Ory

Ory is an open source identity infrastructure company that provides a suite of modular, cloud-native identity and access management components built for developers. Designed with zero-trust principles and modern cloud architecture in mind, Ory's projects cover authentication (Ory Kratos), authorization (Ory Keto), OAuth2/OIDC (Ory Hydra), API access control (Ory Oathkeeper), and network security (Ory Network), providing a complete identity stack that can be deployed self-hosted or consumed as a managed service.

Ory Kratos is the open source identity and user management server. It handles user registration, login, account recovery, email verification, two-factor authentication, and social sign-in. Unlike traditional auth systems that bundle identity management with business logic, Kratos focuses exclusively on managing identities and delegates UI rendering to the application. The headless design means that the login and registration interfaces are entirely custom-built by the application, with Kratos providing only the backend logic and flow management.

Ory Hydra is a fully standards-compliant OAuth 2.0 and OpenID Connect server that can be integrated into any existing authentication system. Rather than replacing the organization's existing login system, Hydra acts as the OAuth2/OIDC layer that handles token issuance, refresh, and revocation, delegating the actual user authentication to the existing system through a custom login and consent flow.

Ory Keto is the open source permissions and authorization server implementing Google's Zanzibar authorization model. Zanzibar is the system that powers Google Drive's fine-grained sharing permissions, and Keto brings this powerful, scalable authorization model to any application. Permissions are expressed as relationship tuples that define which subjects have which relations to which objects, enabling both simple role-based and complex relationship-based access control.

Ory Oathkeeper is a zero-trust identity and access proxy that sits in front of services and applies authentication and authorization checks to every incoming request. It can validate JWTs, call upstream authorization services, and reject unauthorized requests before they reach the application, implementing zero-trust network access at the infrastructure layer.

Ory Network is the managed cloud offering for all Ory projects with global edge deployment, commercial SLAs, and enterprise support.