Skip to main content



The APIs of Ory open-source Servers don't come with integrated access control. This means that all requests sent to their APIs are considered authenticated, authorized, and will be executed. Leaving the APIs in this state can lead to severe security risks.

When deploying Ory open-source Servers, protect access to their APIs using Ory Oathkeeper or a comparable API Gateway.

If you need help, reach out to the community on Ory Community Slack.

Ory software runs on any operating system (FreeBSD, macOS, Linux, Windows, ...) and supports all major CPU platforms (ARM64, ARMv7, x86_64, x86, ...).

Ory provides pre-built binaries, Docker Images and support various package managers:


Install Ory Keto on Linux using bash <(curl ...):

bash <(curl -d -b . keto <version-you-want>
./keto help

You may want to move Ory Keto to your $PATH:

sudo mv ./keto /usr/local/bin/
keto help


Install Ory Keto using homebrew on macOS:

brew install ory/tap/keto
keto help


Install Ory Keto on Windows using Scoop:

scoop bucket add ory
scoop install keto
keto help


Ory Keto is available as a Docker Image for all major platforms (ARM64, AMD64, ...):

docker pull oryd/keto:<version-you-want>
docker run --rm -it oryd/keto:<version-you-want> help


A list of available Helm Charts for Kubernetes can be found at

Download Binaries

You can download the client and server binaries on our Github releases page. No installer is available. You have to add the binary to the PATH in your environment yourself, for example by putting it into /usr/local/bin or something comparable.

Once installed, you should be able to run:

keto help

Building from source

If you wish to compile the binary yourself, you need to install and set up Go 1.17+ and add $GOPATH/bin to your $PATH.


Please note that this will check out the latest commit, which might be not yet released and unstable.

git clone
cd keto
go mod download
go install -tags sqlite,json1,hsm .
$(go env GOPATH)/bin/keto help