---
title: "AuthZed SpiceDB Review 2026: Pricing & Alternatives | IDSync"
url: https://idsync.com/directory/authzed
description: "AuthZed and SpiceDB review: Apache-2.0 Zanzibar-style permissions database, ReBAC, SDKs, datastores, cloud pricing from $2/hr, limits and alternatives."
lang: en
---

# AuthZed (SpiceDB)

Maker of SpiceDB, the Apache-2.0 "open source permissions database" inspired by Google Zanzibar, offered self-hosted, as usage-priced AuthZed Cloud, as Dedicated cloud, or as a licensed self-hosted enterprise build.

Last updated 3 weeks ago

Visit site (https://authzed.com/)

Quick answer

## What is AuthZed (SpiceDB)?

Short answer

AuthZed builds SpiceDB, described as "the open source permissions database": a Google Zanzibar-inspired, Apache-2.0 licensed engine for storing and querying fine-grained relationship-based (ReBAC) authorization data, with caveated relationships for ABAC-style conditions, per-request configurable consistency and reverse-index queries ("Who can access resource?"). SpiceDB runs on PostgreSQL, CockroachDB, Google Cloud Spanner or MySQL and ships official client libraries for Go, Node, Python, Ruby, Java and .NET. AuthZed sells it as AuthZed Cloud (usage-based, "Deploy a permissions system for $2/hr"), AuthZed Dedicated (reserved-vCPU private deployment) and SpiceDB Enterprise (annual per-region, per-vCPU self-hosted licence), plus Materialize for precomputed permissions and MCP servers for AI tooling. Netflix and Turo are named customer stories.

Best for

Product engineering teams building fine-grained, relationship-based permissions (sharing, hierarchies, multi-tenant B2B) at scale who want Zanzibar semantics without building them.

When to choose

Your permission model is relationship-heavy and must scale, and you want a proven open-source engine with a managed option.

When not to choose

You only need coarse roles inside one app, or you prefer a policy-language approach (OPA or Cedar style) over a relationship graph.

Related tools & categories

Authorization: https://idsync.com/directory/category/authorization
Ory: https://idsync.com/directory/ory
Cerbos: https://idsync.com/directory/cerbos
Run the IAM Stack Finder: https://idsync.com/stack-finder
Report: The State of AI Agent Identity 2026: https://idsync.com/reports/state-of-ai-agent-identity-2026

## Categories

Authorization ★: https://idsync.com/directory/category/authorization

## Common use cases

- Fine-grained application authorization (document sharing, folders, org hierarchies)
- Multi-tenant B2B permission models
- Externalising authorization from microservices via gRPC or HTTP API
- Permission-aware RAG and AI-agent access (LangChain, Pinecone, Weaviate integrations)
- Answering "who can access X" via reverse-index queries

## Strengths

- Apache-2.0 open-source engine with a faithful Zanzibar design and a stated 5 ms p95 in production
- Official SDKs for Go, Node, Python, Ruby, Java and .NET plus an HTTP/OpenAPI API
- Runs on PostgreSQL, CockroachDB, Spanner or MySQL, with a Kubernetes operator for self-hosting
- Choice of free self-host, usage-based cloud, dedicated or licensed enterprise builds

## Limitations & considerations

- ReBAC/Zanzibar modelling has a learning curve compared with simple RBAC libraries
- Self-hosted enterprise and Dedicated pricing are quote-only
- Operating SpiceDB yourself means running a datastore and tuning consistency and caching
- Focused on authorization data; no authentication, user directory or IdP features

## Pricing model summary

Published (as published September 2026): SpiceDB open source free (Apache-2.0); AuthZed Cloud usage-based, resource-priced from "$2/hr"; Self-Hosted enterprise on an annual per-region, per-vCPU licence (contact sales); Dedicated Cloud priced on reserved-vCPU capacity (contact sales).

View vendor pricing page ↗ (https://authzed.com/pricing)

## Integrations

PostgreSQL CockroachDB Google Cloud Spanner MySQL Kubernetes gRPC Go Node.js Python Ruby Java .NET LangChain LangGraph Pinecone Weaviate Testcontainers

## Fit

Company size

startup, smb, mid_market, enterprise

Deployment

saas, self_hosted

Source

open core

Pricing model

usage-based / enterprise

## Alternatives & comparisons

Ory (https://idsync.com/directory/ory)

Open source identity, authorization and zero trust stack (Kratos, Hydra, Keto, Oathkeeper) available self-hosted or as Ory Network SaaS.

Compare AuthZed (SpiceDB) vs Ory → (https://idsync.com/compare/authzed-vs-ory)

Cerbos (https://idsync.com/directory/cerbos)

Cerbos is an authorization management platform built around an open source policy decision point (PDP). It enforces fine-grained RBAC, ABAC, PBAC, and ReBAC policies for applications, APIs, workloads, and AI agents.

Compare AuthZed (SpiceDB) vs Cerbos → (https://idsync.com/compare/authzed-vs-cerbos)

Permit.io (https://idsync.com/directory/permit-io)

Permit.io provides authorization-as-a-service with a low-code policy management interface, RBAC/ABAC/ReBAC policy support, and a managed policy decision layer — enabling teams to ship fine-grained access control without building it from scratch.

Compare AuthZed (SpiceDB) vs Permit.io → (https://idsync.com/compare/authzed-vs-permit-io)

## Related glossary terms

Key identity & access terms relevant to AuthZed (SpiceDB).

Relationship-Based Access Control: https://idsync.com/glossary/relationship-based-access-control
Attribute-Based Access Control: https://idsync.com/glossary/attribute-based-access-control
Role-Based Access Control: https://idsync.com/glossary/rbac
Policy as Code: https://idsync.com/glossary/policy-as-code
Principle of Least Privilege: https://idsync.com/glossary/least-privilege
OAuth Scopes: https://idsync.com/glossary/oauth-scopes

AuthZed (SpiceDB) and its logo are trademarks of their respective owner. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated.

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "name": "AuthZed (SpiceDB)",
    "applicationCategory": "SecurityApplication",
    "applicationSubCategory": "Authorization",
    "url": "https://authzed.com/",
    "description": "AuthZed builds SpiceDB, described as \"the open source permissions database\": a Google Zanzibar-inspired, Apache-2.0 licensed engine for storing and querying fine-grained relationship-based (ReBAC) authorization data, with caveated relationships for ABAC-style conditions, per-request configurable consistency and reverse-index queries (\"Who can access resource?\"). SpiceDB runs on PostgreSQL, CockroachDB, Google Cloud Spanner or MySQL and ships official client libraries for Go, Node, Python, Ruby, Java and .NET. AuthZed sells it as AuthZed Cloud (usage-based, \"Deploy a permissions system for $2/hr\"), AuthZed Dedicated (reserved-vCPU private deployment) and SpiceDB Enterprise (annual per-region, per-vCPU self-hosted licence), plus Materialize for precomputed permissions and MCP servers for AI tooling. Netflix and Turo are named customer stories.",
    "offers": {
      "@type": "Offer",
      "category": "usage-based / enterprise"
    },
    "dateModified": "2026-09-17T14:55:08.010998+00:00"
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "What is AuthZed (SpiceDB)?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "AuthZed builds SpiceDB, described as \"the open source permissions database\": a Google Zanzibar-inspired, Apache-2.0 licensed engine for storing and querying fine-grained relationship-based (ReBAC) authorization data, with caveated relationships for ABAC-style conditions, per-request configurable consistency and reverse-index queries (\"Who can access resource?\"). SpiceDB runs on PostgreSQL, CockroachDB, Google Cloud Spanner or MySQL and ships official client libraries for Go, Node, Python, Ruby, Java and .NET. AuthZed sells it as AuthZed Cloud (usage-based, \"Deploy a permissions system for $2/hr\"), AuthZed Dedicated (reserved-vCPU private deployment) and SpiceDB Enterprise (annual per-region, per-vCPU self-hosted licence), plus Materialize for precomputed permissions and MCP servers for AI tooling. Netflix and Turo are named customer stories."
        }
      },
      {
        "@type": "Question",
        "name": "Who is AuthZed (SpiceDB) best for?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Product engineering teams building fine-grained, relationship-based permissions (sharing, hierarchies, multi-tenant B2B) at scale who want Zanzibar semantics without building them."
        }
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://idsync.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Directory",
        "item": "https://idsync.com/directory"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Authorization",
        "item": "https://idsync.com/directory/category/authorization"
      },
      {
        "@type": "ListItem",
        "position": 4,
        "name": "AuthZed (SpiceDB)",
        "item": "https://idsync.com/directory/authzed"
      }
    ]
  }
]
```