OryTalos Transform API keys into dynamic controls for the agentic era

Secure and scale machine to machine (M2M) and AI agents with programmable Macaroon tokens, replacing static, over-privileged keys with hardened, non-human credentials.

AI identity security that scales for the agentic era

Ory Talos secures automated workflows by turning static API keys into short-lived capability tokens for service to service and agent to agent interactions. Using token derivation and macaroon delegation enforces strict least-privilege guardrails.

Identification

Know exactly which app, microservice, or AI agent is calling.

Authentication

Verify keys in real-time with zero-latency checks and instant revocation.

Authorization

Enforce the principle of least privilege with fine-grained scopes.

Ory Talos securing API keys at a glance

• Macaroon tokens

  Enable organizations to scale automated workflows safely via ironclad, least-privilege guardrails that allow permissions to only be narrowed, never expanded.

• IP whitelists and time-to-live (TTL)

  Neutralize the threat of compromised credentials by ensuring stolen keys are immediately useless outside your network or past their strict time limit.

• Scalability

  As AI agents and API keys multiply, legacy IAM degrades. Ory's high-concurrency Go architecture eliminates these bottlenecks, providing the infrastructure that scaled OpenAI through massive global traffic.

• Token derivation

  Minimize the blast radius of credential leaks by eliminating static API keys and providing an instantly revocable hierarchy where invalidating a parent key immediately neutralizes all child tokens.

• Token prefixes

  Prevent costly data breaches by allowing automated scanners to instantly detect and neutralize leaked keys before they can be exploited.

• Deployment freedom

  SaaS, on-prem, or private cloud, Ory adapts as your needs change. Start deployment one way and transition seamlessly to another, backed by the same code underneath.

Ory Talos FAQ

What is Ory Talos?

Ory Talos secures traditional API keys by combining infrastructure-level performance with Macaroon-based delegation and token derivation, allowing organizations to securely "wrap" and narrow permissions for a more secure approach with non-human identities (NHIs).

What business benefits does Ory Talos provide?

• Dynamic Least-Privilege - Ory Talos enables organizations to programmatically derive restricted, task-specific tokens from a parent identity.
• Decentralized Delegation - Utilizing Macaroon-based tokens, Ory Talos embeds complex security logic directly into the credential.
• Hardened Guardrails - Enforcing IP whitelisting, short-lived TTLs, and identifiable prefixes simplifies the detection of leaked credentials.
• Agentic-Ready Scale - The high-concurrency Go architecture effortlessly handles the massive authentication throughput required.

What is the difference between Ory Talos and other API key security solutions?

• Support and use of Macaroon tokens, allowing for an ever-narrowing scope of permissions for autonomous AI agents.
• Use of token prefixes, aiding in the identification and scanning of leaked keys.
• Scalability designed for high-concurrency and low memory footprints to handle demand as AI agents increase.

Deploy Ory Talos on your preferred infrastructure

Deploy on any infrastructure and take full control over authentication and user workflows of your application.

• Open Source deployment - Explore and experiment with a pruned version Ory Talos.
• OEL deployment - Run Ory Talos with enterprise-grade performance and support.
• Ory Network deployment - Use Talos-powered secure API keys service instantly, without managing infrastructure.

Integrate Ory Talos with your stack

• Amazon SES - Reliably deliver critical identity-related transactional emails.
• AWS API Gateway - Secure API front door with fine-grained authorization.
• AWS Infrastructure - Leverage scalable AWS infrastructure for identity management.
• Discord Social Login - Tap into Discord's large, engaged user base.

Ready to try Ory Talos?

Get started with the guides and docs below.

Code Example

cfg := client.NewConfiguration()
cfg.Servers = client.ServerConfigurations{{URL: talosURL}}
c := client.NewAPIClient(cfg)

verifyResp, _, err := c.StaticCredentialsAPI.
    AdminVerifyAPIKey(ctx).
    V2alpha1VerifyAPIKeyRequest(client.V2alpha1VerifyAPIKeyRequest{
        Credential: new(secret),
    }).
    Execute()
if err != nil {
    return fmt.Errorf("verify key: %w", err)
}

if verifyResp.GetIsActive() {
    fmt.Println("Key is valid, owner:", verifyResp.GetActorId())
} else {
    fmt.Println("Key is invalid:", verifyResp.GetErrorMessage())
}

Try Ory today Start for free