SpiceDB Files

For Authzed's first birthday, our gift isn't for us, but the community.

Today, we're as excited as we've ever been.

Today, the database powering the core of Authzed, SpiceDB, is now open source!

SpiceDB is the most faithful implementation of Google's Zanzibar paper outside of the original system at Google.

Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications. Leveraging a system like SpiceDB has become an industry best-practice and is being used to great success at companies large (Google, GitHub, Airbnb) and small (Carta, Authzed).

As we develop SpiceDB, we will not only maintain compatibility with the original paper, but continue to introduce innovations that improve overall user experience. An example of this is our Schema Language, which compiles to Zanzibar's Namespace Configs, but adds far more intuitive syntax and type-safety. However, these types of features cannot be created in a vacuum, thus all future development on SpiceDB will be done entirely in the open.

We invite everyone to collaborate with us on GitHub and join our discussions on the Zanzibar Discord.

Initial features included in SpiceDB that distinguish it from other systems include: - Expressive APIs for checking permissions, listing access, and powering devtools - An architecture faithful to the Google Zanzibar paper, including resistance to the New Enemy Problem - An intuitive and expressive schema language complete with a playground dev environment - A powerful graph engine that supports distributed, parallel evaluation - Pluggable storage that supports in-memory, PostgreSQL, and CockroachDB - Deep observability with Prometheus metrics, structured logging, and distributed tracing

Getting Started

Get a taste of the schema language

• Follow the guide for developing a schema
• Watch a video of us modeling GitHub
• Read the schema language design documentation
• Jump into the playground, load up some examples, and mess around

Learn how to integrate an application

• Learn the latest best practice by following the Protecting Your First App guide
• Explore the gRPC API documentation on the Buf Registry
• Install zed and interact with a live database

Installation

Installing SpiceDB

SpiceDB is currently packaged by Homebrew for both macOS and Linux. Individual releases and other formats are also available on the releases page.

:::sh
brew install authzed/tap/spicedb

SpiceDB is also available as a container image:

:::sh
docker pull quay.io/authzed/spicedb:latest

For production usage, we highly recommend using a tag that corresponds to the latest release, rather than latest.

Running SpiceDB locally

:::sh
spicedb serve --grpc-preshared-key "somerandomkeyhere" --grpc-no-tls

Visit http://localhost:8080 to see next steps, including loading the schema

Changelog