OAuth 2.0 Server & OpenID Connect Provider | Ory Hydra
Ory Hydra
The cloud-native, OpenID Certified® OAuth 2.0 server. Issue access tokens, secure APIs, and federate identity across third-party apps — without writing protocol code yourself.
Existing OAuth and OpenID Connect solutions lack flexibility and granular control, limiting adaptability to specific business needs. Ory Hydra — the open-source, OpenID Certified® OAuth 2.0 server — integrates with your infrastructure, giving you complete control over how access tokens are issued, scoped, and validated.
Need support?
Run Ory Hydra on your own infrastructure with commercial support, SLA-backed responses, and CVE patching from the team that builds it.
Need to move quickly?
Skip the operational overhead — get a production-ready, OpenID Certified® OAuth 2.0 server as a fully managed service on Ory Network.
Millions of users. Unlimited scale.
Ory Hydra powers OAuth 2.0 and OpenID Connect for systems with millions of users, serving thousands of token issuances per second.
SDKs for every stack
Hydra is written in Go with official SDKs for every major language — .NET, Java, Node.js, PHP, Python, Ruby, Rust, Dart, and TypeScript. It works with any login system and integrates with your existing identity provider, so engineers can add OAuth 2.0 in hours, not weeks.
OpenID Certified® OAuth 2.0
The most advanced open-source OAuth 2.0 and OpenID Connect server — and the only one OpenID Certified®. Integrates with any login system and federates identity to any application, anywhere.
Powered by Open Source
Ory Hydra offers deployment flexibility. With open source roots, Ory Hydra has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features, commercial SLAs, and support, or use the fully managed Ory Network for a seamless SaaS experience.
OAuth 2.0 and OpenID Connect features for production
Full OAuth 2.0 spec coverage: Implements the complete OAuth 2.0 standard as defined by the IETF — authorization code, client credentials, refresh token, PKCE, and token exchange flows. Integrates with Ory Kratos or any open-source or proprietary identity provider.
OpenID Certified®: The OpenID Foundation has certified Ory Hydra as a conformant OpenID Connect provider. All flows specified by the IETF and OpenID Foundation are implemented and tested against the certification suite.
Bring your own UX: Use your own branding, login screens, and consent pages for every OAuth 2.0 and OpenID Connect flow. Ory Hydra exposes the protocol; you control the UX. Powered by a documented REST API and CLI.
Cryptographic key storage: Cryptographic keys for JWT signing are stored encrypted at rest. Manage OAuth 2.0 clients, rotate signing keys, and issue tokens directly from the CLI or Admin API.
Production-grade scale and performance: Stateless, horizontally scalable architecture. Ory Hydra serves tokens to systems with millions of users and tens of millions of weekly token issuances — battle-tested for security incident reduction and operational simplicity.
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
| Feature | OSS | OEL | Ory Network |
|---|---|---|---|
| Compliance and audit-ready | No | Yes | Yes |
| Global multi-region architecture | No | Yes | Yes |
| 24/7 SLA support | No | Yes | Yes |
| CVE security patching | No | Yes | Yes |
| Managed infrastructure | No | n/a | Yes |
| OpenID Certified® | Yes | Yes | Yes |
| Credential rotation | No | Yes | Yes |
Deploy Ory Hydra on your preferred infrastructure
Run the same OAuth 2.0 and OpenID Connect server three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same OpenID Certified® engine, same protocol semantics across all three.
Open Source deployment — Explore and experiment with Ory Hydra, an OAuth2 and OpenID Connect server. Ideal for developers building proofs of concept, testing integrations, or learning how Ory identity flows work.
Learn MoreOEL deployment — Run Ory Hydra with enterprise-grade performance and support. Get optimized code, security updates, and compliance features for mission-critical identity workloads, on-premises, or in your private cloud.
Learn MoreOry Network deployment — Use Hydra-powered OAuth2 and OpenID Connect services instantly, without managing infrastructure. Ory Network delivers global scale, built-in compliance, and the fastest path to secure identity.
Learn More
Integrate Ory Hydra with your stack
Amazon SES: Reliably deliver critical identity-related transactional emails
More InfoAWS API Gateway: Secure API front door with fine-grained authorization
More InfoAWS Infrastructure: Leverage scalable AWS infrastructure for identity management
More InfoDiscord Social Login: Tap into Discord's large, engaged user base
More Info
Ory Hydra FAQ
What is Ory Hydra? Ory Hydra is an OAuth 2.0 and OpenID Connect server written in Go. It is OpenID Certified and handles token issuance, consent management, client registration, and cryptographic key storage. Ory Hydra does not manage users or passwords. It delegates authentication to an external login provider (such as Ory Kratos or your own system) through a Login and Consent flow. This separation means Ory Hydra works with any existing identity backend. Ory Hydra is available as open-source software (Apache 2.0), under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.
What business benefits does Ory Hydra provide?
- Total Brand Sovereignty: Legacy IAM platforms often force you to use their hosted login pages, leading to a fragmented user journey that limits conversions. Ory Hydra is a headless, API-first solution. Developers can build pixel-perfect login, registration, and MFA screens that live entirely within your brand's ecosystem, while Ory Hydra manages the secure tokens in the background.
- Planet-Scale Performance and Low Latency: Ory Hydra is built for high-concurrency environments (like the scale required by OpenAI’s 900M+ weekly active users). It offers sub-millisecond response times, ensuring that security checks never degrade the user experience, even during massive traffic spikes.
- Reduced Compliance Risk & Hardened Security: Ory Hydra is a certified OIDC provider, significantly reducing your "Remediation Gap" and lowering the risk of data breaches associated with homegrown identity stacks.
- Cost Effective Growth: Because it is resource-efficient, businesses can scale to millions of users without the exponential cost increases associated with legacy SaaS platforms. Ory takes an average Daily Active Users (aDAU) approach to cost that has significant advantages over the more common Monthly Active User (MAU) approach.
Does Ory Hydra support machine-to-machine authentication?
Yes. The client credentials flow lets services authenticate without user interaction. You can create an OAuth2 client with the client_credentials grant type, and the service exchanges its credentials for an access token.
How do I manage OAuth2 clients in Ory Hydra?
Ory Hydra provides a full client lifecycle API. You can create, read, update, and delete OAuth2 clients via the Ory Console, the Ory CLI, the admin REST API, or SDKs in various languages.
How does Ory Hydra fit into the Ory ecosystem?
Ory Hydra handles OAuth 2.0 and OpenID Connect, issuing access tokens and ID tokens. It integrates seamlessly with any existing identity backend, such as Ory Kratos for authentication. If you need to issue tokens to third-party clients or act as an OpenID Connect provider, use Ory Hydra alongside Ory Kratos.