# Standalone Integration ## Introduction FGA works with any authentication system. While [AuthKit](https://workos.com/docs/fga/authkit-integration) provides built-in user management, you can integrate FGA standalone by managing users, organizations, and organization memberships through the API. Use standalone integration when you have an existing authentication system, are migrating from another identity provider, or need programmatic control over user provisioning. *** ## Core concepts FGA authorization is built on three entities: **Users** represent individuals in your application. Each has a unique ID, email, and profile information. **Organizations** represent your customers or tenants. They serve as the root of your resource hierarchy. **Organization memberships** connect users to organizations and assign an organization-scoped role. Every membership must have at least one role—this determines baseline permissions within the organization. The organization membership role is always scoped to the organization itself, not to specific resources. For resource-level access control, use [role assignments](https://workos.com/docs/fga/assignments) on individual resources. If you want to grant access exclusively through resource-scoped roles, configure the default organization-scoped role to have no permissions. Users will start with no access and only gain permissions through explicit resource role assignments. > **Note:** Organization-scoped roles can be either environment-level roles (which apply across all organizations) or [custom roles](https://workos.com/docs/rbac/custom-roles) (which are defined per-organization). Both types can serve as the membership role. *** ## Creating organizations Organizations are the tenants in your application. Create one for each customer: :::code-group ```bash language="curl" curl --request POST \ --url https://api.workos.com/organizations \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <