
Kilpi is an open-source TypeScript authorization framework designed to provide flexible, powerful, and intuitive authorization for developers. It supports various authorization models like RBAC, ABAC, and ReBAC, and integrates seamlessly with any framework or auth provider. With features like server-first authorization, async policies, and a developer-friendly API, Kilpi ensures a secure and type-safe authorization experience.

"Authorization shouldn't be rocket science. Yet here we are, drowning in complex solutions that make simple permission checks feel like solving quantum physics equations. Enter Kilpi - the TypeScript authorization framework that finally gets it right."
Let's be honest - most authorization solutions feel like they were designed to make developers miserable. You either get:
That's why Kilpi caught my attention. It's not just another auth library - it's the result of someone (Jussi Nevavuori) solving the same authorization problems repeatedly for different clients and finally creating the solution we all needed.
Kilpi is an open-source TypeScript authorization framework that turns this:
// The old way
if (user.role === 'admin' && resource.ownerId === user.id && resource.status !== 'archived') {
// Maybe let them do something?
}
Into this clean one-liner:
// The Kilpi way
await authorize(user).can('edit', resource);
Unlike solutions tied to specific frameworks, Kilpi plays nice with:
Kilpi doesn't force you into one paradigm:
In an era of client-side everything, Kilpi keeps authorization where it belongs - on the server. No more "hoping" your client-side checks match the backend.
Forget JSON configuration hell. Your authorization rules live in TypeScript:
// Define once, use everywhere
const postPolicy = {
create: (user) => user.isVerified,
edit: (user, post) => user.id === post.authorId || user.role === 'moderator'
};
What makes Kilpi stand out isn't just what it does, but how it feels to use:
Installation is straightforward:
npm install @kilpi/auth
# or
yarn add @kilpi/auth
Basic setup example:
import { createKilpi } from '@kilpi/auth';
const kilpi = createKilpi({
policies: {
post: postPolicy,
user: userPolicy
}
});
// Then anywhere in your app:
await kilpi.authorize(currentUser).can('edit', blogPost);
While Kilpi is incredibly flexible, it's not always the perfect fit:
What excites me most about Kilpi is how it represents a shift in how we think about authorization:
As Jussi mentioned in his announcement post, this is just the beginning. With its plugin system and active community, Kilpi is poised to become the go-to solution for TypeScript authorization.
If you're tired of authorization being the worst part of your codebase:
Because life's too short for bad authorization code.
Kilpi is an open-source TypeScript authorization framework designed to provide flexible, powerful, and intuitive authorization for developers. It supports various authorization models like RBAC, ABAC, and ReBAC, and integrates seamlessly with any framework or auth provider. With features like server-first authorization, async policies, and a developer-friendly API, Kilpi ensures a secure and type-safe authorization experience.
AI dating photos that actually get you matches
AllinOne AI video generation platform
1000+ curated no-code templates in one place
One app. Your entire coaching business
AI-powered website builder for everyone
We tested the top AI blog writing tools to find the 5 best for SEO. Compare Jasper, Frase, Copy.ai, Surfer SEO, and Writesonic — with pricing, features, and honest pros/cons for each.
Cursor vs Windsurf vs GitHub Copilot — we compare features, pricing, AI models, and real-world performance to help you pick the best AI code editor in 2026.