FerrisKey is an open-source, cloud-native Identity & Access Management platform designed for Kubernetes, multi-tenancy, and modern security architectures.
Why now
Wiring identity into a modern stack means stitching together password storage, MFA, OIDC, sessions, audit, federation, and policy across fragmented systems — with no unified audit trail and no consistent policy. FerrisKey unifies everything behind one Rust-native service.
Built in-house
Keycloak + extensions
Auth0 (SaaS)
With FerrisKey
Why FerrisKey
Identity & Access Management is the backbone of any secure platform. It controls who can authenticate, what they are authorized to do, and how every access event is tracked across every service, team, and environment in your infrastructure.
Without a solid IAM foundation, teams end up with fragmented auth logic scattered across services, no unified audit trail, and security gaps that grow with every new product. FerrisKey addresses this with a unified, operator-first approach designed for distributed systems from day one.
Built in Rust from the ground up — not ported or wrapped. A ~10MB binary, sub-10ms auth latency, and a predictable memory footprint that holds under sustained load.
FerrisKey ships with first-class tooling for every ops workflow — from local testing to production GitOps pipelines. No custom scripting required.
Every identity event — login, token issuance, policy change, realm update — emits a structured event you can consume to trigger webhooks, sync to your data lake, or drive custom workflows without patching the core.
FerrisKey is designed to fit naturally into cloud-native stacks. Native integrations with the tools your platform team already runs — no adapters, no workarounds.
Compare
Quick, factual comparison with the IAM tools teams reach for first. Same protocols on the surface, very different shapes underneath.
| Criteria | FerrisKey | Keycloak | Auth0 | Authentik | Ory |
|---|---|---|---|---|---|
| Runtime | Rust | Java / JVM | SaaS only | Python | Go |
| License | Apache 2.0 | Apache 2.0 | Commercial | MIT | Apache 2.0 |
| Memory footprint | ~10 MB | ~500 MB | — | ~200 MB | ~80 MB / svc |
| Cold start | < 1 s | 10–30 s | — | ~5 s | ~2 s |
| Self-hosted | Yes | Yes | No | Yes | Yes |
| Multi-tenancy | Realms | Realms | Tenants | Brands | Projects |
| Kubernetes operator | Yes | Yes | No | partial | helm only |
| OIDC / OAuth2 | Yes | Yes | Yes | Yes | Yes |
| MFA built-in | Yes | Yes | Yes | Yes | Yes |
| Modular architecture | Yes | SPI extensions | No | No | Split services |
| AuthZen-ready | planned | No | No | No | Keto ReBAC |
Live
Sign-ins, MFA challenges, token issuance, role changes, federation events — FerrisKey writes them all to one structured stream. Tail it, ship it to your SIEM, or replay it.
Interface
A clean admin UI to manage your realms, clients, users and permissions — without getting lost.
Modules
Purpose-built systems for authentication, audit, federation, and more. Each module owns a specific aspect of identity — composable, extensible, and production-ready.
From passwordless auth to enterprise federation — the primitives are there, composable by design.
Open source
Public release notes, public roadmap, public contributors — no surprises in how Ferriskey grows.
No lock-in, no black boxes. Audit the code, contribute, or fork it — Ferriskey belongs to the community.
Team
The people behind Ferriskey — building secure identity infrastructure in the open.
Partners
These companies and projects keep Ferriskey thriving. Their support funds development, maintenance, and community growth — allowing us to stay independent and focused on building the best IAM we can.
Become a partnerSupporters
Blog
Stay up to date with the latest news and updates.
Ready when you are
Self-hosted, Apache 2.0, built in Rust. Deploy Ferriskey in minutes and own your authentication stack — no vendor, no lock-in.
Ferriskey
