Ory Kratos
Identity as an API — no UI, no opinions, entirely yours.
92
sovereigntyOry takes the opposite approach to everything else here: Kratos handles identity, Hydra handles OAuth2, Keto handles permissions, and none of them ship a login screen. You build the interface; they provide the correctness. For a team that wants authentication fully inside their own product with no vendor's branding or flow, that is exactly right, and Apache-2.0 means no licence surprises. For a team that wanted SSO configured by Friday, it is the wrong tool — you are assembling identity from parts.
OPEN SOURCEApache-2.0SELF-HOSTLOCAL-FIRST
LicenseApache-2.0
PricingFree and open source. Ory Network is a paid hosted option.
Open sourceYes
Self-hostableYes
Local-first dataYes
What it does well
- +Apache-2.0 across the whole stack — no carve-outs
- +API-first: your product owns the entire login experience
- +Cloud-native, stateless, scales horizontally without ceremony
- +Security-first design with a strong track record
Where it falls short
- −No UI at all — you build every screen
- −Composed of several services to deploy and understand
- −Most engineering effort of anything on this page
- −No admin console for non-technical staff
Ory Kratos as an alternative to
Where Ory Kratos shows up in our comparisons, and how it ranked.
Ory Kratos head-to-head
Straight comparisons against the tools people weigh it against.