Casbin is an open-source access control library supporting ACL, RBAC, and ABAC models across Go, Python, Java, Node.js, and other languages. Free to use.
Casbin is an open-source authorization library created in 2017 by Yang Luo, then a student at Peking University, and now developed as an incubating project under the Apache Software Foundation. It is distributed free under the Apache 2.0 license and is embedded directly into applications as a code library rather than run as a hosted service.
Its core abstraction, the PERM metamodel, lets developers define an access control model in a configuration file and switch between paradigms like ACL, RBAC, and ABAC without rewriting application logic.
Casbin separates the access control model from the policy data, which can be stored in files, SQL/NoSQL databases, or custom adapters and updated at runtime via API calls. Its runtime API supports permission checks, role queries, and dynamic policy management.
The library is available across many languages — Go (core), Python, Java, Node.js, .NET, Rust, Ruby, C/C++, and PHP — all maintained under the Apache organization on GitHub, letting teams apply a consistent authorization model across polyglot codebases.
Casbin is completely free and open-source under the Apache 2.0 license, with no commercial tiers, subscriptions, or paid support contracts offered by the project itself.
Teams that need a full identity and access management product with a management UI typically pair Casbin with a companion open-source project such as Casdoor, which uses Casbin as its underlying authorization engine.
Yes, Casbin is fully open-source under the Apache 2.0 license and free to use in commercial and non-commercial projects.
Casbin supports Access Control Lists (ACL), Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and hybrid models such as RBAC with domains, all defined through its PERM metamodel.
Casbin's core is written in Go, with actively maintained ports for Python, Java, Node.js/JavaScript, .NET/C#, Rust, Ruby, C/C++, and PHP.
Casbin was created in 2017 by Yang Luo while at Peking University, and is now developed as an incubating project under the Apache Software Foundation.
No, Casbin is a library, not a hosted product with a UI. Projects that need a management interface typically pair it with a companion tool like Casdoor.