Add authorization to your app.
Not a second system to maintain.
One API call to check access. SDKs in TypeScript, Go, and Python. No policy language to learn, no infrastructure to run. Start free — first 50K checks/month on us.
Check a permission in 3 lines
import { WardenAuth } from '@ecarrizo2/wardenauthz-js'
const client = new WardenAuth({ apiKey })
const { allowed } = await client.access.check({
subjectId: user.id,
scopeId: workspace.id,
resource: 'invoice',
action: 'delete',
})import ac "github.com/ecarrizo2/wardenauthz-go"
client := ac.NewClient(ac.ClientConfig{APIKey: key})
result, err := client.Access.HasAccess(ctx, ac.AccessCheckInput{
SubjectId: userID,
ScopeId: scopeID,
Resource: "invoice",
Action: "delete",
})curl -X POST https://api.wardenauthz.com/v1/access/check \
-H "X-API-Key: sk_..." \
-H "Content-Type: application/json" \
-d '{
"subjectId": "user_123",
"scopeId": "workspace_acme",
"resource": "invoice",
"action": "delete"
}'Built for developers, not just security teams
On the critical path
Authorization runs on the request path. Fargate eval service with a direct Postgres pool, request-scoped caching, no Data API hop.
No policy language to learn
Roles, permissions, and scopes are structured JSON data — not Rego, not Cedar, not a DSL. Use the dashboard or API directly.
Works with any auth provider
Bring your own Cognito, Auth0, Clerk, or custom JWT. WardenAuth handles authorization — you keep your existing auth.
Deny-wins by default
Explicit deny overrides all allows. Grant broad access for convenience, carve out hard restrictions for security.
SDKs with full type safety
TypeScript SDK with complete IntelliSense. Go SDK with context propagation. Python SDK with async support. REST API always available.
One API endpoint for access
POST /v1/access/check — that's the core. Management is RESTful CRUD on roles, permissions, and policies.
Common integration patterns
Middleware / Guard
Wrap your route handlers with a one-line authorization check. Deduplicated per request — pay for the decision once, no matter how many times it's checked.
Service-level checks
Inject the authorization client into your services for conditional logic — "show the export button only if they can export."
Multi-tenant isolation
Each customer workspace is an isolated scope. Permissions, roles, and policies in Scope A cannot touch Scope B. Isolation by construction.
Get your API key in 30 seconds
Self-serve registration. First 50,000 access checks/month free. No credit card.
Start building