AuthZed

AuthZed: frequently asked questions

How much does AuthZed cost?

SpiceDB self-hosted is free under Apache 2.0. AuthZed Cloud publishes one figure, deploying a permissions system from 2 dollars per hour, billed hourly and invoiced monthly in arrears with no annual commitment and a starter programme offering 700 dollars in credits. SpiceDB Enterprise, the self-hosted commercial build, is an annual subscription licensed per region and per vCPU, unpriced publicly. AuthZed Dedicated Cloud is tailored and based on reserved vCPU capacity. The important structural point is that AuthZed prices on compute capacity, not on relationships, tuples, requests or monthly active users, so cost does not scale with how many permission facts you store.

Is SpiceDB open source and has the licence changed?

SpiceDB is Apache 2.0 and remains so. There has been no relicensing event, no move to BUSL or SSPL, which is worth stating plainly given how many infrastructure projects have changed terms since 2023. The repository carries around 7,100 stars. SpiceDB Enterprise is a separate commercially licensed build of the same engine rather than a fork, and AuthZed runs it in its own managed services.

What do you lose by running open-source SpiceDB instead of Enterprise?

Four documented capabilities. Restricted API Access scopes which calls each service account may make. Audit Logging emits full request and response detail per API operation to a log sink. Rate Limiting applies distributed limits by endpoint, service account, header or CEL expression, currently marked tech preview. And Security Embargo gives private advance notice of vulnerabilities, with fixes and remediation time before public disclosure. That last one has a real consequence worth weighing: open-source users learn about SpiceDB vulnerabilities at public disclosure, paying customers learn earlier.

Is SpiceDB a true Zanzibar implementation?

It is the closest of the open-source options. SpiceDB implements token-based point-in-time consistency through ZedToken, which its documentation explicitly identifies as the equivalent of Zanzibar's Zookie, and names the New Enemy Problem it exists to prevent. Four consistency modes are exposed per request: minimize_latency, at_least_as_fresh, at_exact_snapshot and fully_consistent. OpenFGA offers an opt-in higher-consistency flag rather than token-based point-in-time consistency. If faithfulness to the Zanzibar paper matters to your design, SpiceDB is the stronger claim.

What is AuthZed Materialize?

Materialize precomputes transitive relationships across the authorization graph, periodically recomputing its view from a snapshot and consuming a live stream of relationship changes in between. It reached general availability on 10 September 2026 for AuthZed Dedicated only, after entering early access in February 2024. AuthZed states single-digit millisecond responses over billions of relationships in production since 2024. Event Streams remains early access; Accelerated Queries is the part that went GA. This is the answer to deeply nested permission graphs where live traversal becomes the bottleneck.

Does SpiceDB have known vulnerabilities?

Several, all patched, none severe enough to reach CISA KEV. The most recent is CVE-2026-55866, published 14 September 2026 at CVSS 3.7: cache keys for dispatch checks omitted CheckHints, so SpiceDB could return a full permission grant where a conditional or negative result was correct. It affects 1.34.0 up to 1.54.0 and is fixed in 1.54.0. Earlier: CVE-2026-46668 (2.3, improper cache reuse with nested caveat lists, fixed 1.52.0), CVE-2026-40091 (datastore connection string including a plaintext password written to startup logs, fixed 1.51.1), CVE-2023-46255 (similar log exposure) and CVE-2023-29193 (8.1, metrics port bound to untrusted networks leaking command-line flags). The pattern is authorization-logic and log-hygiene bugs rather than remote code execution.

How well funded is AuthZed?

Its last disclosed round was a 12 million dollar Series A announced 27 June 2024, led by General Catalyst with Work-Bench, Y Combinator and Amplify Partners, bringing total raised to 15.9 million dollars. Canva and Turo were named as customers. No funding has been announced since, so that figure is now over two years old. At the time SpiceDB had more than 4,500 GitHub stars; it has roughly 7,100 as of September 2026.

What are the best AuthZed alternatives?

OpenFGA, which reached CNCF Incubating maturity in October 2025, if vendor-neutral foundation governance matters more than Zanzibar fidelity. Oso if you want one model spanning roles, relationships and attributes with SQL-level data filtering rather than a relationship database. Cerbos if stateless policy decisions without a central relationship store fit better. Permit.io for a more managed, product-led experience. Stay with SpiceDB when sharing, nesting and hierarchy dominate your permission model and consistency guarantees matter.