flowctl is a free, open-source, single-binary workflow automation tool with approvals, OIDC SSO, RBAC, and remote execution. Features, pricing, alternatives.
flowctl is a free, open-source, self-hosted workflow automation platform packaged as a single binary. It lets engineering and operations teams define workflows, such as granting temporary SSH access, provisioning infrastructure, running database maintenance, or automating internal business processes, as version-controlled YAML or HUML configuration files, then expose them to authorized users through a web interface with approvals, role-based access control, and audit logging.
The project's public GitHub repository was created on October 30, 2025, and is authored and maintained by a developer known as cvhariharan (Hariharan), a software engineer who works on DevOps and infrastructure. It is presented as an independent open-source project rather than a commercially backed product, and it is written in Go on the backend with a Svelte and TypeScript frontend, licensed under Apache 2.0.
Workflows in flowctl are defined declaratively with inputs, a sequence of actions, and optional approval gates that pause execution until a designated approver signs off. Actions can run locally or be dispatched over SSH to multiple remote nodes concurrently, and workflows can be triggered on demand or automatically via one or more cron schedules.
Security and governance are built in rather than bolted on: authentication integrates with OIDC identity providers for single sign-on, RBAC and team or project namespace isolation control who can view, run, or approve each workflow, and an internal keystore encrypts secrets such as SSH keys and passwords at rest. The web UI streams execution logs in real time, retains execution history, passes file-based artifacts between workflow steps, and can automatically retry failed actions.
flowctl has no pricing tiers, paid edition, or hosted SaaS offering. The entire codebase is published under the Apache 2.0 license, allowing free commercial and non-commercial use, modification, and self-hosted redistribution, and there is no pricing page on flowctl.net.
A public live demo is available at demo.flowctl.net so prospective users can try the web interface before deploying it. Production use requires self-hosting the binary (or its Docker image) alongside a PostgreSQL database that the adopting team provisions and operates itself, so the only real costs are the infrastructure used to run flowctl, not the software.
flowctl is a free, open-source, single-binary workflow automation platform that lets teams define operational workflows, such as granting temporary SSH access, provisioning infrastructure, or running maintenance jobs, as YAML or HUML configuration files, then expose them through a self-hosted web interface with built-in approvals, scheduling, and role-based access control.
Yes. flowctl is licensed under the Apache 2.0 license and is entirely free to download, self-host, and modify. There is no paid tier, subscription, or hosted SaaS version; the only cost is the infrastructure a team uses to run the binary and its required PostgreSQL database.
flowctl is developed and maintained on GitHub under the handle cvhariharan by Hariharan, a software engineer who works on DevOps and infrastructure. It is presented as an independent open-source project rather than a product of a specific company.
flowctl runs as a single compiled binary (or via the provided Docker Compose setup) and requires only a PostgreSQL database as an external dependency. Official binaries are published for Linux (x86_64, arm64, and armv7) and macOS (x86_64 and arm64); no official Windows build is provided.
flowctl positions itself as a lighter-weight alternative to Rundeck, offering similar self-service job execution, approvals, and RBAC without a JVM runtime or commercial enterprise edition. Compared with Ansible AWX, flowctl is not tied to Ansible playbooks and treats approval gates and OIDC SSO as first-class concepts rather than add-ons.
Yes. flowctl integrates with OIDC-compliant identity providers for SSO, and its configuration supports automatic user creation on first login as well as restricting sign-ups to approved email domains.