Authorizer is an open-source authentication and authorization server that can be self-hosted.
The project started around authentication for applications and users. Over time, I started running into a broader set of problems involving services, workloads, and agents making requests.
That's a big part of what led to the work in 2.4.
One area I spent a lot of time on was delegation. An agent can need to act on behalf of a user and then call another service or agent. Passing the user's original access token through every step makes it difficult to keep the user's permissions separate from the permissions of the agents acting on their behalf.
Authorizer 2.4 adds OAuth token exchange using RFC 8693 for this. Delegated tokens carry an actor chain, and the effective scope is attenuated based on the subject token, the agent's allowed scopes, and the requested scope.
The release also adds service accounts using OAuth client credentials for machine-to-machine authentication. Service accounts can authenticate using JWT bearer assertions, SPIFFE JWT-SVID, or Kubernetes TokenReview when workload identity is configured.
Another significant part of the release is MCP. Authorizer can expose its MCP surface over Streamable HTTP and protect it as an OAuth 2.1 resource server. It implements protected resource metadata, Dynamic Client Registration, Client ID Metadata Documents, and RFC 8707 audience binding for the MCP endpoint.
The release also adds a number of enterprise identity features: SAML 2.0 and OIDC federation, SCIM 2.0 user and group provisioning, organizations, WebAuthn/passkeys, and relationship-based authorization using an embedded OpenFGA engine.
Service accounts can also be represented as first-class subjects in the authorization model, so authorization can distinguish between a user and an autonomous workload.
I wanted Authorizer to remain self-hostable. There are good hosted authentication services, but some teams need to run their identity infrastructure themselves or want control over where it runs.
If you want to try Authorizer, there is a Railway deployment template:
https://railway.com/deploy/authorizer-1?referralCode=FEF4uT&...
The source is here:
https://github.com/authorizerdev/authorizer
Getting started:
https://docs.authorizer.dev/getting-started/
The complete 2.4.0 changelog:
https://github.com/authorizerdev/authorizer/blob/main/CHANGE...
I'm particularly interested in how other teams are handling identity and delegation when agents need to call multiple services or act on behalf of users.