# Ory Talos

Ory Talos is an API key management service. It handles the full lifecycle of API credentials: issuing keys, verifying them, deriving short-lived tokens (JWT and macaroon), and revoking access.

Ory Talos exposes two HTTP surfaces. The admin API (`/v2alpha1/admin/*`) covers issue, import, rotate, revoke, derive, and verify. It has no built-in authentication, so put it behind a network boundary or an authenticating proxy. The public API (`POST /v2alpha1/apiKeys:selfRevoke`) validates proof of possession inline and is safe to expose publicly. In production, run them as two processes. See [Separate admin and public APIs](/content/docs/talos/operate/deploy/deployment-modes/index.html).

## Choose your path

### Integrate Ory Talos into your application

Building an application that needs API key authentication? Start here:

- [Quickstart](/content/docs/talos/quickstart/open-source/index.html) — issue and verify your first API key in five minutes
- [Integration guide](/content/docs/talos/integrate/index.html) — API walkthrough for issuing, verifying, importing keys, and deriving tokens
- [Error handling](/content/docs/talos/integrate/error-handling/index.html) — error codes and retry strategies

### Run Ory Talos in production

Deploying and operating Ory Talos? Start here:

- [Install](/content/docs/talos/operate/install/index.html) — install with Homebrew or Scoop, pull the Docker image, or download a binary
- [Configure](/content/docs/talos/operate/configure/index.html) — configuration file, environment variables, and hot-reload behavior
- [Deploy](/content/docs/talos/operate/deploy/index.html) — Docker, binary, and split admin and public API topologies
- [Monitor](/content/docs/talos/operate/monitoring/index.html) — Prometheus metrics, OpenTelemetry tracing, and health endpoints

## Editions

Ory Talos OSS (Apache 2.0) runs on a single node with a SQLite backend. It includes the full key lifecycle, token derivation, and CLI.

Ory Talos Commercial adds multi-tenancy, PostgreSQL, MySQL, and CockroachDB backends, in-memory and Redis caching, rate-limit enforcement, and edge proxy nodes. Pages that cover commercial-only features are marked with a "Commercial" badge.

### Web console

Ory Talos has no built-in web UI. Manage API keys with the [admin API](/content/docs/talos/integrate/index.html) or the [CLI](/content/docs/talos/reference/cli/talos/index.html). For a web console, use the Ory Console:

- On the [Ory Network](/content/site-root.html), the Ory Console is available for Ory Talos.
- To use the Ory Console with a self-hosted deployment, [contact us](/content/contact/index.html).

## Learn more

- [Concepts](/content/docs/talos/concepts/index.html) — architecture, credential types, security model, and caching behavior
- [API reference](/content/docs/talos/reference/api/ory-talos-api/index.html) — full admin and self-service endpoint documentation
- [CLI reference](/content/docs/talos/reference/cli/talos/index.html) — command-line tool documentation
- [Configuration reference](/content/docs/talos/reference/config/index.html) — all configuration keys and their defaults