time.

Migration notes

Moving between OpenFGA and SpiceDB is a schema translation plus a tuple backfill; the concepts map closely, but consistency semantics differ, so retest any flow that depends on read-after-write. Moving from either to Cerbos means converting relationships into attributes you can pass per request, which works for shallow hierarchies and breaks down for deep nested sharing. Run the old and new engines in shadow mode and diff decisions before cutting over.

Who should pick which

OpenFGA: vendor-neutral ReBAC, especially alongside Okta or Auth0.
AuthZed: production ReBAC where consistency and deep graphs matter and you want a vendor contract.
Cerbos: attribute-driven decisions across microservices, managed in Git.

Frequently asked questions

OpenFGA vs SpiceDB: what is the difference?: Both implement Google Zanzibar-style relationship-based access control. SpiceDB, built by AuthZed, implements Zanzibar's point-in-time consistency through ZedTokens with four per-request consistency modes; OpenFGA offers an opt-in higher-consistency flag instead. OpenFGA is a CNCF Incubating project with Okta's Auth0 FGA as the managed version; SpiceDB is Apache 2.0 with AuthZed selling Cloud, Dedicated and Enterprise editions.
Cerbos vs OpenFGA: which should I use?: Use OpenFGA when permissions follow relationships, such as folders containing documents or teams owning projects, and you can keep a relationship store in sync. Use Cerbos when decisions depend on attributes of the user, resource and request, and you prefer stateless YAML policies in version control with no relationship database to run.
Is OpenFGA production ready?: Its governance is maturing: the CNCF accepted OpenFGA on 14 September 2022 and moved it to the Incubating level on 28 October 2025. It is free under Apache 2.0, and Auth0 FGA is the commercial managed service built on it, with support and SLAs.
How much do AuthZed and Cerbos cost?: Checked 2026-11-05: AuthZed Cloud starts at 2 dollars an hour, billed hourly, with Dedicated and self-hosted Enterprise priced on reserved vCPU and region. Cerbos Hub is free up to 100 monthly active principals, Development starts at 25 dollars a month and Production at 933 dollars a month with 5,000 principals included. The SpiceDB, OpenFGA and Cerbos engines themselves are free.
What are the best OpenFGA alternatives?: AuthZed SpiceDB for a stricter Zanzibar implementation with commercial support, Cerbos for stateless attribute-based policy, Open Policy Agent for general-purpose policy across infrastructure, and Oso or Permit.io for a more managed developer experience.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.