Convert Figma logo to code with AI

ory logokratos

Next-gen identity server replacing your Auth0, Okta, Firebase with hardened security and PassKeys, SMS, OIDC, Social Sign In, MFA, FIDO, TOTP and OTP, WebAuthn, passwordless and much more. Golang, headless, API-first. Available as a worry-free SaaS with the fairest pricing on the market!

11,038
949
11,038
248
View on GitHubView on NPM

Top Related Projects

keycloak's avatar

keycloak

22,126

Open Source Identity and Access Management For Modern Applications and Services

supertokens's avatar

supertokens-core

12,647

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

logto-io's avatar

logto

8,288

๐Ÿง‘โ€๐Ÿš€ The better identity infrastructure for developers and the open-source alternative to Auth0.

zitadel's avatar

zitadel

8,198

ZITADEL - Identity infrastructure, simplified forย you.

authelia's avatar

authelia

21,081

The Single Sign-On Multi-Factor portal for web apps

casdoor's avatar

casdoor

9,721

An open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, RADIUS, Google Workspace, Active Directory and Kerberos

Quick Overview

Ory Kratos is an open-source identity and user management system designed for cloud-native applications. It provides secure login, registration, and account recovery functionalities, supporting various authentication methods and integrating seamlessly with modern application architectures.

Pros

  • Highly secure and privacy-compliant, adhering to GDPR and other regulations
  • Flexible and customizable, supporting multiple authentication methods and workflows
  • Cloud-native design, easily scalable and deployable in containerized environments
  • Language-agnostic with RESTful APIs, allowing integration with various tech stacks

Cons

  • Steeper learning curve compared to some simpler authentication solutions
  • Requires additional setup and configuration for advanced features
  • Documentation can be overwhelming for beginners
  • Limited built-in UI components, requiring more frontend development effort

Code Examples

  1. Initializing Kratos client:
import "github.com/ory/kratos-client-go"

configuration := kratos.NewConfiguration()
configuration.Servers = kratos.ServerConfigurations{
    {URL: "http://127.0.0.1:4433"},
}
client := kratos.NewAPIClient(configuration)
  1. Retrieving the current user's session:
import "context"

session, response, err := client.V0alpha2Api.ToSession(context.Background()).Execute()
if err != nil {
    // Handle error
}
// Use session data
  1. Initiating a login flow:
flow, response, err := client.V0alpha2Api.InitializeSelfServiceLoginViaAPIFlow(context.Background()).Execute()
if err != nil {
    // Handle error
}
// Use flow.Id for subsequent login requests

Getting Started

  1. Install Kratos:

    docker pull oryd/kratos:v0.11.1

  2. Create a basic configuration file kratos.yml:

    dsn: memory
serve:
  public:
    base_url: http://127.0.0.1:4433/
  admin:
    base_url: http://127.0.0.1:4434/

  3. Run Kratos:

    docker run -it -p 4433:4433 -p 4434:4434 \
  -v $PWD/kratos.yml:/etc/config/kratos/kratos.yml \
  oryd/kratos:v0.11.1 serve

  4. Integrate Kratos client in your application using the code examples provided above.

Competitor Comparisons

keycloak logo

keycloak

22,126

Open Source Identity and Access Management For Modern Applications and Services

Pros of Keycloak

  • More mature and feature-rich, with a larger ecosystem and community support
  • Offers a comprehensive admin UI for easier management and configuration
  • Provides out-of-the-box support for various authentication protocols (e.g., SAML, OpenID Connect)

Cons of Keycloak

  • Heavier resource footprint, requiring more system resources to run
  • Steeper learning curve due to its extensive feature set and complexity
  • Less flexible for custom integrations compared to Kratos' modular approach

Code Comparison

Keycloak (Java):

@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    KeycloakSecurityContext context = (KeycloakSecurityContext) req.getAttribute(KeycloakSecurityContext.class.getName());
    AccessToken token = context.getToken();
    // Use token for authentication and authorization
}

Kratos (Go):

func (h *Handler) ProtectedEndpoint(w http.ResponseWriter, r *http.Request) {
    session, err := h.r.Session().ToSession(r.Context(), w, r)
    if err != nil {
        h.r.Writer().WriteError(w, r, err)
        return
    }
    // Use session for authentication and authorization
}
supertokens logo

supertokens-core

12,647

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

Pros of SuperTokens

  • Offers a more comprehensive out-of-the-box solution for authentication, including pre-built UI components
  • Provides better documentation and easier setup process for developers
  • Supports multiple programming languages and frameworks natively

Cons of SuperTokens

  • Less flexible and customizable compared to Kratos' modular approach
  • Smaller community and ecosystem, potentially leading to fewer third-party integrations
  • May have a steeper learning curve for developers who prefer more control over the authentication flow

Code Comparison

SuperTokens (Node.js example):

import supertokens from "supertokens-node";
import Session from "supertokens-node/recipe/session";

supertokens.init({
    appInfo: {
        apiDomain: "https://api.example.com",
        appName: "MyApp",
        websiteDomain: "https://example.com"
    },
    recipeList: [Session.init()]
});

Kratos (Go example):

import "github.com/ory/kratos/x"

func main() {
    reg := driver.NewDefaultRegistry()
    c := reg.Config()
    c.MustSet(config.ViperKeyDSN, "memory")
    kratos := driver.New(c, reg)
}

Both examples demonstrate basic initialization, but SuperTokens provides a more opinionated setup, while Kratos offers more flexibility in configuration.

logto-io logo

logto

8,288

๐Ÿง‘โ€๐Ÿš€ The better identity infrastructure for developers and the open-source alternative to Auth0.

Pros of Logto

  • More user-friendly interface with a built-in admin console
  • Offers out-of-the-box social sign-in integrations
  • Provides a more comprehensive solution with additional features like user management and audit logs

Cons of Logto

  • Less mature project with a smaller community compared to Kratos
  • May have fewer customization options for advanced use cases
  • Limited language support for SDKs (primarily JavaScript/TypeScript)

Code Comparison

Logto (JavaScript SDK usage):

import { LogtoClient } from '@logto/browser';

const logto = new LogtoClient({
  endpoint: 'https://your-logto-endpoint',
  appId: 'your-application-id',
});

await logto.signIn('http://localhost:3000/callback');

Kratos (Go SDK usage):

import "github.com/ory/kratos-client-go"

configuration := kratos.NewConfiguration()
configuration.Servers = []kratos.ServerConfiguration{
    {URL: "http://127.0.0.1:4433"},
}
client := kratos.NewAPIClient(configuration)

_, _, err := client.V0alpha2Api.InitializeSelfServiceLoginViaAPIFlow(context.Background()).Execute()

Both projects aim to provide authentication and identity management solutions, but they differ in their approach and target audience. Logto focuses on simplicity and ease of use, while Kratos offers more flexibility and customization options for complex scenarios.

zitadel logo

zitadel

8,198

ZITADEL - Identity infrastructure, simplified forย you.

Pros of Zitadel

  • Offers a more comprehensive identity management solution, including user management, authentication, and authorization
  • Provides built-in multi-tenancy support out of the box
  • Includes a user-friendly web interface for easier management and configuration

Cons of Zitadel

  • Less flexible and customizable compared to Kratos' modular approach
  • Steeper learning curve due to its more extensive feature set
  • May be overkill for simpler authentication requirements

Code Comparison

Kratos configuration example:

selfservice:
  strategies:
    password:
      enabled: true
    oidc:
      enabled: true
      providers:
        - id: google
          provider: google
          client_id: ...
          client_secret: ...

Zitadel configuration example:

AuthNKey:
  key: ...
  algorithm: RS256
Database:
  cockroach:
    host: ...
    user: ...
    password: ...
OIDC:
  Issuer: https://example.com

Both projects offer robust identity and access management solutions, but they cater to different use cases. Kratos focuses on providing a flexible, API-first approach to authentication, while Zitadel offers a more comprehensive suite of identity management features. The choice between the two depends on the specific requirements of your project and the level of customization needed.

authelia logo

authelia

21,081

The Single Sign-On Multi-Factor portal for web apps

Pros of Authelia

  • Comprehensive all-in-one solution with built-in 2FA, SSO, and access control
  • Supports multiple authentication backends (LDAP, file-based)
  • Easy to set up and configure with Docker

Cons of Authelia

  • Less flexible for custom identity workflows compared to Kratos
  • Limited support for external identity providers
  • Smaller community and ecosystem compared to Ory projects

Code Comparison

Authelia configuration (YAML):

authentication_backend:
  file:
    path: /config/users_database.yml
access_control:
  default_policy: deny
  rules:
    - domain: secure.example.com
      policy: two_factor

Kratos configuration (YAML):

selfservice:
  strategies:
    password:
      enabled: true
    oidc:
      enabled: true
      providers:
        - id: google
          provider: google

Both projects use YAML for configuration, but Kratos offers more granular control over identity workflows and strategies. Authelia's configuration is more focused on access control and authentication methods, while Kratos provides a more flexible identity management system.

casdoor logo

casdoor

9,721

An open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, RADIUS, Google Workspace, Active Directory and Kerberos

Pros of Casdoor

  • More comprehensive out-of-the-box features, including user management, role-based access control, and multi-tenancy
  • Easier to set up and configure, with a user-friendly web interface for management
  • Better support for multiple authentication protocols (OAuth 2.0, SAML, LDAP)

Cons of Casdoor

  • Less focus on API-first design, which may limit flexibility for complex integrations
  • Smaller community and ecosystem compared to Kratos
  • Less emphasis on cloud-native architecture and scalability

Code Comparison

Kratos (Go):

import "github.com/ory/kratos/driver"

d := driver.New()
r := d.Registry()

Casdoor (Go):

import "github.com/casdoor/casdoor/object"

object.InitConfig("conf/app.conf")

Both projects use Go, but Kratos follows a more modular approach with its driver and registry pattern, while Casdoor uses a simpler configuration initialization. This reflects Kratos' focus on flexibility and Casdoor's emphasis on ease of use.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Ory Kratos - Cloud native Identity and User Management

Chat | Discussions | Newsletter

Guide | API Docs | Code Docs

Support this project!

Work in Open Source, Ory is hiring!

CI Tasks for Ory Kratos CII Best Practices

Ory Kratos is the developer-friendly, security-hardened and battle-tested Identity, User Management and Authentication system for the Cloud. Finally, it is no longer necessary to implement User Login for the umpteenth time!

Ory Kratos on the Ory Network

The Ory Network is the fastest, most secure and worry-free way to use Ory's Services. Ory Identities is powered by the Ory Kratos open source identity server, and it's fully API-compatible.

The Ory Network provides the infrastructure for modern end-to-end security:

  • Identity & credential management scaling to billions of users and devices
  • Registration, Login and Account management flows for passkey, biometric, social, SSO and multi-factor authentication
  • Pre-built login, registration and account management pages and components
  • OAuth2 and OpenID provider for single sign on, API access and machine-to-machine authorization
  • Low-latency permission checks based on Google's Zanzibar model and with built-in support for the Ory Permission Language

It's fully managed, highly available, developer & compliance-friendly!

  • GDPR-friendly secure storage with data locality
  • Cloud-native APIs, compatible with Ory's Open Source servers
  • Comprehensive admin tools with the web-based Ory Console and the Ory Command Line Interface (CLI)
  • Extensive documentation, straightforward examples and easy-to-follow guides
  • Fair, usage-based pricing

Sign up for a free developer account today!

Ory Network Hybrid Support Plan

Ory offers a support plan for Ory Network Hybrid, including Ory on private cloud deployments. If you have a self-hosted solution and would like help, consider a support plan! The team at Ory has years of experience in cloud computing. Ory's offering is the only official program for qualified support from the maintainers. For more information see the website or book a meeting!

Quickstart

Install the Ory CLI and create a new project to get started with Ory Identities right away:

# If you don't have Ory CLI installed yet:
bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory
sudo mv ./ory /usr/local/bin/

# Sign up
ory auth

# Create project
ory create project

Table of Contents

What is Ory Kratos?

Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with:

  • Self-service Login and Registration: Allow end-users to create and sign into accounts (we call them identities) using Username / Email and password combinations, Social Sign In ("Sign in with Google, GitHub"), Passwordless flows, and others.
  • Multi-Factor Authentication (MFA/2FA): Support protocols such as TOTP (RFC 6238 and IETF RFC 4226 - better known as Google Authenticator)
  • Account Verification: Verify that an E-Mail address, phone number, or physical address actually belong to that identity.
  • Account Recovery: Recover access using "Forgot Password" flows, Security Codes (in case of MFA device loss), and others.
  • Profile and Account Management: Update passwords, personal details, email addresses, linked social profiles using secure flows.
  • Admin APIs: Import, update, delete identities.

We highly recommend reading the Ory Kratos introduction docs to learn more about Ory Krato's background, feature set, and differentiation from other products.

Who is using it?

The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 33.000 members and is growing rapidly. The Ory stack protects 60.000.000.000+ API requests every month with over 400.000+ active service nodes. None of this would have been possible without each and everyone of you!

The following list represents companies that have accompanied us along the way and that have made outstanding contributions to our ecosystem. If you think that your company deserves a spot here, reach out to office@ory.sh now!

Type Name Logo Website
Adopter * Raspberry PI Foundation Raspberry PI Foundation raspberrypi.org
Adopter * Kyma Project Kyma Project kyma-project.io
Adopter * Tulip Tulip Retail tulip.com
Adopter * Cashdeck / All My Funds All My Funds cashdeck.com.au
Adopter * Hootsuite Hootsuite hootsuite.com
Adopter * Segment Segment segment.com
Adopter * Arduino Arduino arduino.cc
Adopter * DataDetect Datadetect unifiedglobalarchiving.com/data-detect/
Adopter * Sainsbury's Sainsbury's sainsburys.co.uk
Adopter * Contraste Contraste contraste.com
Adopter * Reyah Reyah reyah.eu
Adopter * Zero Project Zero by Commit getzero.dev
Adopter * Padis Padis padis.io
Adopter * Cloudbear Cloudbear cloudbear.eu
Adopter * Security Onion Solutions Security Onion Solutions securityonionsolutions.com
Adopter * Factly Factly factlylabs.com
Adopter * Nortal Nortal nortal.com
Adopter * OrderMyGear OrderMyGear ordermygear.com
Adopter * Spiri.bo Spiri.bo spiri.bo
Adopter * Strivacity Spiri.bo strivacity.com
Adopter * Hanko Hanko hanko.io
Adopter * Rabbit Rabbit rabbit.co.th
Adopter * inMusic InMusic inmusicbrands.com
Adopter * Buhta Buhta buhta.com
Adopter * Connctd Connctd connctd.com
Adopter * Paralus Paralus paralus.io
Adopter * TIER IV TIER IV tier4.jp
Adopter * R2Devops R2Devops r2devops.io
Adopter * LunaSec LunaSec lunasec.io
Adopter * Serlo Serlo serlo.org
Adopter * dyrector.io dyrector.io dyrector.io
Adopter * Stackspin stackspin.net stackspin.net
Adopter * Amplitude amplitude.com amplitude.com
Adopter * Pinniped pinniped.dev pinniped.dev
Adopter * Pvotal pvotal.tech pvotal.tech

Many thanks to all individual contributors

* Uses one of Ory's major projects in production.

Getting Started

To get started with some easy examples, head over to the Get Started Documentation.

Installation

Head over to the Ory Developer Documentation to learn how to install Ory Kratos on Linux, macOS, Windows, and Docker and how to build Ory Kratos from source.

Ecosystem

We build Ory on several guiding principles when it comes to our architecture design:

  • Minimal dependencies
  • Runs everywhere
  • Scales without effort
  • Minimize room for human and network errors

Ory's architecture is designed to run best on a Container Orchestration system such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are small (5-15MB) and available for all popular processor types (ARM, AMD64, i386) and operating systems (FreeBSD, Linux, macOS, Windows) without system dependencies (Java, Node, Ruby, libxml, ...).

Ory Kratos: Identity and User Infrastructure and Management

Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with: Self-service Login and Registration, Multi-Factor Authentication (MFA/2FA), Account Recovery and Verification, Profile, and Account Management.

Ory Hydra: OAuth2 & OpenID Connect Server

Ory Hydra is an OpenID Certifiedรขย„ยข OAuth2 and OpenID Connect Provider which easily connects to any existing identity system by writing a tiny "bridge" application. It gives absolute control over the user interface and user experience flows.

Ory Oathkeeper: Identity & Access Proxy

Ory Oathkeeper is a BeyondCorp/Zero Trust Identity & Access Proxy (IAP) with configurable authentication, authorization, and request mutation rules for your web services: Authenticate JWT, Access Tokens, API Keys, mTLS; Check if the contained subject is allowed to perform the request; Encode resulting content into custom headers (X-User-ID), JSON Web Tokens and more!

Ory Keto: Access Control Policies as a Server

Ory Keto is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.

Security

Running identity infrastructure requires attention and knowledge of threat models.

Disclosing vulnerabilities

If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. You can find all info for responsible disclosure in our security.txt.

Telemetry

Ory's services collect summarized, anonymized data that can optionally be turned off. Click here to learn more.

Documentation

Guide

The Guide is available here.

HTTP API documentation

The HTTP API is documented here.

Upgrading and Changelog

New releases might introduce breaking changes. To help you identify and incorporate those changes, we document these changes in the CHANGELOG.md. For upgrading, please visit the upgrade guide.

Command line documentation

Run kratos -h or kratos help.

Develop

We encourage all contributions and encourage you to read our contribution guidelines

Dependencies

You need Go 1.16+ and (for the test suites):

  • Docker and Docker Compose
  • Makefile
  • NodeJS / npm

It is possible to develop Ory Kratos on Windows, but please be aware that all guides assume a Unix shell like bash or zsh.

Install from source

make install

Formatting Code

You can format all code using make format. Our CI checks if your code is properly formatted.

Running Tests

There are three types of tests you can run:

  • Short tests (do not require a SQL database like PostgreSQL)
  • Regular tests (do require PostgreSQL, MySQL, CockroachDB)
  • End to end tests (do require databases and will use a test browser)
Short Tests

Short tests run fairly quickly. You can either test all of the code at once

go test -short -tags sqlite ./...

or test just a specific module:

cd client; go test -tags sqlite -short .
Regular Tests

Regular tests require a database set up. Our test suite is able to work with docker directly (using ory/dockertest) but we encourage to use the Makefile instead. Using dockertest can bloat the number of Docker Images on your system and are quite slow. Instead we recommend doing:

make test

Please be aware that make test recreates the databases every time you run make test. This can be annoying if you are trying to fix something very specific and need the database tests all the time. In that case we suggest that you initialize the databases with:

make test-resetdb
export TEST_DATABASE_MYSQL='mysql://root:secret@(127.0.0.1:3444)/mysql?parseTime=true'
export TEST_DATABASE_POSTGRESQL='postgres://postgres:secret@127.0.0.1:3445/kratos?sslmode=disable'
export TEST_DATABASE_COCKROACHDB='cockroach://root@127.0.0.1:3446/defaultdb?sslmode=disable'

Then you can run go test as often as you'd like:

go test -tags sqlite ./...

# or in a module:
cd client; go test  -tags sqlite  .
Updating Test Fixtures

Some tests use fixtures. If payloads change, you can update them with:

make test-update-snapshots

This will only update the snapshots of the short tests. To update all snapshots, run:

UPDATE_SNAPSHOTS=true go test -p 4 -tags sqlite ./...

You can also run this command from a sub folder.

End-to-End Tests

We use Cypress to run our e2e tests.

รขยšย รฏยธย To run Cypress on ARM based Mac's, at the moment it is necessary to install Rosetta 2. To install, use the command - softwareupdate --install-rosetta --agree-to-license

The simplest way to develop e2e tests is:

./test/e2e/run.sh --dev sqlite

You can run all tests (with databases) using:

make test-e2e

For more details, run:

./test/e2e/run.sh

Run only a singular test

Add .only to the test you would like to run.

For example:

it.only('invalid remote recovery email template', () => {
    ...
})

Run a subset of tests

This will require editing the cypress.json file located in the test/e2e/ folder.

Add the testFiles option and specify the test to run inside the cypress/integration folder. As an example we will add only the network tests.

"testFiles": ["profiles/network/*"],

Now start the tests again using the run script or makefile.

Build Docker

You can build a development Docker Image using:

make docker

Preview API documentation

  • update the SDK including the OpenAPI specification: make sdk
  • run preview server for API documentation: make docs/api
  • run preview server for swagger documentation: make docs/swagger

NPM DownloadsLast 30 Days