Run the PDP (Policy Decision Point)

Start a policy decision point (PDP) for your application to send permission checks to: run the PDP container on your machine, or connect the SDK to the managed Cloud PDP. This page is for developers setting up Permit for the first time.

A policy decision point (PDP) is the microservice that evaluates your policy and answers each permission check. Permit offers two kinds:

PDP	Where it runs	Use it when
Container PDP	A Docker container you run in your own network	You need attribute-based access control (ABAC), local enforcement APIs, or decisions next to your services
Cloud PDP	Permit's managed service at https://cloudpdp.api.permit.io	You want to start without running infrastructure, and your policies use role-based (RBAC) or relationship-based (ReBAC) access control

For the full feature comparison, see Cloud PDP capabilities.

Prerequisites

• Your environment API key. See Get your API key.
• For the container PDP: Docker. See Install Docker.

Start the PDP

Container PDP

Pull the PDP container from Docker Hub

Pull the permitio/pdp-v2 image:

docker pull permitio/pdp-v2:latest

Run the PDP container

Replace <YOUR_API_KEY> with your environment API key, then run:

docker run -it -p 7766:7000 --env PDP_DEBUG=True --env PDP_API_KEY=<YOUR_API_KEY> permitio/pdp-v2:latest

The command sets these options:

Option	Meaning
-p 7766:7000	Maps port 7766 on your machine to port 7000, the PDP API port inside the container. Your application sends checks to http://localhost:7766.
PDP_API_KEY	The environment API key. The PDP uses it to connect to Permit and load that environment's policy and data.
PDP_DEBUG=True	Turns on debug logging in the container output.

Verify the container PDP is running

1. In a second terminal, run docker ps. The list shows a container from the permitio/pdp-v2:latest image with 0.0.0.0:7766->7000/tcp in the PORTS column.
2. Open http://localhost:7766/health in a browser. A healthy PDP returns HTTP 200 with "status": "ok". If a component inside the PDP is not healthy, the endpoint returns HTTP 503 with "status": "error" and the failing component. Check the container output for errors.

To connect the SDK to the container PDP, set the SDK's pdp option to http://localhost:7766. For logging, port, and monitoring options, see Run the PDP as a local authorization microservice.

Cloud PDP

Connect the SDK to the Cloud PDP

The Cloud PDP needs no installation. Pass the Cloud PDP URL as the pdp option and your environment API key as the token option when you initialize the SDK. In this Node.js example, replace [YOUR_API_KEY] with your API key:

// This line initializes the SDK and connects your app
// to the Permit.io Cloud PDP.

const permit = new Permit({
  pdp: "https://cloudpdp.api.permit.io",
  // your API Key
  token: "[YOUR_API_KEY]",
});

For other languages, see the SDKs overview.

Cloud PDP limits

The Cloud PDP is a managed PDP that you can use in production. It does not support ABAC policies or container-only APIs such as all-tenants checks and local enforcement APIs. If your policies need those features, or your checks are latency-sensitive, run the container PDP next to your application. See Cloud PDP capabilities.

Verify the Cloud PDP connection

Run a permission check with permit.check(). The check appears in the Audit Log screen of the Permit dashboard. For a guided example, see Run your first policy check with the Cloud PDP.

Next steps

• Run your first policy check with the Cloud PDP
• Configure and monitor a local PDP
• Check permissions with permit.check()
• Deploy the PDP to production