Ory Kratos
A headless, API-only identity server for teams that want to build their own login UI.
84
sovereigntyOry Kratos is a headless identity and user-management server — it handles registration, login, MFA, account recovery, and profile management entirely through APIs, with no bundled UI. It's designed for teams who want full control over the login experience and are comfortable building their own frontend against a well-documented identity API.
OPEN SOURCEApache-2.0SELF-HOSTLOCAL-FIRST
LicenseApache-2.0
PricingFree / self-host under Apache-2.0; Ory Network offers a managed hosted version with a free tier and paid usage-based plans for teams that prefer not to operate it themselves.
Open sourceYes
Self-hostableYes
Local-first dataYes
What it does well
- +Clean Apache-2.0 license with no enterprise-only carve-out directory, unlike several peers
- +Headless-by-design means zero UI lock-in — build exactly the login experience your product needs
- +Pairs well with companion Ory projects (Hydra for OAuth2/OIDC server, Keto for permissions) for teams that need the full stack
- +Strong documentation and a security-first design philosophy from the Ory team
Where it falls short
- −Headless-only means you must build and maintain your own login/registration UI — meaningfully more upfront engineering work than Auth0's Universal Login or authentik's flow builder
- −Running the full picture (Kratos + Hydra + Keto) for OAuth2/OIDC server capability adds operational complexity beyond a single service
- −Smaller ecosystem of ready-made UI kits/themes compared to Keycloak or authentik
Ory Kratos as an alternative to
Where Ory Kratos shows up in our comparisons, and how it ranked.
Ory Kratos head-to-head
Straight comparisons against the tools people weigh it against.