Ory Oathkeeper is an open-source identity and access proxy and access-control decision API, written in Go. It authenticates, authorises and mutates incoming HTTP requests according to access rules, following a zero-trust model. Authenticators include cookie sessions, bearer tokens, OAuth2 introspection and JWT; authorisation can use Ory Keto for fine-grained permissions; mutators can add headers, set cookies or issue signed ID tokens. Oathkeeper can run as a reverse proxy or as a decision API queried by gateways such as Nginx, Envoy, Kong and AWS API Gateway. It needs no database, since rules are loaded from files or HTTP endpoints.
Oathkeeper is licensed under Apache 2.0 and can be self-hosted on your own infrastructure, so you decide where it runs. Ory also offers an Ory Enterprise License for self-hosted or on-premises use with support and security patches, and the managed Ory Network. On Ory Network you choose the personal data location when creating a project, and personal data of EU users is stored on servers in the EU, while operational data such as session and token validity is replicated globally.