OryKratos

Cloud-native identity and user management system

Headless user authentication and identity management with MFA, social login, custom identities, and a clean API.

Secure, scalable identity management and user authentication is complex. Ory Kratos streamlines it with a headless, cloud-native identity management system that runs in the cloud or self-hosted — letting developers focus on building their applications.

Need support?

Run Ory Kratos on your own infrastructure with the Ory Enterprise License. Self-hosted control, 24x7 support, security patches, and SLAs.

Need to move quickly?

Get cloud identity management without the operational overhead. Ory Network runs Ory Kratos for you — fully managed, multi-region, free to start.

Full control. A cloud-native identity management system that fits your stack.

Ory Kratos is a fully featured identity and user management system with a clean, API-first architecture. Run it cloud-native, self-hosted, or fully managed — you control every aspect through the headless API.

Integrate with any stack

Ory Kratos works as a headless user authentication system behind any UI framework. Native support for FIDO2, WebAuthn, TOTP, and modern passwordless flows — drop in a few API calls and you're live.

Configurable user authentication flows

Customize login, registration, MFA, device binding, and account recovery. Define your own identity models with custom traits and schemas. Bring your own UI or use Ory Elements to expedite development — either way, every flow is configurable through the API.

Powered by Open Source

Ory Kratos is open-source identity management at its core — auditable, no vendor lock-in, and deployable across three models. Run the open-source distribution yourself, choose the Ory Enterprise License for self-hosted production support, or use Ory Network for fully managed cloud identity management.

The Ory Kratos identity and user management system at a glance

• Self service login and registration
  Users create and sign in to accounts using username/email and password combinations, Social Login, passwordless flows, TOTP and more.

• Multifactor Authentication
  Implement proven standards of web security with FIDO2, WebAuthn, TOTP. Use Yubikeys, Google Authenticator or FaceID to reduce friction and increase security.

• User management
  Run a complete user management system: create, update, retrieve, and delete user identities through the API, with webhooks for lifecycle events. Full admin control over every identity in your system.

• Bring your identity model
  Use customizable identity models (defining custom fields such as name, address, favorite pet) and create your own interfaces in your style and branding.

• Social Login & SSO
  Let users sign in with Google, GitHub, Apple, and any OIDC provider. Single sign-on (SSO) with the social and enterprise identity providers your users already trust.

• Account verification and recovery
  Verify an identity by checking the email, phone number, or physical address of that user. Provide recovery of accounts using "Forgot Password" flows, security codes, etc.

How to de-risk identity at scale with Ory

OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.

OSS

Evaluate and prototype

OEL

Self-hosted, great for enterprises that require air-gapped or certified environments

Ory Network

Fully-managed, fastest path to production without operational overhead

Deploy Ory Kratos on your preferred infrastructure

Self-hosted to SaaS: full control over your infrastructure, data, and compliance.

• Open Source deployment — Run, try, and inspect Ory Kratos open source. Perfect to proof-of-concept your next big idea.
• OEL deployment — Ory Kratos on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date.
• Ory Network deployment — Ory Network includes Ory Kratos powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.

Integrate Ory Kratos with your stack

• Amazon SES
  Reliably deliver critical identity-related transactional emails

• AWS API Gateway
  Secure API front door with fine-grained authorization

• AWS Infrastructure
  Leverage scalable AWS infrastructure for identity management

• Discord Social Login
  Tap into Discord's large, engaged user base

Ory Kratos FAQ

What is Ory Kratos?
Ory Kratos is an API-first identity and user management system. It handles login, registration, multi-factor authentication, account recovery, profile management, and session management. Ory Kratos is headless: it exposes APIs that your application consumes and does not ship a built-in login page. You build the UI in whatever framework you use.

What authentication methods does Ory Kratos support?
Ory Kratos supports:

• password-based login
• social login via any OpenID Connect provider (Google, GitHub, Apple, Facebook, and 15+ preconfigured providers)
• TOTP
• WebAuthn/FIDO2
• passkeys for passwordless login, SMS OTP, email OTP, magic links, and lookup/recovery codes as a backup method

How does Ory Kratos fit into the Ory ecosystem?
Ory Kratos is the identity layer. It handles who the user is: login, registration, account recovery, email/phone verification, profile management, multi-factor authentication, and session management. The other Ory products handle what the user can do and how access is delegated. Ory Hydra issues OAuth 2.0 access tokens and OpenID Connect ID tokens when you need to grant third-party applications access to your APIs. Ory Ketas evaluates fine-grained permissions based on the Google Zanzibar model.