Official Client Libraries

SpiceDB is primarily accessed by a gRPC  API and thus client libraries can be generated for any programming language.

AuthZed builds and maintains gRPC client libraries for the following languages:

• Go 
• Node 
• Python 
• Ruby 
• Java 
• .NET 

Because the above libraries are generated from protobuf definitions in our API repo , the primary documentation for the gRPC API is in the buf documentation  for SpiceDB’s services. The gRPC client documentation associated with each host language will also be helpful for putting together invocations. Additionally, there are example directories in the client libraries that provide example usages.

Local Development

When developing locally, you’ll need to configure your client based on how SpiceDB is running.

SpiceDB running without TLS (most common)

If SpiceDB is started without TLS (using --grpc-no-tls), use insecure plaintext credentials:

This applies to localhost, Docker, OrbStack, and other local environments running without TLS.

SpiceDB running with TLS using self-signed certificates

If SpiceDB is running with TLS but using a self-signed or untrusted certificate:

See the Protecting a Blog Application tutorial for examples.

HTTP Clients

SpiceDB exposes an HTTP API when run with the --http-enabled flag. While Authzed doesn’t officially maintain HTTP client libraries, there are OpenAPI  docs available here and served by a SpiceDB instance running the HTTP server.

Try it out:

docker run --rm -p 50051:50051 -p 8443:8443 authzed/spicedb serve --http-enabled --grpc-preshared-key foobar
 
curl localhost:8443/openapi.json

The OpenAPI JSON can then be converted into a client using a tool like openapi-ts  or openapi-python-client .

Other Clients

AuthZed also develops zed , a command-line client for interacting with the SpiceDB API.

You can find more languages and integrations maintained by the community in the Clients section  of the Awesome SpiceDB  repository.