Frauthy
A modular auth abstraction protocol.
One stable contract — session().can() — over swappable OAuth/OIDC providers and Zanzibar-style authorization stores. Author rules once in Frauthy Script; compile to SpiceDB or Ory Keto; eject any time.
// your code — never changes
frauthy.session().can("access", portal)What it does
- Single app-layer contract: session().can("action", resource)
- Frauthy Script: schema language, compiler and LSP — emit SpiceDB or Ory Keto
- Swappable providers: BetterAuth, Ory, Keycloak, Auth0, Clerk, custom OIDC
- SDKs in TypeScript, Rust, Go and Python at full conformance parity
- Eject to raw standard parts at any time — no lock-in by construction
- Auth-native APM: OTLP traces across the authn → map → authz → decide lifecycle
- Marketplace for reusable auth modules with ReBAC-governed visibility
Problem
Every product rebuilds the same seam between "who are you" (OIDC) and "what may you do" (fine-grained authorization), coupling app code to vendors on both sides. When you switch providers, you rewrite the integration.
Approach
Make the seam the product: one stable contract above, swappable implementations below, observability through the whole decision path, and a guaranteed exit via eject.
System
A Rust core (7 crates) powers the Frauthy Script compiler and LSP. A 4-language SDK conformance matrix ensures TypeScript, Rust, Go, and Python all behave identically against both SpiceDB and Ory Keto backends. Frauthy Cloud provides a managed control plane with auth-native APM on Cloudflare, and a marketplace with ReBAC-governed visibility tiers.
Craft
Conformance-driven development: the 10/10 SDK-by-backend matrix is the release gate. Go and Python SDKs use stdlib-only dependencies. The discovery-doc design language ensures consistent documentation across all surfaces.
Proof
GPFamily is the canonical worked example throughout Frauthy's documentation. The self-hosted tier is always free. Clean security review. Near-zero TODO density across the codebase.
Capswan's own customer portal authorization is SpiceDB-based, giving Frauthy a dogfooding path from within the studio itself.
Building on identity and fine-grained access? This is what our studio does. Start a project →
Design
Code
Frauthy is an 11-repository ecosystem around one seam: authentication in, authorization out. A Rust core compiles Frauthy Script to SpiceDB or Ory Keto; four SDKs hold conformance parity; a managed cloud adds auth-native observability.
Protocol Core
Request lifecycle engine (authn → map → authz → decide → observe); 7 Rust crates
Frauthy Script
Schema language: compiler + LSP; emits SpiceDB .zed or Keto OPL
CLI
frauthy init/compile/eject/conformance/dev — react-scripts-style eject
SDKs
TypeScript, Rust, Go (stdlib-only), Python (stdlib-only); 10 framework adapters
Cloud
Managed control plane: multi-tenant projects, OTLP ingest, auth-native APM, billing
Marketplace
Publish/discover auth modules; ReBAC-governed visibility tiers; domain verification
Admin
Operator portal + TUI: relationship browser, check console, schema editor, key rotation
Brand
Design system: 7 published packages, discovery-doc visual language
Sandbox
3 integration apps (TS/Go/Python) proving cross-language, cross-backend parity
Plus DevOps (conformance matrix, coverage gates, observability portal) and Terraform infrastructure for self-host and cloud.