Existing OAuth and OpenID Connect solutions lack flexibility and granular control, limiting adaptability to specific business needs. Ory Hydra — the open-source, OpenID Certified® OAuth 2.0 server — integrates with your infrastructure, giving you complete control over how access tokens are issued, scoped, and validated.
Millions of users. Unlimited scale.
Ory Hydra powers OAuth 2.0 and OpenID Connect for systems with millions of users, serving thousands of token issuances per second.
SDKs for every stack
Hydra is written in Go with official SDKs for every major language — .NET, Java, Node.js, PHP, Python, Ruby, Rust, Dart, and TypeScript. It works with any login system and integrates with your existing identity provider, so engineers can add OAuth 2.0 in hours, not weeks.
OpenID Certified® OAuth 2.0
The most advanced open-source OAuth 2.0 and OpenID Connect server — and the only one OpenID Certified®. Integrates with any login system and federates identity to any application, anywhere.
Powered by Open Source
Ory Hydra offers deployment flexibility. With open source roots, Ory Hydra has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features, commercial SLAs, and support, or use the fully managed Ory Network for a seamless SaaS experience.
OpenAI wanted a partner that could help enable our vision for owning our identity processes, data, and success. We have a lot of partners, and Ory is one of our best.
OAuth 2.0 and OpenID Connect features for production
Full OAuth 2.0 spec coverage
Implements the complete OAuth 2.0 standard as defined by the IETF — authorization code, client credentials, refresh token, PKCE, and token exchange flows. Integrates with Ory Kratos or any open-source or proprietary identity provider.
OpenID Certified®
The OpenID Foundation has certified Ory Hydra as a conformant OpenID Connect provider. All flows specified by the IETF and OpenID Foundation are implemented and tested against the certification suite.
Bring your own UX
Use your own branding, login screens, and consent pages for every OAuth 2.0 and OpenID Connect flow. Ory Hydra exposes the protocol; you control the UX. Powered by a documented REST API and CLI.
Compatible with MITREid
Drop-in migration path from MITREid Connect. Hydra ships with documentation for migrating client registrations, key material, and active sessions with minimal downtime.
Cryptographic key storage
Cryptographic keys for JWT signing are stored encrypted at rest. Manage OAuth 2.0 clients, rotate signing keys, and issue tokens directly from the CLI or Admin API.
Production-grade scale and performance
Stateless, horizontally scalable architecture. Ory Hydra serves tokens to systems with millions of users and tens of millions of weekly token issuances — battle-tested for security incident reduction and operational simplicity.
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
Ory Open Source
Continuous Security License
Ory Enterprise License
Ory Network
Cross-platform benefits
Cross-platform benefits
Cross-platform benefits
Cross-platform benefits
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Open Source: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Continuous Security License: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance-ready
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Network: Yes
Global multi-region architecture
Ory Open Source: No
Global multi-region architecture
Continuous Security License: No
Global multi-region architecture
Multi-region capable
Global multi-region architecture
Ory Network: Yes
Purpose-based data retention
Ory Open Source: No
Purpose-based data retention
Continuous Security License: No
Purpose-based data retention
Ory Enterprise License: Yes
Purpose-based data retention
Ory Network: Yes
24/7 SLA support
Ory Open Source: No
24/7 SLA support
Continuous Security License: No
24/7 SLA support
Ory Enterprise License: Yes
24/7 SLA support
Ory Network: Yes
CVE security patching
Ory Open Source: No
CVE security patching
Continuous Security License: Yes
CVE security patching
Ory Enterprise License: Yes
CVE security patching
Ory Network: Yes
Unified control plane for ease of management
Ory Open Source: CLI
Unified control plane for ease of management
Continuous Security License: CLI
Unified control plane for ease of management
Ory Enterprise License: CLI / GUI
Unified control plane for ease of management
Ory Network: CLI / GUI / Terraform provider
Software Bill of Materials
Ory Open Source: Yes
Software Bill of Materials
Continuous Security License: Yes
Software Bill of Materials
Ory Enterprise License: Yes
Software Bill of Materials
Ory Network: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Open Source: No
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Continuous Security License: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Enterprise License: Yes
Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)
Ory Network: Yes
Production Helm Charts
Ory Open Source: No
Production Helm Charts
Continuous Security License: No
Production Helm Charts
Ory Enterprise License: Yes
Production Helm Charts
n/a
Managed infrastructure
Ory Open Source: No
Managed infrastructure
Continuous Security License: No
Managed infrastructure
n/a
Managed infrastructure
Ory Network: Yes
Support Ticketing System
Ory Open Source: No
Support Ticketing System
Continuous Security License: No
Support Ticketing System
Ory Enterprise License: Yes
Support Ticketing System
Ory Network: Yes
Concierge onboarding
Ory Open Source: No
Concierge onboarding
Continuous Security License: No
Concierge onboarding
Ory Enterprise License: Yes
Concierge onboarding
Ory Network: Yes
Dedicated slack channel
Ory Open Source: No
Dedicated slack channel
Continuous Security License: No
Dedicated slack channel
Ory Enterprise License: Yes
Dedicated slack channel
Ory Network: Yes
Premium Features
Ory Open Source: No
Premium Features
Continuous Security License: No
Premium Features
Ory Enterprise License: Yes
Premium Features
Ory Network: Yes
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
Authorization (Certified OAuth2/OIDC) - Ory Hydra
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Open Source: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Continuous Security License: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Enterprise License: Yes
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
Ory Network: Yes
OpenID Certified®
Ory Open Source: Yes
OpenID Certified®
Continuous Security License: Yes
OpenID Certified®
Ory Enterprise License: Yes
OpenID Certified®
Ory Network: Yes
High performance pooling
Ory Open Source: No
High performance pooling
Continuous Security License: No
High performance pooling
Ory Enterprise License: Yes
High performance pooling
Ory Network: Yes
Stateless JWT access tokens
Ory Open Source: No
Stateless JWT access tokens
Continuous Security License: No
Stateless JWT access tokens
Ory Enterprise License: Yes
Stateless JWT access tokens
Ory Network: Yes
Credential rotation
Ory Open Source: No
Credential rotation
Continuous Security License: No
Credential rotation
Ory Enterprise License: Yes
Credential rotation
Ory Network: Yes
Token exchange
Ory Open Source: No
Token exchange
Continuous Security License: No
Token exchange
Ory Enterprise License: Yes
Token exchange
Ory Network: Yes
Resource Owner Password Credentials (ROPC)
Ory Open Source: No
Resource Owner Password Credentials (ROPC)
Continuous Security License: No
Resource Owner Password Credentials (ROPC)
Ory Enterprise License: Yes
Resource Owner Password Credentials (ROPC)
Ory Network: Yes
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
Managing Identities - Ory Kratos
High performance pooling
Ory Open Source: No
High performance pooling
Continuous Security License: No
High performance pooling
Ory Enterprise License: Yes
High performance pooling
Ory Network: Yes
B2B Organizations
Ory Open Source: No
B2B Organizations
Continuous Security License: No
B2B Organizations
Ory Enterprise License: Yes
B2B Organizations
Ory Network: Yes
Admin onboarding portal
Ory Open Source: No
Admin onboarding portal
Continuous Security License: No
Admin onboarding portal
Ory Enterprise License: Yes
Admin onboarding portal
Ory Network: Yes
Social single sign-on
Ory Open Source: Yes
Social single sign-on
Continuous Security License: Yes
Social single sign-on
Ory Enterprise License: Yes
Social single sign-on
Ory Network: Yes
Purpose-based data retention
Ory Open Source: No
Purpose-based data retention
Continuous Security License: No
Purpose-based data retention
Ory Enterprise License: Yes
Purpose-based data retention
Ory Network: Yes
CAPTCHA
Ory Open Source: No
CAPTCHA
Continuous Security License: No
CAPTCHA
Ory Enterprise License: Yes
CAPTCHA
Ory Network: Yes
FedCM
Ory Open Source: No
FedCM
Continuous Security License: No
FedCM
Ory Enterprise License: Yes
FedCM
Ory Network: Yes
Advanced identity search
Ory Open Source: No
Advanced identity search
Continuous Security License: No
Advanced identity search
Ory Enterprise License: Yes
Advanced identity search
Ory Network: Yes
B2B Federation - Ory Polis
B2B Federation - Ory Polis
B2B Federation - Ory Polis
B2B Federation - Ory Polis
Custom Branding for Onboarding Portal
Ory Open Source: No
Custom Branding for Onboarding Portal
Continuous Security License: No
Custom Branding for Onboarding Portal
Ory Enterprise License: Yes
Custom Branding for Onboarding Portal
Ory Network: Yes
SAML & OIDC
Ory Open Source: Yes
SAML & OIDC
Continuous Security License: Yes
SAML & OIDC
Ory Enterprise License: Yes
SAML & OIDC
Ory Network: Yes
Directory sync
Ory Open Source: Yes
Directory sync
Continuous Security License: Yes
Directory sync
Ory Enterprise License: Yes
Directory sync
Ory Network: Yes
Identity federation
Ory Open Source: No
Identity federation
Continuous Security License: No
Identity federation
Ory Enterprise License: Yes
Identity federation
Ory Network: Yes
Permissions - Ory Keto
Permissions - Ory Keto
Permissions - Ory Keto
Permissions - Ory Keto
Concierge Onboarding
Ory Open Source: No
Concierge Onboarding
Continuous Security License: No
Concierge Onboarding
Ory Enterprise License: Yes
Concierge Onboarding
Ory Network: Yes
Optimized Permission Checks
Ory Open Source: No
Optimized Permission Checks
Continuous Security License: No
Optimized Permission Checks
Ory Enterprise License: Yes
Optimized Permission Checks
Ory Network: Yes
OPA & RAG Integration
Ory Open Source: No
OPA & RAG Integration
Continuous Security License: No
OPA & RAG Integration
Ory Enterprise License: Yes
OPA & RAG Integration
Ory Network: Yes
Deploy Ory Hydra on your preferred infrastructure
Run the same OAuth 2.0 and OpenID Connect server three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same OpenID Certified® engine, same protocol semantics across all three.
Open Source deployment — Explore and experiment with Ory Hydra, an OAuth2 and OpenID Connect server. Ideal for developers building proofs of concept, testing integrations, or learning how Ory identity flows work. 
Ory Enterprise License
OEL deployment — Run Ory Hydra with enterprise-grade performance and support. Get optimized code, security updates, and compliance features for mission-critical identity workloads, on-premises or in your private cloud. 
Ory Network
Ory Network deployment — Use Hydra-powered OAuth2 and OpenID Connect services instantly, without managing infrastructure. Ory Network delivers global scale, built-in compliance, and the fastest path to secure identity.
Integrate Ory Hydra with your stack
Amazon SES
Reliably deliver critical identity-related transactional emails
AWS API Gateway
Secure API front door with fine-grained authorization
AWS Infrastructure
Leverage scalable AWS infrastructure for identity management
Discord Social Login
Tap into Discord's large, engaged user base
Get Started
Ready to try Ory Hydra?
Spin up Ory Hydra locally in under five minutes, or jump to the OAuth 2.0 integration guide if you're scoping a production deployment.
oauth2-client.js
const express = require('express');
const app = express();
const { AuthorizationCode } = require("simple-oauth2")
const client = new AuthorizationCode({
client: {
id: process.env.CLIENT_ID,
secret: process.env.CLIENT_SECRET,
},
auth: {
tokenHost: "https://<your-project>.projects.oryapis.com",
tokenPath: "/oauth2/token",
authorizePath: "/oauth2/auth",
},
})
app.get("/", (req, res) => {
const authorizationUri = client.authorizeURL({
redirect_uri: REDIRECT_URI,
scope: "openid offline",
})
res.redirect(authorizationUri)
})
app.get("/callback", async (req, res) => {
const { code } = req.query
try {
const accessToken = await client.getToken({
code,
redirect_uri: process.env.REDIRECT_URI,
scope: "openid offline",
})
res.json(accessToken.token)
} catch (error) {
res.status(500).json({ error: error.message })
}
})
More on Ory Hydra
View all Ory Hydra blogs
June 26, 2026
Discover how Cloudflare used Ory Hydra to scale OAuth for all users, slashing API response times by 45% and memory use by 40% with zero user downtime.
November 14, 2025
Ory OSS 25.4.0 brings OAuth 2.0 device authorization flow, SMS login, token chain revocation and more — giving developers and IAM builders a solid foundation for IAM.
November 11, 2025
Open-source Ory Hydra v25.4.0 addresses agentic authentication with Device Authorization Grant, OAuth 2.1 discovery, and token chain revocation for AI, smart devices, and IoT.
November 10, 2025
The Ory OSS v25.4.0 release rollout is underway. Discover how Ory’s new unified, calendar-based versioning streamlines upgrades and compatibility across Hydra, Kratos, Keto, and Oathkeeper.
Ory Hydra FAQ
Ory Hydra is an OAuth 2.0 and OpenID Connect server written in Go. It is OpenID Certified and handles token issuance, consent management, client registration, and cryptographic key storage. Ory Hydra does not manage users or passwords. It delegates authentication to an external login provider (such as Ory Kratos or your own system) through a Login and Consent flow. This separation means Ory Hydra works with any existing identity backend. Ory Hydra is available as open-source software (Apache 2.0), under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.
- Total Brand Sovereignty - Legacy IAM platforms often force you to use their hosted login pages, leading to a fragmented user journey that limits conversions. Ory Hydra is a headless, API-first solution. Your developers can build pixel-perfect login, registration, and MFA screens that live entirely within your brand's ecosystem, while Ory Hydra manages the secure tokens in the background.
- Planet-Scale Performance and Low Latency - For global businesses, identity is often the primary bottleneck for application speed. Ory Hydra is built for high-concurrency environments (like the scale required by OpenAI’s 900M+ weekly active users). It offers sub-millisecond response times, ensuring that security checks never degrade the user experience, even during massive traffic spikes.
- Reduced Compliance Risk & Hardened Security - Implementing OAuth2 and OIDC from scratch is a significant security liability. Ory Hydra is a certified OIDC provider, significantly reducing your "Remediation Gap" and lowering the risk of data breaches associated with homegrown identity stacks.
- Cost Effective Growth Traditional providers often charge "per-user" or "per-login" fees that punish growth. Ory is written in Go and takes an API-first headless approach. Because it is resource-efficient, businesses can scale to millions of users without the exponential cost increases associated with legacy SaaS platforms. Ory takes a average Daily Active Users (aDAU) approach to cost that has significant advantages over the more common Monthly Active User (MAU) approach.
Ory Hydra supports the Authorization Code Grant (with PKCE), Client Credentials Grant, Implicit Grant (deprecated per spec), Refresh Token Grant, Device Authorization Grant, and OAuth 2.0 Token Exchange (RFC 8693). It also supports the JWT Bearer profile for client authentication (RFC 7523). Ory Hydra is certified by the OpenID Foundation for Basic, Implicit, Hybrid, Config, and Dynamic OpenID Provider profiles.
The Login and Consent App is a web application you build (or use a reference implementation of) that handles two responsibilities: authenticating the user against your identity store, and asking the user for consent to share data with an OAuth2 client. When an OAuth2 flow starts, Ory Hydra redirects the user to your Login App with a challenge parameter. Your app verifies the user's credentials, then calls the Ory Hydra admin API to accept the login. Ory Hydra then redirects to your Consent App, which presents the requested scopes and calls the Ory Hydra API to accept or reject.This design means Ory Hydra integrates with any identity backend: Ory Kratos, Keycloak, Azure AD, a custom database, or anything else. On the Ory Network, the Login and Consent flow is pre-integrated with Ory Kratos and the Ory Account Experience UI, so you can skip building it yourself.
Ory Hydra handles delegation: issuing OAuth 2.0 access tokens and OpenID Connect ID tokens so that third-party applications can access resources on behalf of users. Ory Kratos handles identity: login, registration, MFA, account recovery, and session management.If you only need login for your own first-party app, use Ory Kratos alone. You do not need OAuth 2.0 just to authenticate your own users. If you need to issue tokens to third-party clients, enable machine-to-machine flows, or act as an OpenID Connect provider, use Ory Hydra. Ory Kratos and Ory Hydra pair naturally: Ory Kratos provides the identity layer, and Ory Hydra handles the OAuth2/OIDC protocol.
Ory Hydra delivers a "deploy-anywhere," OAuth2 and OpenID Connect-certified platform built for trillion-scale performance. By decoupling identity from application logic, Ory empowers global enterprises to eliminate vendor lock-in and secure a vast ecosystem of customers, partners, and AI agents. Consolidate your authorization layer into modular building blocks to slash total cost of ownership (TCO) and accelerate the delivery of mission-critical, secure-by-design applications.
Ory Hydra supports two access token formats. Opaque tokens (the default) are random strings stored in the database and validated via lookup. They are immediately revocable. JWT access tokens are self-contained and verified by checking their cryptographic signature, without a database call. The trade-off is that JWTs cannot be instantly revoked. You can configure the token format globally or per client. Refresh tokens are always opaque. Ory Hydra also supports token introspection (RFC 7662) so resource servers can validate tokens and check revocation status.You can add custom claims to access tokens and ID tokens through the consent flow, by promoting claims to the top level of JWTs, or by registering a token webhook that Ory Hydra calls before issuing any token.
Yes. The client credentials flow lets services authenticate without user interaction. Create an OAuth2 client with the client_credentials grant type, and the service exchanges its credentials for an access token. Ory Hydra supports three client authentication methods: Basic Authentication, body-based authentication, and JWT Bearer with a private key. You can use token webhooks to inject custom claims into M2M tokens.
Ory Hydra provides a full client lifecycle API. You can create, read, update, and delete OAuth2 clients via the Ory Console, the Ory CLI, the admin REST API, or SDKs in Go, TypeScript, Python, Java, PHP, Ruby, Rust, Dart, .NET, and Elixir. Ory Hydra also supports OpenID Connect Dynamic Client Registration (RFC 7591/7592) for programmatic client creation.
PostgreSQL (12+), MySQL (8+), and CockroachDB are supported for production. SQLite is supported for local development only. CockroachDB is recommended for multi-region deployments or complex disaster recovery requirements. Connection pooling parameters are configurable for each database. On the Ory Network, the database layer is managed for you.
Ory Hydra is the delegation layer. It handles OAuth 2.0 and OpenID Connect: issuing access tokens, refresh tokens, and ID tokens so that third-party applications, partner services, and AI agents can access your APIs on behalf of users or on their own authority. Ory Hydra does not manage users or passwords itself. It delegates authentication to a Login and Consent App, which is where Ory Kratos fits in. When an OAuth 2.0 flow begins, Ory Hydra redirects the user to Ory Kratos for authentication, then collects consent and issues tokens. Ory Keto can enforce fine-grained permissions on the resources those tokens grant access to. Ory Oathkeeper can introspect tokens issued by Ory Hydra at the network edge, rejecting unauthorized requests before they reach your services. Ory Polis extends the ecosystem with SAML-to-OIDC bridging for enterprise SSO scenarios where Ory Hydra acts as the downstream OIDC provider. If you only need first-party login (no third-party token issuance), you do not need Ory Hydra at all; Ory Kratos handles that directly with native session management. You add Ory Hydra when you need to act as an OAuth 2.0/OIDC provider for external clients, enable machine-to-machine authentication, or secure MCP-based AI agent interactions. On the Ory Network, Ory Hydra and Ory Kratos are pre-integrated, so the Login and Consent flow works out of the box without building a custom app.
Keycloak bundles user management, login, and OAuth2/OIDC into a single system. This means your authentication, user storage, and token issuance are all coupled in one Java-based application. Ory Hydra takes the opposite approach: it handles only OAuth2/OIDC and connects to your existing identity provider through a headless Login and Consent flow.This separation has three practical consequences.
- First, you keep your existing user database and login system. Ory Hydra does not force you to migrate users or adopt a new login UI.
- Second, Ory Hydra ships as a lightweight Go binary (~5MB Docker image) optimized for cloud-native environments, compared to Keycloak's heavier JVM-based footprint.
- Third, you get full control over the login and consent UX because you build those screens yourself, in your framework, with your design system.
Ory Hydra open source is free under the Apache 2.0 license. You can self-host it at no cost.The Ory Network managed service has a free Developer tier for testing and proof-of-concept work. On the Ory Network, each M2M token issued via the Client Credentials flow is billed at a per-token rate. Token introspection calls are not billed. Each paid plan includes a monthly usage credit.For self-hosted production with SLAs, CVE patching, enterprise features (such as stateless JWT tokens and high-performance pooling), and dedicated support, the Ory Enterprise License is available at custom pricing.
