Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...) - opal/packages/opal-client/opal_client/config.py at master · permitio/opal

OPAL's configuration is based on our very own Confi module, which in turn is based on Decouple, and adds complex value parsing with Pydantic, and command line arguments via Typer/Click.

May 18, 2026 · Learn how to configure and use the Opal CLI. See the Opal CLI npm page for a list of all available CLI commands. Use opal login to authenticate to the Opal CLI. This creates an …

May 13, 2026 · The opal-client is deployed alongside a policy-store (e.g: OPA), keeping it up-to-date, by connecting to an opal-server and subscribing to pub/sub updates for policy and policy data changes.

As your application state changes (whether it's via your APIs, DBs, git, S3 or 3rd-party SaaS services), OPAL will make sure your services are always in sync with the authorization data and policy they need.

OPAL-Servers publish policy and data updates over a lightweight (websocket) PubSub Channel, which OPAL-clients subscribe to via topics. Upon updates, each client fetches data directly (from the …

Opal client can be configured to maintain a local backup file, enabling to restore the policy store to its last known state after a restart, even when server is unavailable.

If you would like OPAL to execute OPA for you, and act as a watchdog for OPA, we need to make sure it can find the OPA program and make it executable. To do this, please follow the guidance here, but …

This guide will teach you how to setup the OPAL Server & Client as a series of python packages using the CLI.

Now that OPAL is live, we can use OPAL server to push updates to OPAL clients in real time. We have a separate tutorial on how to trigger updates.