FerrisKey is an open-source, cloud-native Identity & Access Management platform designed for Kubernetes, multi-tenancy, and modern security architectures.
Supporters
Use cases
Whether you sign in customers, onboard business clients or give identities to AI agents, FerrisKey runs the same open-source core.
A fast, themeable login for the people who use your product. Passkeys, magic links and MFA are built in, and you shape the flow yourself.
Each organization gets members, groups and roles, and can bring its own identity provider. Your own workforce signs in the same way.
Let agents act on behalf of users without sharing their credentials. Delegation is explicit, scoped and audited.
Features
Each capability is a module of the same open-source server, so you switch on what you need and leave the rest.
WebAuthn passkeys, TOTP, magic links and recovery codes, enforced per realm or per role.
Compose authentication steps and conditions instead of patching a fixed login page.
Federate OIDC identity providers and LDAP directories, and serve SAML applications.
Members, groups and roles for each business customer, inside one realm.
Shape the claims in every token and the scopes each client may request.
Write Cedar policies per realm and evaluate access requests over the AuthZEN API.
Let a realm authorize MCP servers, with dynamic client registration and token exchange for agents.
Every security event lands in a hash-chained log, ready to stream out.
Events leave through a delivery outbox, with custom headers per webhook.
Problems we solve
Each one has a plain answer in FerrisKey.
01
One OpenID Connect and OAuth 2.0 server. Your apps just validate tokens.
web app
validates token
mobile
validates token
api
validates token
FerrisKey
OIDC · OAuth 2.0
02
Organizations, per-realm themes and federation over OIDC, SAML and LDAP.
acme-corp
own login · own members
globex
own login · own members
initech
own login · own members
one realm · isolated organizations
03
Service accounts, token exchange with a delegation chain, and Cedar policies for every call.
Cedar policy
permit (principal is Agent,
action == call_tool,
resource is Tool);
Permit · search_docs
Deny · delete_user
04
Every security event goes into a hash-chained log, and webhooks carry it out.
event 1
a3f9…
event 2
7c21…
event 3
e08b…
event 4
51d4…
05
One Rust service, a Helm chart and a Kubernetes operator.
one Rust service
API · admin console · login portal
Helm chart
published as an OCI artifact
Operator
Kubernetes native
06
Apache 2.0, self-hosted, standard protocols. Leave whenever you want.
Apache 2.0
read it, fork it, run it yourself
OIDC
OAuth 2.0
SAML
Interface
A clean admin UI to manage your realms, clients, users and permissions, without getting lost.
Community
Public releases, a public roadmap, public contributors and an open governance.
Latest releases
All release notes →
Team
The people behind Ferriskey, building secure identity infrastructure in the open.
Sponsoring
Our financial partners fund development, infrastructure, and the long-term roadmap. That's what keeps Ferriskey independent and moving fast.
Lead Sponsor 
Cloud IAM is a major supporter of Ferriskey. Their financial backing and identity expertise help the project grow in the open.
Partnership
France Nuage is our cloud partner in France and runs the official managed Ferriskey offering on their infrastructure.
Hosted in France
Your data stays on French soil, out of reach of the US Cloud Act.
Fully managed
France Nuage handles updates, monitoring, and uptime, so your team can focus on using Ferriskey instead of running it.
GDPR ready
Built for organizations that need to meet strict data protection requirements.
Ready when you are
Self-hosted, Apache 2.0, built in Rust. Deploy Ferriskey in minutes and own your authentication stack outright, with no vendor holding the keys.
FerrisKey
