What does Ory Kratos actually manage?

Self-service login, registration, account recovery, verification, multi-factor authentication, and profile management for identities.

Is Ory Kratos an OAuth2/OpenID Connect provider?

No, that role is handled by the separate Ory Hydra project; Kratos focuses on identity and credentials, and the two are commonly used together.

Is there a managed version of Kratos?

Yes, the Ory Network runs Ory Identities, a managed service powered by the same open source Kratos server and API-compatible with it.

What's the Ory Enterprise License for?

It adds features not in the open source version, such as SCIM, SAML, and organization SSO, plus CVE-patched builds and SLA-backed support, for production, business-critical deployments.

How do I get started with Kratos?

Install the Ory CLI and run `ory create project` to create a new project, or follow the self-hosting install guide for Linux, macOS, Windows, or Docker.

Ory Kratos: Open source Auth0 alternative

Q: What databases does Kratos support?

PostgreSQL, MySQL, and CockroachDB.

Ory Kratos is an API-first identity and user management system for cloud native applications, centralizing login, registration, recovery, verification, and profile management flows so individual services don't reimplement them. It's built as an open source alternative to hosted identity providers like Auth0, Okta, and Firebase Authentication, exposing identity logic entirely over HTTP APIs rather than tying it to a specific UI framework. Kratos handles the identity side; teams migrating from OAuth2/OIDC-based providers typically pair it with Ory Hydra, which covers the OAuth2 and OpenID Connect provider role. The Ory stack reports protecting more than 7 billion API requests a day across thousands of companies, with adopters including OpenAI and Fandom documented in public case studies.

Key features

Self-service identity flows: Login, registration, account recovery, and email/phone verification are all implemented as versioned, API-driven flows.
Multi-factor authentication: Built-in MFA support without needing a separate third-party MFA service.
Identity schemas and traits: Identity data models are defined via JSON Schema, so you control exactly what fields and traits an identity has rather than a fixed schema.
UI framework agnostic: Because everything is exposed over HTTP APIs, both browser-based and native app flows can be built with any frontend stack.
Admin APIs for lifecycle management: Programmatic APIs cover identity creation, updates, and deletion for account lifecycle automation.
Designed for cloud native scale: Built to scale to large numbers of identities and devices, and to integrate with the rest of the Ory stack for OAuth2, OIDC, and access control.

Self-hosting and deployment

Kratos can be installed on Linux, macOS, Windows, or via Docker, and supports PostgreSQL, MySQL, and CockroachDB as backing databases, with deployment guides covering Kubernetes and other orchestration systems. The open source distribution gives you the full core identity engine with no license requirement, which the project positions as a good fit for individuals, researchers, and workloads without strict SLAs. For business-critical identity flows in production, Ory sells an Ory Enterprise License (OEL) that layers on SCIM, SAML, organization login/SSO, CAPTCHAs, and CVE-patched builds on top of the same self-hosted core.

Ideal use cases

Kratos fits teams that want identity and user management logic out of their application code and behind a dedicated API, especially in Kubernetes or other cloud native environments. It's a reasonable target for teams migrating away from Auth0 or Okta who want to self-host the equivalent login, registration, and recovery flows, and for teams already using other Ory projects like Hydra for OAuth2/OIDC who want a consistent identity layer across services. The open source distribution is explicitly recommended for individuals, researchers, and prototypes without SLA requirements, with the Ory Enterprise License reserved for production, business-critical identity systems. Ory also runs a public chat and GitHub Discussions space where implementation questions about specific flows, such as recovery or MFA setup, get answered by maintainers and other self-hosters.