# New Ory Agent Security is now live!

## Overview

Ory offers support for self-hosted Ory software through the Ory Enterprise License (OEL). Read more about the OEL [here](/content/docs/oel/getting-started/index.html).

Ory Kratos has several moving parts and getting everything right from the beginning can be challenging. This getting started guide will help you install Ory Kratos and some additional dependencies so that you can see how it works.

This guide isn't a replacement for studying the docs. You must understand core concepts and APIs to use Ory Kratos productively. This is merely a guide to get you set up with some examples.

## Use case: application login and registration

This section gives you some context on what we want to achieve and what tools we need for that. You will also learn about the network set up we picked for this guide.

This quickstart guide operates on the assumption that we're writing a Node.js app. This app is using nothing fancy - some Express.js and a bit of HTML Templating using Handlebars. We do want to use TypeScript, but only because it's more readable - not because we're doing anything out of the ordinary!

You could pick any technology here, of course. This works with Swift, React.js, or Angular (client side) as well as with PHP, Ruby, Python, Java (server side) - you name it! We picked Node.js + TypeScript because we believe it's the easiest to understand, and because JavaScript and Node.js are universally understood and easy to install.

We know our app will need to have some type of dashboard and that it needs users. Therefore, we need:

- Login
- Logout
- Registration
- Profile management ("update first name", "update avatar", etc.)
- Credentials Management ("add a new recovery email", "change password", etc.)  
- Account Recovery ("password reset")
- Email Verification
- Two Factor Authentication
- "Sign in with Google" and "Sign in with GitHub"

and of course:

- A dashboard that shows `Hello {{ traits.name.first }} {{ traits.name.last }}!` which is only visible when the user is signed in.

## Setup

As you might already know, Ory Kratos is API-only; it doesn't have a UI or HTML templating engine. We will implement all the user-facing UIs like "dashboard", "login", and "registration" in our Node.js app!

To ensure that no one can access the dashboard without prior authentication (login), we can use a small piece of code (here Express.js) to do that:

```javascript
// Your Express.js code snippet here
```

Ory Kratos isn't just an API: it uses cookies, HTTP redirects, anti-CSRF tokens and more so you don't have to.

The Node.js app and Ory Kratos need to share cookies in order for anti-CSRF tokens and login sessions to work. Because the quickstart runs on different ports on `127.0.0.1`, there isn't anything we need to do to get this all working. In environments where you have multiple sub-domains or reverse proxies, the set up will be a bit more sophisticated. You can find more information about the different set up possibilities in the [Getting Cookies to Work on Multi-Domains Guide](/content/docs/kratos/guides/multi-domain-cookies/index.html).

Ory Kratos doesn't ship with an administrative user interface. You must implement that UI yourself. If you need a managed solution that takes care of everything, consider signing up to [Ory Network](https://console.ory.com/).

In this quickstart, we will use Ory Kratos' CLI to interact with Ory Kratos' APIs.

### Clone Ory Kratos and run it in Docker

To get this example working, you will need Git, [Docker](https://docs.docker.com/get-docker/), and [Docker Compose](https://docs.docker.com/compose/install/) installed on your system. No other dependencies are required. Before you start, make sure that Docker has enough disk space.

This tutorial uses Docker-Compose volumes which have reported to run out of disk space. Check the remaining disk space using `docker system df`. If the volumes are above the 85% threshold, [prune old Docker objects](https://docs.docker.com/config/pruning/) before you start!

If you encounter build errors such as network timeout, make sure that the network is running and run `make docker` again. If the problem persists, feel free to [open an issue](https://github.com/ory/kratos/issues/new/choose).

Let's clone Ory Kratos and run `docker compose`:

```shell
git clone https://github.com/ory/kratos.git

cd kratos

git checkout v26.2.0

docker compose -f quickstart.yml -f quickstart-standalone.yml up --force-recreate
```

### Network architecture

This demo makes use of several services:

1. [Ory Kratos](/content/kratos/index.html)
   - Public ("Browser") API (port 4433)
   - Admin API (port 4434) - This is only made public so we can test via the CLI.
2. [Node.js Selfservice UI](https://github.com/ory/kratos-selfservice-ui-node)
   - Public (port 4455) - an example application written in Node.js that implements the login, registration, logout, dashboard, and other UIs.
3. [MailSlurper](https://github.com/mailslurper)
   - Public (port 4436) - a development SMTP server which Ory Kratos will use to send emails.

To better understand the application architecture, let's take a look at the network configuration. This assumes that you have at least some understanding of how Docker networks work:

- Can access URLs via 127.0.0.1:4455
- Can access URLs via 127.0.0.1:4433
- Can access UI via 127.0.0.1:4436

## Perform registration, login, and logout

Enough theory, it's time to get this thing going! Let's start by trying to open the dashboard - **go to** **[127.0.0.1:4455/welcome](http://127.0.0.1:4455/welcome)**. The rendered login form should be a standard HTML `<form>`. AJAX requests require `credentials: 'include'`. This flow also works with Single Page Apps (SPA) and frameworks like Angular or React.js.

### Understand how login and registration work

Head over to the [Self-Service Flows Chapter](/content/docs/kratos/self-service/index.html) for an in-depth explanation of how each individual flow works.

### Session details

After verifying your email, the session at [127.0.0.1:4455/sessions](http://127.0.0.1:4455/sessions) shows the verified address — check the `verified` and `verified_at` fields in the JSON response:

```json
{
  "id": "f28ea4ec-b5d8-4bb1-aa6e-c3046daf9129",
  "active": true,
  "expires_at": "2026-04-28T16:05:13.011508962Z",
  "authenticated_at": "2026-04-27T16:05:13.011508962Z",
  "authenticator_assurance_level": "aal1",
  "identity": {
    "id": "8250c7cf-9815-4a30-a5f6-9166760d4b20",
    "traits": {
      "name": {
        "last": "Bar",
        "first": "Foo"
      },
      "email": "foo@ory.com"
    }
  }
}
```

### Account recovery

The quickstart has account recovery enabled. To recover an account, log out and click on "Recover Account".

Hit "submit" and open MailSlurper to retrieve the account recovery message.

Enter the code on the recovery page to verify your identity, then set a new password:

You are now able to sign in with the new password. To learn more about account recovery, head over to the [Account Recovery Documentation](/content/docs/kratos/self-service/flows/account-recovery-password-reset/index.html).

### Cleaning up Docker

To clean everything up, you need to bring down the Docker Compose environment and remove all mounted volumes.

```sh
docker compose -f quickstart.yml down -v
docker compose -f quickstart.yml rm -fsv
```

### Next steps

Here is some information should you want to modify the quickstart:
- **Social Login** steps to add sign up and login with popular OIDC providers.
- **Use a different database** configurations for PostgreSQL, CockroachDB, MySQL.
- **Change ports** for the SelfService-UI.
- **Hooks** for redirects after registration or login.

### Quickstart configuration

This tutorial uses a simplified configuration. You can find it in the [GitHub repository](https://github.com/ory/kratos/blob/master/contrib/quickstart/kratos/email-password/kratos.yml).

```yaml
version: v0.13.0

dsn: memory

serve:
  public:
    base_url: http://127.0.0.1:4433/

selfservice:
  default_browser_return_url: http://127.0.0.1:4455/welcome
  methods:
    password:
      enabled: true
  flows:
    login:
      ui_url: http://127.0.0.1:4455/login
      lifespan: 10m
```

**Ask AI** [Ory Documentation](/content/docs/oel/kratos/quickstart#next-steps/index.html) for further details.