Ory Identity Infrastructure

Ory is an identity and access management platform built around API-first, headless architecture that separates identity concerns from application code. The system is composed of several modular open-source projects, each handling a distinct layer of the identity stack. Kratos manages identities, registration, login, account recovery, profile management, and multi-factor authentication with support for passkeys, WebAuthn, and TOTP. Hydra is a certified OAuth 2.0 and OpenID Connect provider that handles token issuance, consent flows, and client management for API authorization. Keto implements relationship-based access control using Google Zanzibar-style tuple storage, enabling fine-grained permission checks that scale to billions of relationships. Oathkeeper is a reverse proxy that evaluates access rules and enforces authentication and authorization policies at the edge. The platform supports B2B federation, multi-tenancy, social login with dozens of providers, and zero-trust network architectures. A managed cloud called Ory Network offers global multi-region deployment with sub-hundred-millisecond response times, while the open-source edition can be self-hosted on any infrastructure. The API design follows REST principles with JSON responses, webhooks for event-driven workflows, and SDKs for Go, JavaScript, Python, Java, and .NET. Enterprise licensing adds support for SAML identity provider federation, SCIM user provisioning, audit log streaming, and uptime SLAs. Recent additions include agent security features that manage credentials and permissions for autonomous AI agents operating in production environments.