Alternatives
Products that do what NPL, a programming language with authorization as first‑class citizen does
I always struggled to build simple authorisation systems. It’s a multi-layer mess: API-level role checks, countless object-user DB tables, and SQL/ORM spaghetti just to manage rights. With NPL, my authorisation lives in a single place. When I create a new protocol instance (NPL data objects), I attach user attributes that define who can read and do what. And that’s it, the NPL runtime takes care of the rest — I have a fully authorised backend without adding layers and layers of authorisation.
- 1
One identity layer for your customers, APIs, and agents
Jul 2026 · monocloud.com
- 2
- 3
- 4GA
While working on a proof of concept project, I kept hitting Claude's token limit 30-60 minutes into their 5-hour sessions. The accumulating context from the codebase was eating through tokens fast. So I built a language designed to be generated by AI rather than written by humans. GlyphLang GlyphLang replaces verbose keywords with symbols that tokenize more efficiently: # Python @app.route('/users/') def get_user(id): user = db.query("SELECT * FROM users WHERE id = ?", id) return jsonify(user) # GlyphLang @ GET /users/:id { $ user = db.query("SELECT * FROM users WHERE id…
Jan 2026
- 5
- 6MA
Hi HN, I built MOL, a domain-specific language for AI pipelines. The main idea: the pipe operator |> automatically generates execution traces — showing timing, types, and data at each step. No logging, no print debugging. Example: let index be doc |> chunk(512) |> embed("model-v1") |> store("kb") This auto-prints a trace table with each step's execution time and output type. Elixir and F# have |> but neither auto-traces. Other features: - 12 built-in domain types (Document, Chunk, Embedding, VectorStore, Thought, Memory, Node) - Guard assertions: `guard answer.confidence > 0.5 : "Too low"` -…
Feb 2026 · github.com
- 7NM
Every product that allows usernames eventually ships the same broken solution. Someone adds a blacklist. Then a regex. Then another regex copied from StackOverflow. It works just long enough to ship, and then `admin`, `support`, city names, brand impersonation, and obvious slurs start leaking through anyway. Everyone knows it’s fragile, but it gets ignored because "it’s just usernames". I’ve had to rebuild this logic across multiple products, and I got tired of pretending it’s a solved problem. So I built *username.dev*, an API that answers a more useful question than "is this taken?" — it…
Dec 2025 · username.dev
- 8KD
Every AI agent that does something useful - opening a PR, posting in Slack, updating a ticket - needs to call an API on behalf of a user. That means OAuth. Authorization flows, token storage, refresh logic, per-user credential isolation. Today, most teams solve this with a long-lived API key in an .env file, shared across every user and every session. As everyone in an organization becomes a software engineer - whether they know it or not - you can't expect each of them to roll their own OAuth. Secure credential handling needs to be baked into the infrastructure. The core issue: agents are a…
Mar 2026 · kontext.dev
- 9
- 10OP
I, like Andrej Karpathy, became super frustrated by how annoying it was to deploy projects that were previously an absolute joy to make with Claude Code. That is why I made open-passkey, an MIT licensed passkey repo with support for 33 languages and frameworks (examples included) that makes adding simple secure auth to a project easy. We are also releasing gateway (https://gateway.locke.id) a "backendless" hosted auth server that frontend apps can consume for free so that you can ship a React or Angular app using a CDN like Netlify without needing to configure a server at all. We…
Apr 2026 · github.com
- 11PB
Hi HN, We're Rishabh, Aashish, and Noah, the creators of ProtoType: a platform for building GraphQL backends. You can check it out here: https://www.useprototype.com We were fed up with creating the same sort of APIs over and over again when building web applications so we built this tool for ourselves. As we're all in university, we showed it around to our friends and they enjoyed using it to kickstart their projects. After that, we thought we'd host it on a website and allow anybody to use it! ProtoType is different from similar GraphQL backend builders such as 8base in that it…
2019
- 12
- 13IB
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com
- 14ZA
Hi HN, I'm Jiasheng, co-creator of ZenStack. Access control usually ends up scattered across app code instead of living with the data model — and that's riskier when the code is written by an agent, since it's easy to ship a query with a missing or incomplete authorization check. ZenStack enforces policy (RBAC/ABAC/relation-based) directly at the ORM layer, on top of Kysely, so every query gets checked the same way regardless of who wrote it and who is calling it. Postgres RLS is an option too, but it's hard to maintain and scale, and it's Postgres-only — ZenStack's approach is…
Jul 2026 · zenstack.framer.website
- 15UP
Utilizing Postgres' RLS feature to isolate user data instead of easy-to-forget where-clauses, is such an underrated use case, I really wonder why not more people use it. If you prefer code over the blog post, I've put the full application example on GitHub. Would love to hear your thoughts. https://github.com/simplyblock/example-rls-invoicing
Sep 2025 · simplyblock.io
- 16PO
Hello HN! We are developers and security researchers making tools for developers to encrypt data at an application level while maintaining sole control of their keys. We believe that data should always be encrypted unless it is part of an active computation. Encryption is relatively easy, but key management is challenging. There are plenty of encryption tools and SDKs that are out there (Hashicorp Vault, AWS KMS etc.) but we are focusing on ease and speed of implementation, developer experience and self custody of keys. A few months ago, we quit our jobs and started full time on Phase. So…
2023 · github.com
- 17EA
Hey folks, Michael here. I have been working in this project on and of for about a year and a half and I finally got it into a state where I can share it. I initially started this project to learn Rust and afterwards decided to make it useful for others. Vulpo Auth is an authentication server that you can host yourself. The goal was to make it as easy as possible for you to get started and have a complete authentication solution without you having to configure anything. Project Website: https://auth.vulpo.dev The Project contains: - Auth Server (Rust) - Admin Dashboard - JS and…
2022
- 18AS
Hi HN, I’ve been working on an experimental programming language called XXML. The project started from a frustration I kept running into across systems languages: Languages with strong ownership tend to avoid runtime reflection. Languages with rich reflection usually rely on GC or give up memory guarantees. Compile-time code generation often requires a separate macro language. I wanted to explore whether those tradeoffs are truly necessary. What XXML is trying to do XXML is a statically-typed, native language that: Uses explicit ownership and borrowing (no garbage collector) Supports runtime…
Dec 2025 · xxml-language.com
- 19DD
I've been working on something for a while now. It's a combination of a decentralised identity system and a decentralised messaging system that makes use of the aforementioned new identity system. It's based on cryptographic keys with one major property: keys are paired with arbitrary mnemonic strings, e.g. your favourite username, so apps can send messages in a P2P fashion addressed to the strings directly without having to worry about IP addresses. These key-string pairs can be generated on-the-fly on any computer and there's no central database. When multiple people inevitably choose the…
2020
- 20
Stop rewriting auth. Ship your Node.js backend faster.
Jul 2026 · katia-ait.lemonsqueezy.com
- 21GI
https://goms-demo.herokuapp.com This is a very early stage demo for Goms. 1. Independent User registration / User sign-in You can create a public site or a private site, or mixed. Was using auth0 earlier but felt it as an extra step during setup. Authentication/Authorization is a first class component. 2. Native support for user defined entities Create extensively related entities, eg. (Clothing)"Style" has a "Style File", some "Order" and "Costing", and "Order" has "Vendor" associated to it. Entities you see in this demo are defined here [1], [2] 3. Oauth Connections and…
2017
- 22DN
we finetuned Google's Gemma 270m (and 1b) small language models specialized in having conversations as non-playable characters (NPC) found in various video games. Our goal is to enhance the experience of interacting in NPSs in games by enabling natural language as means of communication (instead of single-choice dialog options).
Oct 2025 · github.com
- 23SA
Hi HN, we’re Jessie and Eric. We’ve been baking away at Cakework (https://www.cakework.com/), which is a way to build async backends without needing to manage cloud infrastructure. Cakework is for operations that take time or more compute, like file processing, report generation, or machine learning. Devs write backends as Python functions and deploy them with our CLI. They use our client SDKs to make requests, get status, and get processing results. Each request runs with its own CPU and memory parameters in its own microVM, with no timeouts. Devs can query for failures and…
2023 · cakework.com
- 24SD
We built a Claude Code plugin that adds fine-grained authorization to apps. Works for creating new apps, adding features to existing apps, and migrating legacy authorization layers. The plugin helps design the permission model, write a SpiceDB schema, identify authorization points in the code base, generate SpiceDB client code, and test the authorization model. We designed the plugin around different modes of working with Claude Code: 1. Guided workflow. /spicedb-dev:plan is the single entry point for anyone unsure where to start. It scans your data model, produces an authorization…
Apr 2026 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →