OpenFGA Hosting Live In 5 Minutes

Deploy OpenFGA hosting and run relationship-based permissions as a service your applications call over HTTPS. xCloud runs the pinned OpenFGA 1.22.0 image with a private PostgreSQL 17.11 database, completes the database migration, generates a 48-character API key and publishes the HTTP API on your domain, ready for your first store, authorization model and permission check. Your application keeps calling one endpoint, and you decide who holds the key.

Deploy your OpenFGA

No terminal
No technical skills needed
No lock-in, cancel anytime

What is OpenFGA?

OpenFGA is a fine-grained authorization service. Upstream calls it a high-performance, flexible authorization engine inspired by Google Zanzibar: you define an authorization model, write relationship tuples, and your application asks it whether a user may act on a resource. It has HTTP and gRPC APIs, SDKs for Java, Node.js, Go, Python and .NET, and a CLI for testing models. Self-hosted OpenFGA replaces a hosted authorization service under the Apache-2.0 licence.

On xCloud it is OpenFGA 1.22.0 and PostgreSQL 17.11, both pinned by digest, with a one-shot migration that finishes before the API starts. Only the HTTP API is published over HTTPS, protected by a generated preshared key. PostgreSQL, gRPC and metrics stay on the private network, and the openfga_postgres_data volume holds your stores, models and tuples.

From Sign-Up to a Live Authorization Check In Just 3 Easy Steps

Self-hosting a Zanzibar-style authorization service normally means a container, a database, a migration step, a domain and a certificate before a single permission check runs. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick OpenFGA from the OneClick catalog. Enter a site title and choose a domain — there are no other fields to fill in.
Step 02
We Deploy It For You
One click. We bring up the official OpenFGA 1.22.0 image alongside a private PostgreSQL 17.11 database — both pinned by immutable digest — run the database migration to completion, generate a database role and a 48-character API key, and publish the HTTP API over HTTPS on your domain.
Step 03
Create A Store And Check A Permission
Copy your HTTPS endpoint and generated API key from the Credentials panel, send it as a Bearer token, create a store and an authorization model, write a relationship tuple, then call Check and confirm it returns allowed: true.

Everything OpenFGA Does, On Your Own Server

OpenFGA runs in full here — stores, authorization models, relationship tuples and permission checks, on infrastructure you control.

Relationship-Based Authorization
Model fine-grained permissions around users, groups, resources and relationships, in the style of Google Zanzibar.
Stores And Authorization Models
Create isolated stores, define authorization models, and version them as your permission logic evolves.
Permission Checks Over HTTP
Write relationship tuples and call the Check API to answer allow/deny decisions for your application.
Preshared-Key API Authentication
A generated 48-character key authenticates every call to the HTTP API — the unauthenticated developer Playground stays disabled.
Persistent Authorization Data
Stores, models, tuples and migration state persist on their own PostgreSQL volume across restarts.
Private Database, gRPC And Metrics
PostgreSQL, gRPC and metrics stay on the internal network — only the OpenFGA HTTP API is published over HTTPS.

Everything You Need To Run Your Authorization Service 24/7

Managed hosting for OpenFGA, so the parts that keep it online are not your problem.

OpenFGA 1.22.0 deployed instantly
Official pinned image digests
Generated preshared API key at setup
Private PostgreSQL, gRPC and metrics, not exposed to the internet
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With OpenFGA

Share documents by folder and team
A product team models owners, editors and viewers once, then asks the Check API whether a user may open a given file or folder.
Give every service one permission source
Several backend services call the same OpenFGA endpoint for allow or deny decisions, instead of each carrying its own access rules.
Separate customers into isolated stores
A multi-tenant SaaS keeps one store per customer, each with its own authorization model and relationship tuples.
Test a permission model before shipping it
Engineers write tuples against a staging store and use the upstream CLI to test an authorization model before it reaches production.

OpenFGA vs Alternatives

Hosted authorization services: A hosted authorization service runs on a vendor's servers. Self-hosted OpenFGA is Apache-2.0 and runs on yours, with a preshared key you generate and relationship data in your own PostgreSQL volume.
Google Zanzibar: The Google research paper that upstream says inspired OpenFGA's model. OpenFGA is the open-source engine you can install and call over HTTP or gRPC, which Zanzibar, as a paper, is not.
OpenFGA as a Go library: Upstream notes the engine can also be embedded as a Go library inside your own program. This template instead runs it as a separate HTTP service that any language reaches through an SDK.
The upstream in-memory quickstart: Upstream's quickstart runs OpenFGA with in-memory storage, which it marks as not for production because data is discarded when it stops. This template stores everything in PostgreSQL on a persistent volume.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for OpenFGA hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom for higher check throughput.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Cloud VPS 24 GB

OpenFGA alongside a whole self-hosted stack.

$84.99per month

24 GB RAM
8 vCPU cores
300 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. OpenFGA itself is free under the Apache-2.0 licence.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy OpenFGA on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Authorization Service?

OpenFGA on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Can you self-host OpenFGA with Docker?

Yes, upstream documents Docker and Docker Compose, and this template is OpenFGA Docker hosting with the pieces assembled: the 1.22.0 image and PostgreSQL 17.11 pinned by digest, a migration container that runs first, a private network and HTTPS. It gives you your own OpenFGA cloud endpoint.

How much RAM does OpenFGA need?

The manifest sets a floor of 1024 MB RAM, one CPU core and 10 GB disk for OpenFGA and PostgreSQL together, and the 6 GB plan is the entry rung. Headroom matters as your stores, authorization models and relationship tuples grow.

Is OpenFGA free?

Yes. OpenFGA is open source under the Apache License 2.0, so the software itself is free. The Cloud VPS hosting it is the only charge, and you can cancel it whenever you like. Your tuples remain in PostgreSQL on a volume you control.

Which database does OpenFGA use?

Upstream supports in-memory, PostgreSQL, MySQL and SQLite (beta) storage. This template uses PostgreSQL 17.11 in its own private container, with the data on the openfga_postgres_data volume. The database publishes no host port and is reachable only inside the install's network.

How do I authenticate to OpenFGA?

xCloud generates a 48-character preshared API key during installation and shows it in the Credentials panel with your HTTPS endpoint. Send it on every request as an Authorization: Bearer header, then create a store, add an authorization model, write tuples and call Check.

Which SDKs does OpenFGA have?

Upstream lists SDKs for Java, Node.js, Go, Python and .NET, plus a CLI for interacting with a server and testing authorization models, and a Terraform provider. They all talk to the HTTP API you publish here, authenticated with the generated key.

Is the OpenFGA Playground available?

No. OPENFGA_PLAYGROUND_ENABLED is false in this template, because upstream permits the unauthenticated Playground only in development mode, and this deployment runs with preshared-key authentication. Use the CLI or an SDK from your own machine to model and test instead.

How do I rotate the OpenFGA API key?

Change OPENFGA_AUTHN_PRESHARED_KEYS in the Environment editor and update every client configuration at the same time, then redeploy. The key never rotates itself, and any client still holding the old key fails authentication until you update it.

How do I rotate the PostgreSQL credentials?

PostgreSQL reads its initialization values only when the volume is empty. On a live install, change the role and password inside PostgreSQL first, then update the matching environment values and redeploy. Take a backup of openfga_postgres_data before you touch any credentials.

How do I back up OpenFGA?

Back up the openfga_postgres_data volume, which holds stores, authorization models, relationship tuples and migration state. Use PostgreSQL's pg_dump for an application-consistent copy, keep tested copies off the server, and rehearse a restore on an isolated install first.

Backups in xCloud

How do I upgrade OpenFGA?

The install stays on pinned 1.22.0 and PostgreSQL 17.11 until you adopt a newer template version. Read the OpenFGA release and migration notes, back up the PostgreSQL volume, then redeploy and run a representative Check before dropping your rollback copy. Nothing upgrades automatically.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.