# Ory documentation > Official documentation for Ory Network, Ory Enterprise License, Ory Open Source, Ory Polis, Ory Talos, and Ory Agent Security. > > Tool-enabled agents can query the [Ory Docs MCP Server](https://www.ory.com/docs/ecosystem/mcp) for targeted retrieval. Otherwise, use the curated links below. This file covers pages under https://www.ory.com/docs/. Index revision: `e0918d3098a68d9db5ac25814512670abd015acb`. For Ory product, company, integration, blog, and other product marketing content, use the [Ory website index](https://www.ory.com/llms.txt). Use deployment-specific documentation when a Network, OEL, or OSS version is available. Product availability and configuration differ by deployment model. ## Start here - [Ory Overview](https://www.ory.com/docs/intro): Ory is a software infrastructure provider building a global zero-trust network for humans, robots, devices, and software services. - [Ory Documentation](https://www.ory.com/docs/welcome): Developer documentation for Ory ## Agent Security - [Ory Agent Security](https://www.ory.com/agent-security): Runtime policy enforcement and observability for AI coding agents and agent harnesses. ## Ory Network - [Introduction to Ory Network](https://www.ory.com/docs/network/getting-started): Ory Network is the fully managed, cloud-native deployment of Ory - a global, low-latency identity and access management service built on Ory's open source software. - [Introduction to Ory Hydra for Ory Network](https://www.ory.com/docs/network/hydra) - [OAuth2 authorization code and client credentials grants](https://www.ory.com/docs/network/hydra/ory-network-oauth2) - [Introduction to Ory Keto for Ory Network](https://www.ory.com/docs/network/keto) - [File sharing example](https://www.ory.com/docs/network/keto/file-sharing-example) - [What is an identity in Ory?](https://www.ory.com/docs/network/kratos/identity-model) - [Introduction to Ory Kratos for Ory Network](https://www.ory.com/docs/network/kratos/intro) - [Multi-factor authentication](https://www.ory.com/docs/network/kratos/mfa-overview) - [Lookup Secrets - a MFA fail-safe](https://www.ory.com/docs/network/kratos/mfa/lookup-secrets) - [SMS and Email 2FA](https://www.ory.com/docs/network/kratos/mfa/mfa-via-sms) - [Use dynamic multi-factor (step-up) authentication to protect high-risk operations](https://www.ory.com/docs/network/kratos/mfa/step-up-authentication) - [Multi-factor authentication with TOTP (Google Authenticator)](https://www.ory.com/docs/network/kratos/mfa/totp) - [Multi-factor authentication with WebAuthn](https://www.ory.com/docs/network/kratos/mfa/webauthn-fido-yubikey) - [Device authentication](https://www.ory.com/docs/network/kratos/passwordless/deviceauthn) - [Device authentication on Android](https://www.ory.com/docs/network/kratos/passwordless/deviceauthn/android) - [Device authentication in Dart/Flutter](https://www.ory.com/docs/network/kratos/passwordless/deviceauthn/flutter) - [Device authentication on iOS](https://www.ory.com/docs/network/kratos/passwordless/deviceauthn/ios) - [Passwordless authentication with email and SMS one-time code](https://www.ory.com/docs/network/kratos/passwordless/one-time-code) - [Passwordless sign-in and sign-up with passkeys](https://www.ory.com/docs/network/kratos/passwordless/passkeys) - [Implement passkey authentication in web and mobile applications](https://www.ory.com/docs/network/kratos/passwordless/passkeys-mobile) - [Use passwordless WebAuthN to protect against phishing attacks](https://www.ory.com/docs/network/kratos/passwordless/passwordless) - [Introduction to Ory Oathkeeper for Ory Network](https://www.ory.com/docs/network/oathkeeper) - [Introduction to Ory Polis for Ory Network](https://www.ory.com/docs/network/polis) - [Ory Polis Quickstart](https://www.ory.com/docs/network/polis/quickstart) ## Ory Enterprise License - [Introduction to Ory Enterprise License](https://www.ory.com/docs/oel/getting-started): The Ory Enterprise License (OEL) is the self-hosted, commercially supported deployment of Ory - optimized builds of Ory's open source software with enterprise features, SLAs, and CVE patching for production and mission-critical environments. - [Ory Hydra (OAuth2) Quickstart](https://www.ory.com/docs/oel/hydra/quickstart) - [Distributed tracing](https://www.ory.com/docs/oel/hydra/tracing) - [Apply upgrades](https://www.ory.com/docs/oel/keto/guides/upgrade) - [Installation](https://www.ory.com/docs/oel/keto/install) - [Ory Keto Quickstart](https://www.ory.com/docs/oel/keto/quickstart) - [CSRF troubleshooting](https://www.ory.com/docs/oel/kratos/debug/csrf) - [Debugging Ory Kratos in Docker with Delve](https://www.ory.com/docs/oel/kratos/debug/debug-docker-delve-ory-kratos) - [Performance problems and out of memory panics caused by password hashing](https://www.ory.com/docs/oel/kratos/debug/performance-out-of-memory-password-hashing-argon2) - [General troubleshooting](https://www.ory.com/docs/oel/kratos/debug/troubleshooting) - [Install Ory Kratos with Ory Enterprise License](https://www.ory.com/docs/oel/kratos/install): Install the self-hosted Ory Kratos Enterprise License build and its required dependencies. - [Scalability](https://www.ory.com/docs/oel/kratos/scalability) ## Ory Open Source - [Changelog and roadmap](https://www.ory.com/docs/oss/changelog): Ory Changelog - [Ory is committed to open source](https://www.ory.com/docs/oss/commitment): Ory is fundamentally rooted in open source, its community dynamics, and development principles. Ory software is licensed under the - [Community resources](https://www.ory.com/docs/oss/community): Ory is possible because of a unique, experienced, and dedicated community. - [Configuration](https://www.ory.com/docs/oss/configuring): All Ory services share the same configuration system. This page documents the details and edge cases that apply to all Ory - [Contribute to Ory](https://www.ory.com/docs/oss/contributing): This document explains how you can contribute to Ory. - [Database](https://www.ory.com/docs/oss/deployment) - [Introduction to Ory Open Source](https://www.ory.com/docs/oss/getting-started): Ory Open Source is the Apache 2.0 licensed identity and access management software at the core of every Ory deployment - modular, self-hosted servers you run on your own infrastructure. - [End-to-end and integration tests](https://www.ory.com/docs/oss/guidelines/e2e-integration-tests) - [REST API Guidelines](https://www.ory.com/docs/oss/guidelines/rest-api-guidelines): This design document provides guidelines for specifying API documentation in Go Code using go-swagger, OpenAPI 3.0, and OpenAPI - [Distributed tracing](https://www.ory.com/docs/oss/hydra/tracing) - [Scalability](https://www.ory.com/docs/oss/kratos/scalability) - [Ory is open source](https://www.ory.com/docs/oss/open-source): This document provides an overview of the most popular Ory open source projects, and other related resources. - [Architecture principles](https://www.ory.com/docs/oss/software-architecture-philosophy): Ory's architecture is designed along several guiding principles: - [Product telemetry and privacy](https://www.ory.com/docs/oss/telemetry): To continuously improve reliability and performance, Ory collects a limited set of fully anonymized product telemetry. This page - [Versioning and upgrades](https://www.ory.com/docs/oss/upgrading): Upgrades ## Solutions - [Workforce IAM Solution](https://www.ory.com/docs/solutions/solution_workforce): Workforce IAM handles authentication and authorization for your internal users - employees, contractors, and partners who need - [Agentic IAM Solution](https://www.ory.com/docs/solutions/solution-agentic): Agentic IAM handles authentication and authorization for AI agents, autonomous software that acts on behalf of users or systems to - [B2B IAM Solution](https://www.ory.com/docs/solutions/solution-B2B): B2B IAM (Business-to-Business Identity and Access Management) handles authentication and authorization for applications where your - [CIAM IAM Solution](https://www.ory.com/docs/solutions/solution-CIAM): Ory abstracts away the complexity of secure authentication flows, session management, token handling, and credential storage. - [Solutions Overview](https://www.ory.com/docs/solutions/solutions-overview): Ory provides flexible identity and access management solutions for different use cases. Choose the solution that best fits your ## Security and compliance - [Compliance and certifications](https://www.ory.com/docs/security-compliance/compliance-and-certifications): Ory is dedicated to maintaining the highest standards of data security to protect the personal data stored on behalf of our - [GDPR compliance](https://www.ory.com/docs/security-compliance/gdpr): How Ory Network helps you to be GDPR compliant - [Landlock filesystem sandbox for Ory Identities](https://www.ory.com/docs/security-compliance/landlock-sandbox): Ory Identities (Kratos) uses the Linux Landlock LSM to restrict filesystem - [Personal data location and homing](https://www.ory.com/docs/security-compliance/personal-data-location): Ory Network is globally distributed for maximum resilience and minimum latency. Check out the - [Security policy](https://www.ory.com/docs/security-compliance/security): This security policy outlines the security support commitments for different types of Ory users. - [Identifiable token formats](https://www.ory.com/docs/security-compliance/token-formats): Ory is an open-source service that allows developers to secure their applications using different protocols such as OAuth 2.0, ## Getting started - [Custom UI](https://www.ory.com/docs/getting-started/custom-ui): Are you looking for an example on how to build a custom user interface for Ory Identities or the Ory Kratos Identity Server? Fork - [Integrate authentication into Auth.js and NextAuth](https://www.ory.com/docs/getting-started/integrate-auth/auth-js): This guide explains how to integrate Ory with Auth.js, a flexible authentication library for Next.js - [Integrate authentication into ASP.NET](https://www.ory.com/docs/getting-started/integrate-auth/dotnet): This guide shows how to create a simple ASP.NET application and secure it with - [Integrate authentication into Node.js / Express.js](https://www.ory.com/docs/getting-started/integrate-auth/expressjs): Create Express.js app - [Integrate authentication into Flutter Web](https://www.ory.com/docs/getting-started/integrate-auth/flutter-web-redirect): Create Flutter Web app - [Integrate authentication into Go](https://www.ory.com/docs/getting-started/integrate-auth/go): Create Go app - [Integrate authentication into Java + Spring Boot](https://www.ory.com/docs/getting-started/integrate-auth/java): This guide shows how to create a simple Java Spring Boot application and secure it with authentication powered by Ory. - [Next.js App Router Quickstart](https://www.ory.com/docs/getting-started/integrate-auth/nextjs-app-router-quickstart): This quickstart will guide you through the process of setting up Ory Elements with the App Router in a Next.js application. - [Next.js Pages Router Quickstart](https://www.ory.com/docs/getting-started/integrate-auth/nextjs-pages-router-quickstart): This quickstart will guide you through the process of setting up Ory Elements with the Pages Router in a Next.js application. - [Integrate authentication into PHP](https://www.ory.com/docs/getting-started/integrate-auth/php): Create PHP app - [Integrate authentication into React + API](https://www.ory.com/docs/getting-started/integrate-auth/react): Create React app - [Integrate Authentication into React Native](https://www.ory.com/docs/getting-started/integrate-auth/react-native): This guide shows how to create a simple React Native application and secure it with authentication powered by Ory. You can use - [Integrate authentication into Vue.js + API](https://www.ory.com/docs/getting-started/integrate-auth/vue): Create Vue.js app - [Develop applications on your local machine](https://www.ory.com/docs/getting-started/local-development): To create your first project on the Ory Network, install the Ory CLI: - [Add OAuth2 and OpenID Connect to your NodeJS / ExpressJS application](https://www.ory.com/docs/getting-started/oauth2-openid/add-oauth2-openid-connect-nodejs-expressjs): Adding OAuth2 to any application using the Ory Network is straight forward. This guide demonstrates how to write an app receiving - [OAuth2 authorization code and client credentials grants](https://www.ory.com/docs/getting-started/ory-network-oauth2): Ory OAuth2 & OpenID Connect (based on Ory Hydra) is available in the - [Quickstarts](https://www.ory.com/docs/getting-started/overview): Get started with Ory using the guides and examples that best match your use case. ## Guides - [Configure Ory Network IP addresses as allow list](https://www.ory.com/docs/guides/allowlist): To enhance your security measures while using the Ory Network, we've narrowed down the source IP addresses for all of our egress - [API REST Pagination](https://www.ory.com/docs/guides/api-rest-pagination): Pagination is a strategy that limits access to large datasets by dividing the data into manageable chunks or "pages." This - [Authentication](https://www.ory.com/docs/guides/authentication) - [Set up CORS for Ory Network](https://www.ory.com/docs/guides/cors): Cross-Origin Resource Sharing (CORS) is a mechanism to allow cross-origin requests. CORS is a relaxation of the same-origin policy - [Set up custom domains](https://www.ory.com/docs/guides/custom-domains): To use the Ory Network on one or more domains that you own, you can set a CNAME record. - [Email and SMS](https://www.ory.com/docs/guides/email-sms) - [Manage Ory Network configuration in git](https://www.ory.com/docs/guides/gitops): This guide will walk you through the process of managing your Ory Network configuration in Git using GitHub Actions. By following - [Trigger custom logic and integrate with external systems with webhooks](https://www.ory.com/docs/guides/integrate-with-ory-cloud-through-webhooks): Ory Actions supports webhooks, which are HTTP callbacks that can be triggered by specific events in your Ory-powered application. - [Load and performance testing](https://www.ory.com/docs/guides/load-performance-testing): Load testing, stress testing, and performance testing against Ory Network require prior written approval. Unauthorized load - [Manage Ory Network projects through the API](https://www.ory.com/docs/guides/manage-project-via-api): You can configure Ory Network projects using the Ory Console, as well as the - [OAuth2 and OpenID Connect](https://www.ory.com/docs/guides/oauth2-oidc) - [Console](https://www.ory.com/docs/guides/operations) - [Get started with Permissions in the Ory Network](https://www.ory.com/docs/guides/permissions/overview): Ory Permissions (based on Ory Keto) implements - [Ory Network rate limits](https://www.ory.com/docs/guides/rate-limits): Ory uses rate limits to protect your applications against abuse, attacks, and service disruptions, and to maintain fair resource - [Endpoint rate limits for Ory Network](https://www.ory.com/docs/guides/rate-limits-endpoint): Endpoint-based rate limits apply to individual API endpoints regardless of your project rate limits. They protect specific - [Project rate limits](https://www.ory.com/docs/guides/rate-limits-project): Each project has a set of rate limit buckets. A bucket is a named group of API endpoints that share the same rate limit threshold. - [Token management](https://www.ory.com/docs/guides/token-management) - [Upgrade your Ory SDKs to v1](https://www.ory.com/docs/guides/upgrade/sdk-v1): We are excited to announce the release of version 1.0 of Ory's Software Development Kits (SDKs) for all major languages. As part - [Implementing user impersonation securely](https://www.ory.com/docs/guides/user-impersonation): User impersonation is a security and administrative feature that allows authorized users (for example, system administrators or - [Ory Network Workspaces, Projects, and Environments](https://www.ory.com/docs/guides/workspaces): Ory Network has introduced two key concepts to simplify and streamline the management of multiple projects: Workspaces and ## Concepts - [Low latency with Edge Sessions](https://www.ory.com/docs/concepts/cache): Edge Sessions is a caching mechanism in Ory Network that's designed to ensure the lowest possible latency on the critical-path - [Password policy](https://www.ory.com/docs/concepts/password-policy): Password-based authentication flows are subject to frequent abuse through social engineering, password guessing and phishing - [Authorization with API Keys](https://www.ory.com/docs/concepts/personal-access-token): Ory Network Project APIs are separated into: - [Browser redirects and flow completion](https://www.ory.com/docs/concepts/redirects): This document covers browser redirects for Server Side Applications (Node.js, PHP, Golang etc.) and how to configure them. ## Integrations - [Integrations overview](https://www.ory.com/docs/integrations) ## Ory ecosystem - [API Design](https://www.ory.com/docs/ecosystem/api-design): This document provides a summary of Ory's REST design with topics like pagination and date formats. If you're interested in Ory's - [Ory Docs MCP Server](https://www.ory.com/docs/ecosystem/mcp): The Ory Docs MCP (Model Context Protocol) server gives AI assistants direct access to Ory documentation, enabling more accurate ## Account experience - [Account Experience Overview](https://www.ory.com/docs/account-experience): The Ory Account Experience is the default user interface for all self-service screens like login, registration, or consent. It can ## Actions - [HubSpot integration with Ory Actions](https://www.ory.com/docs/actions/integrations/hubspot): HubSpot is a CRM platform that can be used to manage data from marketing, sales, content management, - [Mailchimp integration with Ory Actions](https://www.ory.com/docs/actions/integrations/mailchimp): Mailchimp is an email marketing platform that provides tools and services to help businesses send - [Segment integration with Ory Actions](https://www.ory.com/docs/actions/integrations/segment): Segment is a customer data platform that helps businesses unify their customer data from multiple - [Live event streams](https://www.ory.com/docs/actions/live-events): You can stream events (sign-ups, logins, machine-to-machine tokens issued, and many more) in real-time, live as they happen in - [Notify previous addresses](https://www.ory.com/docs/actions/notify-previous-addresses): The notifypreviousaddresses action sends a notification to a user's previous email or phone addresses when they change a - [Address verification](https://www.ory.com/docs/actions/require-verified-address): Address verification ensures that a user’s email or phone number is valid and belongs to them. It helps prevent spam, ensures - [One active session per user](https://www.ory.com/docs/actions/revoke-active-sessions): The revokeactivesessions action is used to log out a user from all other active sessions. This ensures that every user has - [Sign in after registration](https://www.ory.com/docs/actions/session): The session action is used to sign in the user after they successfully registered. If the option to verify the email address - [Verify address changes](https://www.ory.com/docs/actions/verify-new-address): By default, when a user changes their email address or phone number in the settings flow, Ory applies the change immediately and ## API - [gRPC + REST API Overview](https://www.ory.com/docs/api): REST API - [Eventual consistency](https://www.ory.com/docs/api/eventual-consistency): Ory Network is a global, planet-spanning system with data distributed across numerous continents. To enhance query performance, ## Console - [Change a project or workspace owner](https://www.ory.com/docs/console/change-owner): In Ory Network, managing project ownership is sometimes required. Projects are typically part of a workspace, where you can easily - [Roles and permissions in the Ory Console](https://www.ory.com/docs/console/roles-and-permissions): The Ory Console uses role-based access control enforced through Ory Keto. Roles are assigned at two levels: workspace and project. - [Ory Console SSO](https://www.ory.com/docs/console/single-sign-on): Ory Console SSO is available on Ory Enterprise plans. - [Usage-based billing](https://www.ory.com/docs/console/usage-billing): Overview ## Debugging - [SMTP Courier address not settable](https://www.ory.com/docs/debug/smtp-courier-1): You tried setting the SMTP "from" address. This is only possible when you also supply your own SMTP server. Otherwise, the ## Ory Elements - [Ory Elements Introduction](https://www.ory.com/docs/elements): Overview - [CSS Reference](https://www.ory.com/docs/elements/css-reference): This document provides a reference for the CSS variables used in Ory Elements. You can use these variables to customize the look - [Quickstarts](https://www.ory.com/docs/elements/guides): Learn how to use Ory Elements in your application! - [Configuration](https://www.ory.com/docs/elements/guides/configuration): Ory Elements exposes a few configuration options that can be used to configure the default behavior of the UI components. These - [Submit and error events](https://www.ory.com/docs/elements/guides/events): Ory Elements emits events for form submission actions, including on success, on error, and on validation error. Your application - [Going to Production](https://www.ory.com/docs/elements/guides/going-to-production): Ory Elements is designed to be used in production environments. However, there are a few things you should consider when going to - [Use custom translations (i18n)](https://www.ory.com/docs/elements/guides/internationalization): Ory Elements supports internationalization (i18n) to help you create applications that can be used by users from different - [Use a custom theme](https://www.ory.com/docs/elements/guides/theming): Ory Elements allows you to customize the look and feel of the default UI components by using a custom theme. This guide will show - [Transient Payload passthrough](https://www.ory.com/docs/elements/guides/transient-payload): Transient payload is an Ory Kratos concept, that allows users of the APIs to pass data through to webhooks. All self-service - [Upgrade Ory Elements](https://www.ory.com/docs/elements/guides/upgrade): Ory Elements 1.1.0 to 1.2.0 upgrade guide ## HTTP API - [HTTP API Docs](https://www.ory.com/docs/http-api): Read the HTTP API reference documentation ## Ory Hydra - [When to use OAuth2](https://www.ory.com/docs/hydra/concepts/before-oauth2): OAuth2 is a popular authorization and consent protocol that has been widely adopted by developers to enable third-party - [Solutions for common OAuth2-related problems](https://www.ory.com/docs/hydra/debug): Spec-compliant OAuth 2.0 and OpenID Connect is hard. Let's take a look how to resolve certain issues. - [OAuth2 logout not working](https://www.ory.com/docs/hydra/debug/logout): Sometimes, calling /oauth2/sessions/logout doesn't behave as expected, for example: - [Client auth fails because Wrong token_endpoint_auth_method](https://www.ory.com/docs/hydra/debug/token-endpoint-auth-method): There are multiple ways of authenticating OAuth 2.0 Clients at the /oauth2/token: - [OAuth2 token audience](https://www.ory.com/docs/hydra/guides/audiences): There are two types of audience concepts in OAuth 2.0 and OpenID Connect: - [Customize claims with OAuth2 webhooks](https://www.ory.com/docs/hydra/guides/claims-at-refresh): You can modify aspects of the OpenID Connect and access tokens returned from Hydra's OAuth2 token endpoint. A typical use case is - [Configure OAuth2 & OpenID Connect expiration times](https://www.ory.com/docs/hydra/guides/client-token-expiration): This document describes how to configure the token expiration time for various tokens in Ory, including the user login and consent - [Using common OAuth2 and OpenID Connect flows](https://www.ory.com/docs/hydra/guides/common-oauth2-openid-connect-flows): Authorize Code Flow with Refresh Token - [Configuring cookies](https://www.ory.com/docs/hydra/guides/cookies): By default, cookies sent by Ory Hydra's API are set without explicitly specifying a SameSite mode. If you wish for these cookies - [Configure cross-origin resource sharing (CORS)](https://www.ory.com/docs/hydra/guides/cors): Ory services support cross-origin resource sharing (CORS). For the full schema, see the - [Try out custom OAuth2 login and consent](https://www.ory.com/docs/hydra/guides/custom-ui-oauth2): When using OAuth2 grants in Ory Network, you can use your custom UI implementation in place of the default screens supplied by the - [Graceful token refresh](https://www.ory.com/docs/hydra/guides/graceful-token-refresh): Graceful refresh token rotation is a feature in Ory OAuth2 and Ory Hydra that allows for a smoother transition during refresh - [JSON Web Token (JWT) profile for OAuth2](https://www.ory.com/docs/hydra/guides/jwt): JSON Web Token (JWT) for OAuth 2.0 Client Authentication and Authorization Grants is an extension to OAuth2 framework. It allows a - [Implementing the OIDC logout endpoint & UI](https://www.ory.com/docs/hydra/guides/logout): When using Ory OAuth2 and OpenID Connect, by default the logout operation is handled by the Ory Account Experience. Alternatively, - [Manage OAuth 2.0 and OpenID Connect clients](https://www.ory.com/docs/hydra/guides/oauth2-clients): OAuth2 clients are applications that securely authenticate with an authorization server to obtain access to an HTTP service. Every - [OAuth 2.0 token introspection](https://www.ory.com/docs/hydra/guides/oauth2-token-introspection): Token introspection is a mechanism for resource servers to obtain information about access tokens. With this specification, - [Subject anonymization](https://www.ory.com/docs/hydra/guides/openid): Ory OAuth2 and OpenID Connect offers two subject identifier algorithms: public and pairwise. These algorithms are used to - [Popular OAuth2 client libraries](https://www.ory.com/docs/hydra/guides/using-oauth2): Use open source & battle-tested libraries to consume OAuth2 and OpenID Connect: - [Cryptographic key management and JSON Web Key Sets (JWKS)](https://www.ory.com/docs/hydra/jwks): Cryptographic keys play a vital role in securing the transmission of sensitive information. In the context of Ory OAuth2 and - [Ory OAuth2 & OpenID Connect Go SDK](https://www.ory.com/docs/hydra/sdk/go): In this document you can find code examples for the Ory OAuth2 Go SDK. - [Ory OAuth2 & OpenID Connect JavaScript SDK](https://www.ory.com/docs/hydra/sdk/js): In this document you can find code examples for the Ory OAuth2 JavaScript SDK. - [Software Development Kit (SDK)](https://www.ory.com/docs/hydra/sdk/overview): The Ory Hydra SDK allows for integration with a self-hosted Ory Hydra OAuth2 Server. - [OAuth 2.0 security overview](https://www.ory.com/docs/hydra/security-architecture): Ory OAuth2 and OpenID Connect is a certified OAuth2 and OpenID Connect provider. It is based on the popular, secure, and widely - [Run Ory Hydra in Docker](https://www.ory.com/docs/hydra/self-hosted/configure-deploy): The goal of this chapter is to introduce you to a fully functional set up that includes Ory Hydra as well as our User Login & - [Database setup and configuration](https://www.ory.com/docs/hydra/self-hosted/dependencies-environment): Ory Hydra requires a database to store OAuth 2.0 clients, consent sessions, and access tokens. Choose between two operational - [Example deployment](https://www.ory.com/docs/hydra/self-hosted/deploy-hydra-example): This guide explains how to set up and run Ory Hydra in an exemplary production environment. It uses Postgres as database, Nginx as - [Gitlab Hydra integration](https://www.ory.com/docs/hydra/self-hosted/gitlab): Gitlab has several OAuth2 related features. The relevant here is the possibility to sign in to GitLab with (almost) any OAuth2 - [Ory Hydra Go](https://www.ory.com/docs/hydra/self-hosted/go): In this document you can find code examples for the Ory Hydra Go SDK. - [Hardware Security Module support for JSON Web Key sets](https://www.ory.com/docs/hydra/self-hosted/hsm-support): The - [Installation](https://www.ory.com/docs/hydra/self-hosted/install) - [JavaScript](https://www.ory.com/docs/hydra/self-hosted/js): In this document you can find code examples for the Ory Hydra JavaScript SDK. - [Kubernetes Helm Chart](https://www.ory.com/docs/hydra/self-hosted/kubernetes-helm-chart): The Ory Hydra Helm Chart helps you deploy Ory Hydra on Kubernetes using Helm. The source code is available on - [Merge multiple Hydra instances with different system.secrets](https://www.ory.com/docs/hydra/self-hosted/merge-multiple-db-secrets): Be advised that this can break client creation if done incorrectly! - [Guide to migrate from MITREid to Ory](https://www.ory.com/docs/hydra/self-hosted/migrating-from-mitreid): This page contains tips and tricks to move your current MITREid instance to Ory OAuth2 & OpenID. - [Prepare for production](https://www.ory.com/docs/hydra/self-hosted/production): Read this document to prepare for production when self-hosting Ory Hydra. - [Quickstart](https://www.ory.com/docs/hydra/self-hosted/quickstart): In this quickstart, you will set up Ory Hydra OAuth2 & OpenID Connect Server and an exemplary User Login & Consent App using - [Secrets and key rotation](https://www.ory.com/docs/hydra/self-hosted/secrets-key-rotation): There are two types of key rotation: - [SSL/TLS, HTTPS, self-signed certificates](https://www.ory.com/docs/hydra/self-hosted/ssl-https-tls): If you want to run Ory Hydra using self-signed TLS certificates, you can do the following: - [Apply upgrades](https://www.ory.com/docs/hydra/self-hosted/upgrade): Follow this guide when upgrading Ory Hydra to a newer version. ## Identities - [Introduction to Ory Kratos Identities](https://www.ory.com/docs/identities): Ory Kratos Identities is an API-first identity and user management system built on top of the widely deployed open-source - [Identity management guide - Day 1 essentials](https://www.ory.com/docs/identities/get-started): This guide shows how to implement basic authentication flows with Ory. It covers the essential setup and implementation details - [Account recovery](https://www.ory.com/docs/identities/get-started/account-recovery): Account recovery allows users to regain access to their accounts when they forget their passwords. This guide shows how to - [Multi-factor authentication](https://www.ory.com/docs/identities/get-started/mfa): This guide shows you how to enable multi-factor authentication (MFA) for your Ory project. - [Passwordless login](https://www.ory.com/docs/identities/get-started/passwordless): Passwordless login allows users to authenticate without using traditional passwords. This guide shows how to enable and configure - [Session](https://www.ory.com/docs/identities/get-started/session-management): After a user has logged in, Ory creates a session cookie that your application can use to verify the user's authentication status. - [Configure Ory](https://www.ory.com/docs/identities/get-started/setup): This guide shows how to set up the necessary dependencies and configurations to integrate Ory's identity management features into - [Implement user login](https://www.ory.com/docs/identities/get-started/sign-in): The sign in flow follows the same pattern as the sign up flow but instead of redirecting - [Implement User Logout](https://www.ory.com/docs/identities/get-started/sign-out): The logout flow allows users to securely terminate their sessions. This guide shows how to implement proper logout functionality - [Implement user sign up](https://www.ory.com/docs/identities/get-started/sign-up): This guide shows how to implement a secure sign up flow that authenticates users and creates sessions. - [Social sign-in](https://www.ory.com/docs/identities/get-started/social-sign-in): Social sign-in allows users to log in to your application using their existing accounts from providers like Google, GitHub, or - [Activate and de-activate identities](https://www.ory.com/docs/identities/model/activate-deactivate-user-login-state): The identity state determines whether an identity is active or not with the following states: - [Identity schema selection](https://www.ory.com/docs/identities/model/identity-schema-selection): Ory Kratos now supports selecting an identity schema during registration and login self-service flows by specifying a query - [Manage identity schemas](https://www.ory.com/docs/identities/model/manage-identity-schema): This document explains how to create, update, and manage identity schemas in Ory Network. - [Browser vs. native apps](https://www.ory.com/docs/identities/native-browser): Ory Identities supports both mobile (native) and browser applications. Because of the broad capabilities browsers offer, they pose - [Issue JWTs for Ory Sessions](https://www.ory.com/docs/identities/session-to-jwt-cors): Ory provides a robust session management system that uses cookies for browser clients and API tokens for API clients. It also - [Customize login and registration flows with webhooks and actions](https://www.ory.com/docs/identities/sign-in/actions): Customize login and registration behavior - [Check for user session status in browser cookies and session tokens](https://www.ory.com/docs/identities/sign-in/check-session-token-cookie-api): Ory stores session data in different ways for browser apps and native apps: - [Code submissions limit](https://www.ory.com/docs/identities/sign-in/code-submission-limit): A code is sent to a user controlled address (for example an email address) in some flows such as verification, recovery, - [Identifier first authentication](https://www.ory.com/docs/identities/sign-in/identifier-first-authentication): Identifier first authentication first requests the user's identifier such as an email or username before prompting for a password - [Display login hint for duplicate identifiers](https://www.ory.com/docs/identities/sign-in/login-hint): Login hints are enabled by default for newly created Ory Network Projects. - [saml](https://www.ory.com/docs/identities/sign-in/saml) - [Set custom domain as redirect URL](https://www.ory.com/docs/identities/sign-in/social-sign-in/redirect-url): Some Social Sign-in Providers such as Google or GitHub show the Redirect URL as part of the sign-in process. By default, Ory - [Two-step registration](https://www.ory.com/docs/identities/sign-in/two-step-registration): Identity traits are data associated with an identity ## Integrates with - [Skyfire AI-agent identity](https://www.ory.com/docs/integrates-with/agent-identity/skyfire): Pair Skyfire's AI-agent identity and payment verification with Ory to authenticate agents with verifiable identity and spend controls. - [Tetrate Agent Router Enterprise](https://www.ory.com/docs/integrates-with/agent-identity/tetrate): Pair Tetrate's enterprise AI gateway with Ory for dynamic, granular control over enterprise AI-agent traffic. - [Google Apigee API gateway](https://www.ory.com/docs/integrates-with/api-gateways/apigee): Validate Ory-issued JWTs at the gateway layer using Google Apigee's VerifyJWT policy and Ory's JWKS endpoint. - [AWS API Gateway](https://www.ory.com/docs/integrates-with/api-gateways/aws-api-gateway): Validate Ory-issued JWTs at AWS API Gateway using a Lambda authorizer or a native JWT authorizer. - [Envoy](https://www.ory.com/docs/integrates-with/api-gateways/envoy): Validate Ory-issued JWTs or Ory Identities sessions at the Envoy layer using its jwt_authn or ext_authz filters. - [Kong API Gateway](https://www.ory.com/docs/integrates-with/api-gateways/kong): Validate Ory OAuth2 access tokens and Ory Identities sessions at Kong Gateway using its JWT and session plugins. - [Traefik API gateway](https://www.ory.com/docs/integrates-with/api-gateways/traefik): Validate Ory sessions at Traefik with the ForwardAuth middleware, or front it with Ory Oathkeeper for richer rules. - [Amplitude integration](https://www.ory.com/docs/integrates-with/cdp-analytics/amplitude): Send Ory authentication events directly to Amplitude's HTTP V2 API without a webhook handler. - [Mixpanel integration](https://www.ory.com/docs/integrates-with/cdp-analytics/mixpanel): Send Ory authentication events directly to Mixpanel's Ingestion API without a webhook handler. - [mParticle integration](https://www.ory.com/docs/integrates-with/cdp-analytics/mparticle): Send Ory identity events to mParticle's Events API, which fans them out to downstream analytics and marketing destinations. - [Running Ory on AWS](https://www.ory.com/docs/integrates-with/cloud-infrastructure/aws): Reference patterns for connecting AWS applications to Ory Network and self-hosting Ory on EKS. - [Running Ory on Microsoft Azure](https://www.ory.com/docs/integrates-with/cloud-infrastructure/azure): Reference patterns for connecting Azure applications to Ory Network and self-hosting Ory on AKS. - [Running Ory on Google Cloud](https://www.ory.com/docs/integrates-with/cloud-infrastructure/gcp): Reference patterns for connecting Google Cloud applications to Ory Network and self-hosting Ory on GKE. - [Drata compliance evidence collection](https://www.ory.com/docs/integrates-with/compliance-audit/drata): Configure Drata to pull identity and access management evidence from the Ory Admin API for automated compliance collection. - [Vanta compliance evidence collection](https://www.ory.com/docs/integrates-with/compliance-audit/vanta): Configure Vanta to pull identity and access management evidence from the Ory Admin API for automated compliance collection. - [Didomi consent management](https://www.ory.com/docs/integrates-with/consent-privacy/didomi): Sync Didomi consent state into Ory identity metadata and fulfill data-subject requests through the Ory Admin API. - [OneTrust consent and privacy](https://www.ory.com/docs/integrates-with/consent-privacy/onetrust): Sync Ory identities with OneTrust profiles and consume consent webhooks to surface consent state on Ory identities. - [Osano consent and DSAR management](https://www.ory.com/docs/integrates-with/consent-privacy/osano): Sync Osano consent state into Ory identity metadata and handle data-subject requests through the Ory Admin API. - [Running Ory with Docker](https://www.ory.com/docs/integrates-with/containerization/docker): Run the open-source Ory stack locally or in CI using the official Docker images for Kratos, Hydra, Keto, and Oathkeeper. - [Running Ory on Kubernetes (raw manifests)](https://www.ory.com/docs/integrates-with/containerization/kubernetes): Deploy the open-source Ory stack on Kubernetes using raw manifests without Helm, useful for GitOps workflows. - [Microsoft Dynamics 365 CRM](https://www.ory.com/docs/integrates-with/crm/microsoft-dynamics-365): Sync Ory identities to Dynamics 365 Contact records through the Dataverse Web API using an Ory Actions webhook. - [Pipedrive](https://www.ory.com/docs/integrates-with/crm/pipedrive): Sync Ory identities to Pipedrive persons and log login activity to their timeline via Ory Actions webhooks. - [Salesforce (CRM)](https://www.ory.com/docs/integrates-with/crm/salesforce): Sync Ory identities to Salesforce as Leads or Contacts via Ory Actions webhooks using OAuth2 authentication. - [Zoho CRM](https://www.ory.com/docs/integrates-with/crm/zoho-crm): Sync Ory Network contacts to Zoho CRM through Ory Actions webhooks, upserting Zoho Contacts keyed by email. - [Self-hosted Ory on CockroachDB](https://www.ory.com/docs/integrates-with/data-persistence/cockroachdb): Use CockroachDB, a distributed PostgreSQL-compatible SQL database, as a backend for self-hosted Ory deployments. - [BambooHR directory sync](https://www.ory.com/docs/integrates-with/directory-sync/bamboohr): Syncs BambooHR employee lifecycle events to Ory Network as identity create, update, and disable operations. - [Workday SCIM](https://www.ory.com/docs/integrates-with/directory-sync/workday-scim): Keeps Ory's identity store in sync with Workday, the source of truth for enterprise employee data. - [Akamai EdgeWorkers : Ory token validation](https://www.ory.com/docs/integrates-with/edge-token-validation/akamai-edgeworkers): Validate Ory Network session tokens and JWTs at the Akamai edge using the EdgeWorkers serverless runtime. - [Cloudflare Workers : Ory token validation at the edge](https://www.ory.com/docs/integrates-with/edge-token-validation/cloudflare-workers): Validate Ory Network session tokens and JWTs at the Cloudflare edge so invalid requests never reach origin. - [Fastly Compute@Edge : Ory token validation](https://www.ory.com/docs/integrates-with/edge-token-validation/fastly-compute): Validate Ory Network session tokens and JWTs at the Fastly edge using the WASM-based Compute@Edge runtime. - [CyberArk Identity](https://www.ory.com/docs/integrates-with/enterprise-sso/cyberark-identity): Configure CyberArk Identity's SAML 2.0 and OIDC endpoints as an enterprise SSO provider for Ory Polis. - [ForgeRock Access Management](https://www.ory.com/docs/integrates-with/enterprise-sso/forgerock-am): Configure ForgeRock Access Management as an OIDC or SAML 2.0 enterprise SSO provider for Ory Polis. - [HID Global Identity Services](https://www.ory.com/docs/integrates-with/enterprise-sso/hid-global): Configure HID Global's SAML 2.0 or OIDC endpoints as a certificate-based enterprise SSO provider for Ory Polis. - [IBM Security Verify](https://www.ory.com/docs/integrates-with/enterprise-sso/ibm-security-verify): Configure IBM Security Verify's OIDC and SAML 2.0 endpoints as an enterprise SSO provider for Ory Polis. - [Keycloak](https://www.ory.com/docs/integrates-with/enterprise-sso/keycloak): Configure the open-source Keycloak IAM server as an OIDC or SAML 2.0 enterprise SSO provider for Ory Polis. - [LaunchDarkly feature flags](https://www.ory.com/docs/integrates-with/feature-flags/launchdarkly): Pass Ory identity attributes to LaunchDarkly as multi-kind contexts so feature rollouts can target by identity attribute. - [Split.io feature flags](https://www.ory.com/docs/integrates-with/feature-flags/split-io): Pass Ory identity attributes to the Split.io SDK so feature rollouts can target by identity. - [Arkose Labs bot protection](https://www.ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs): Protect Ory registration and login flows with Arkose Labs bot detection and adaptive enforcement challenges. - [Castle account-takeover protection](https://www.ory.com/docs/integrates-with/fraud-bot-protection/castle): Protect Ory flows with Castle device fingerprinting, behavioral analytics, and per-event risk scoring. - [Cloudflare Turnstile CAPTCHA](https://www.ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile): Protect Ory registration and login flows with Cloudflare Turnstile, a non-interactive CAPTCHA alternative. - [hCaptcha](https://www.ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha): Protect Ory registration and login flows with hCaptcha, a privacy-focused, GDPR-compliant CAPTCHA service. - [Google reCAPTCHA](https://www.ory.com/docs/integrates-with/fraud-bot-protection/recaptcha): Protect Ory registration and login flows with Google reCAPTCHA v2, v3, or Enterprise challenges. - [Sift Digital Trust & Safety](https://www.ory.com/docs/integrates-with/fraud-bot-protection/sift): Protect Ory flows with Sift real-time, ML-based fraud and account-abuse scoring. - [Sign in with Aadhaar](https://www.ory.com/docs/integrates-with/government-identity/aadhaar): Integrate India's UIDAI-administered Aadhaar biometric identity through a licensed eKYC provider that brokers UIDAI access. - [Sign in with BankID](https://www.ory.com/docs/integrates-with/government-identity/bankid): Integrate Sweden and Norway's high-assurance BankID electronic identity via an OIDC broker configured in Ory Identities. - [Sign in with eIDAS](https://www.ory.com/docs/integrates-with/government-identity/eidas): Enable cross-border use of EU national electronic IDs through a commercial eIDAS broker configured as an OIDC provider. - [Sign in with iDIN](https://www.ory.com/docs/integrates-with/government-identity/idin): Integrate the Dutch banks' iDIN identity verification service via an OIDC broker to get bank-verified attributes. - [Pulumi infrastructure-as-code with Ory](https://www.ory.com/docs/integrates-with/iac-devops/pulumi): Manage Ory Network with Pulumi by bridging the Terraform provider or calling the REST API from a dynamic resource. - [Manage Ory Network with Terraform](https://www.ory.com/docs/integrates-with/iac-devops/terraform): Manage Ory Network resources as infrastructure-as-code with the official ory/ory Terraform provider. - [Equifax identity verification](https://www.ory.com/docs/integrates-with/identity-verification/equifax): Run US-focused Equifax identity verification, fraud, and credit checks from an Ory Actions webhook during registration. - [GBG (Acuant) identity verification](https://www.ory.com/docs/integrates-with/identity-verification/gbg-acuant): Verify document and biometric evidence with GBG's global GO Journey API from an Ory Actions webhook to gate registration. - [ID.me verified identity](https://www.ory.com/docs/integrates-with/identity-verification/id-me): Configure ID.me as a federated OIDC provider for US-government-trusted IAL2/AAL2 identity assurance and verified group claims. - [Jumio](https://www.ory.com/docs/integrates-with/identity-verification/jumio): Start Jumio document, selfie, and face-match verification from Ory Actions and gate sign-in on the stored status. - [LexisNexis InstantID](https://www.ory.com/docs/integrates-with/identity-verification/lexisnexis): Run LexisNexis InstantID database-backed identity verification synchronously from Ory Actions and gate sign-in on the result. - [Onfido](https://www.ory.com/docs/integrates-with/identity-verification/onfido): Run Onfido document, biometric, and database verification workflows from Ory Actions and gate sign-in on the status. - [Persona](https://www.ory.com/docs/integrates-with/identity-verification/persona): Run a Persona Inquiry for document, selfie, and watchlist checks from Ory Actions and gate sign-in on the status. - [Prove](https://www.ory.com/docs/integrates-with/identity-verification/prove): Use Prove's phone-anchored identity signals from Ory Actions for prefill, enrollment, and per-login validation. - [Socure identity verification](https://www.ory.com/docs/integrates-with/identity-verification/socure): Run Socure's ML-based identity verification and fraud signals from an Ory Actions webhook using sync and async paths. - [Duo Security as a second factor](https://www.ory.com/docs/integrates-with/mfa/duo-security): Wire Duo Security's workforce MFA as an Ory Actions webhook that runs a Duo Auth API check as a second factor. - [Okta Verify as a second factor](https://www.ory.com/docs/integrates-with/mfa/okta-verify): Wire Okta Verify's mobile MFA as an Ory Actions webhook that runs an Okta Factors API check as a second factor. - [Datadog](https://www.ory.com/docs/integrates-with/monitoring-observability/datadog): Monitor Ory in Datadog using the native Datadog tracer for self-hosted or OpenTelemetry export for Ory Network. - [New Relic OTel ingestion](https://www.ory.com/docs/integrates-with/monitoring-observability/new-relic): Ingest Ory traces and metrics into New Relic over OpenTelemetry OTLP/HTTP. - [OpenTelemetry](https://www.ory.com/docs/integrates-with/monitoring-observability/opentelemetry): Export Ory traces, metrics, and logs over OTLP using native OpenTelemetry support for self-hosted and Ory Network. - [Prometheus + Grafana](https://www.ory.com/docs/integrates-with/monitoring-observability/prometheus-grafana): Scrape Ory metrics from each service's Prometheus-compatible endpoint and visualize them in Grafana. - [Recurly integration](https://www.ory.com/docs/integrates-with/payment-billing/recurly): Sync Ory identities with Recurly by creating accounts at sign-up and surfacing subscription state on the identity. - [Stripe integration](https://www.ory.com/docs/integrates-with/payment-billing/stripe): Create Stripe Customer records at sign-up and consume subscription webhooks to keep state on the Ory identity. - [Elastic SIEM](https://www.ory.com/docs/integrates-with/siem-security-analytics/elastic-siem): Ingest Ory authentication events into Elastic SIEM mapped to the Elastic Common Schema for security analytics. - [Microsoft Sentinel](https://www.ory.com/docs/integrates-with/siem-security-analytics/microsoft-sentinel): Ingest Ory identity events into Microsoft Sentinel through the Log Analytics or Logs Ingestion API. - [Splunk](https://www.ory.com/docs/integrates-with/siem-security-analytics/splunk): Ingest Ory authentication events directly into Splunk through the HTTP Event Collector with no webhook handler. - [Sumo Logic](https://www.ory.com/docs/integrates-with/siem-security-analytics/sumo-logic): Ingest Ory authentication events into Sumo Logic through an HTTP Source with no webhook handler needed. - [WhatsApp Business OTP courier](https://www.ory.com/docs/integrates-with/sms-providers/whatsapp): Use the WhatsApp Business Cloud API as the OTP delivery channel for Ory Identities verification, recovery, and MFA flows. - [Sign in with Battle.net](https://www.ory.com/docs/integrates-with/social-sign-in/battle-net): Configure Blizzard's Battle.net as an OAuth2 social sign-in provider in Ory Network for gaming use cases. - [Sign in with Epic Games](https://www.ory.com/docs/integrates-with/social-sign-in/epic-games): Configure Epic Games OAuth2 and OIDC sign-in as a social sign-in provider in Ory Network for gaming apps. - [Sign in with a GitHub App](https://www.ory.com/docs/integrates-with/social-sign-in/github-app): Let users sign in with a GitHub App for fine-grained per-repository permissions and JWT-based server-to-server auth. - [Sign in with Kakao](https://www.ory.com/docs/integrates-with/social-sign-in/kakao): Add Kakao, South Korea's dominant messaging platform, as an OAuth 2.0 social sign-in provider in Ory. - [Sign in with Naver](https://www.ory.com/docs/integrates-with/social-sign-in/naver): Add Naver, South Korea's largest search portal, as an OAuth 2.0 social sign-in provider in Ory. - [Sign in with Steam](https://www.ory.com/docs/integrates-with/social-sign-in/steam): Bridge Steam's OpenID 2.0 sign-in to Ory Identities via an OIDC proxy for gaming platforms. - [Sign in with Telegram](https://www.ory.com/docs/integrates-with/social-sign-in/telegram): Authenticate users with the Telegram Login Widget's hash-signed payload and mint an Ory session via the Admin API. - [Sign in with TikTok](https://www.ory.com/docs/integrates-with/social-sign-in/tiktok): Add TikTok Login Kit as a generic OAuth 2.0 provider in Ory Identities with explicit endpoints. - [Sign in with WeChat](https://www.ory.com/docs/integrates-with/social-sign-in/wechat): Integrate WeChat Login, the dominant Chinese super-app, with Ory Identities through an OIDC proxy pattern. - [Freshdesk](https://www.ory.com/docs/integrates-with/support-helpdesk/freshdesk): Sync Ory identities into Freshdesk Contacts so support agents see identity context when handling tickets. - [Intercom](https://www.ory.com/docs/integrates-with/support-helpdesk/intercom): Sync Ory identities into Intercom Contacts to make chat, support, and lifecycle messaging identity-aware. - [Zendesk](https://www.ory.com/docs/integrates-with/support-helpdesk/zendesk): Sync Ory identities into Zendesk Users with Ory Actions so support agents have identity context. - [Clearbit (HubSpot Breeze Intelligence)](https://www.ory.com/docs/integrates-with/user-enrichment/clearbit): Enrich Ory identities with Clearbit (now HubSpot Breeze Intelligence) person and company data at registration. - [FullContact](https://www.ory.com/docs/integrates-with/user-enrichment/fullcontact): Enrich Ory identities with FullContact person and company data after registration. - [ZoomInfo](https://www.ory.com/docs/integrates-with/user-enrichment/zoominfo): Enrich Ory identities with ZoomInfo B2B contact and company data after registration. - [Hookdeck webhook reliability](https://www.ory.com/docs/integrates-with/webhook-infrastructure/hookdeck): Route Ory Network Actions through Hookdeck for reliable webhook ingestion, retries, replay, and observability. - [Svix webhook infrastructure](https://www.ory.com/docs/integrates-with/webhook-infrastructure/svix): Use Svix to fan out Ory identity events as signed outbound webhooks to your own customers' subscriptions. ## Ory Keto - [Introduction to Ory Keto Permissions](https://www.ory.com/docs/keto): Ory Permissions is a modern permission system you can use to create a complete authorization system for your application or - [Ory Permissions API overview](https://www.ory.com/docs/keto/concepts/api-overview): This page gives an overview of Ory Permissions APIs including common use cases. - [Graph of relations](https://www.ory.com/docs/keto/concepts/graph-of-relations): The relationships of the access control list used by Ory Permissions can be represented as a graph of - [Namespaces in Ory Permissions](https://www.ory.com/docs/keto/concepts/namespaces): In Ory Permissions, namespaces fulfill two purposes: - [Objects in Ory Permissions](https://www.ory.com/docs/keto/concepts/objects): Objects are identifiers of entities in an application. For example, objects can represent files, network ports, or physical items. - [Relationships in Ory Permissions](https://www.ory.com/docs/keto/concepts/relation-tuples): Relationships are the underlying datatype of Ory Permissions. They encode relations between objects, which are - [Subjects in Ory Permissions](https://www.ory.com/docs/keto/concepts/subjects): In Ory Keto subjects are a recursive polymorphic datatype. They refer to specific subjects by an identifier defined by the - [File sharing example](https://www.ory.com/docs/keto/examples/file-sharing-example): A basic, down-to-earth full feature example - [Expand API: display who has access to an object](https://www.ory.com/docs/keto/guides/expand-api-display-who-has-access): This guide will explain how to use Ory Keto's expand-API to display who has access to an object, and why. Please refer to the - [List API: display all objects a user has access to](https://www.ory.com/docs/keto/guides/list-api-display-objects): In this guide you will learn how to use Ory Keto's list API to display a list of all objects (for example files, ...) a user has - [Migrating policies from 0.5 to 0.6](https://www.ory.com/docs/keto/guides/migrating-legacy-policies): The 0.6 release of Ory Keto makes Ory Access Control Policy DSL modeled after AWS IAM Policies obsolete. This guide will help you - [Migrating from subject IDs to subject sets](https://www.ory.com/docs/keto/guides/migrating-to-subject-sets): Early versions of Ory Permissions allowed writing tuples where the subject was a plain string with no namespace - for example - [Prepare for production](https://www.ory.com/docs/keto/guides/production): Read this document to prepare for production when self-hosting Ory Keto. - [Role Based Access Control (RBAC)](https://www.ory.com/docs/keto/guides/rbac): Role-based access control (RBAC) is useful when users should receive permissions through roles instead of assigning permissions to - [How to integrate permission checks to your application](https://www.ory.com/docs/keto/guides/simple-access-check-guide): In this guide you will learn how Ory Permissions fits into your architecture and how to integrate it into your application. - [Strict mode for Ory Permissions](https://www.ory.com/docs/keto/guides/strict-mode): What is strict mode? - [Migrating to Keto v0.7](https://www.ory.com/docs/keto/guides/v0.7-migration): Ory Keto v0.6 used the table-separated namespaces database schema described in the - [How to create a permission model with Ory Permission Language](https://www.ory.com/docs/keto/modeling/create-permission-model): This section guides you through creating your first permission model using the Ory Permission Language (OPL). - [Ory Permissions Go SDK](https://www.ory.com/docs/keto/sdk/go): In this document you can find code examples for the Ory Permissions Go SDK. - [Software Development Kit (SDK)](https://www.ory.com/docs/keto/sdk/overview): The Ory Keto SDK allows for integration with a self-hosted Ory Keto Permission Server. - [Ory Permissions Python SDK](https://www.ory.com/docs/keto/sdk/python): In this document you can find code examples for the Ory Permissions Python SDK. - [Go](https://www.ory.com/docs/keto/self-hosted/go): In this document you can find code examples for the Ory Keto Go SDK. ## Ory Kratos - [Configure Ory to use your UI](https://www.ory.com/docs/kratos/bring-your-own-ui/configure-ory-to-use-your-ui): To define the paths where Ory calls your custom UI, go to . This view allows you to define the - [Advanced integration](https://www.ory.com/docs/kratos/bring-your-own-ui/custom-ui-advanced-integration): This document goes into detail on advanced topics in specific use cases after you have already integrated a basic user interface. - [Basic information you need to integrate your UI with Ory](https://www.ory.com/docs/kratos/bring-your-own-ui/custom-ui-basic-integration): Ory provides headless APIs for ease of integration. This ensures that Ory is compatible with software stacks across different - [Custom UI overview](https://www.ory.com/docs/kratos/bring-your-own-ui/custom-ui-overview): Ory is designed to allow you to use custom user interfaces (UI) for browser and native applications thanks to simple-to-use - [Decision guide: Custom vs. Built-in UI](https://www.ory.com/docs/kratos/bring-your-own-ui/custom-vs-built-in-ui): Ory provides multiple options for integrating user interfaces (UI) with your applications. This guide helps you decide when to use - [HTTP redirection configuration](https://www.ory.com/docs/kratos/concepts/browser-redirect-flow-completion): Self-Service flows such as Login, Registration, Updating Settings support two successful response modes: - [Credentials](https://www.ory.com/docs/kratos/concepts/credentials): Each identity has one or more credentials associated with it: - [Login and registration using passwords](https://www.ory.com/docs/kratos/concepts/credentials/username-email-password): The combination of identifier (username, email, phone number) and password is the oldest and most common way to authenticate users - [Threat models and security profiles](https://www.ory.com/docs/kratos/concepts/security): Threat modeling is essential for securing a system like Ory Identities. This document provides guidelines for identifying and - [ui-messages](https://www.ory.com/docs/kratos/concepts/ui-messages): Sign in (1010001) - [Understanding UI nodes and error messages](https://www.ory.com/docs/kratos/concepts/ui-user-interface): UI payloads - [Configure Ory Kratos](https://www.ory.com/docs/kratos/configuring): This document describes how the service can be configured. For a documentation on all configuration values head over to the - [Customize message templates for Ory Identity emails](https://www.ory.com/docs/kratos/emails-sms/custom-email-templates): Ory Identities comes with built-in templates for all messages sent by the system. You can replace the default templates with - [Email delivery configuration](https://www.ory.com/docs/kratos/emails-sms/sending-emails-smtp): The Ory Network provides a default SMTP server for sending emails. Ory emails are sent from this address: - [Send SMS to your users](https://www.ory.com/docs/kratos/emails-sms/sending-sms): Ory Network comes with an HTTP based SMS delivery option that can be configured to point to any service that supports sending SMS - [Cookie settings](https://www.ory.com/docs/kratos/guides/configuring-cookies): When working with cookies, keep the following in mind: - [Deploy to production](https://www.ory.com/docs/kratos/guides/deploy-kratos-example): This guide explains how to set up and run Ory Kratos in an exemplary production environment. It uses Postgres as database, Nginx - [Ory Kratos Docker images](https://www.ory.com/docs/kratos/guides/docker): Images are published on Docker Hub as oryd/kratos with these tags: - [End-to-end and integration tests](https://www.ory.com/docs/kratos/guides/e2e-integration-tests): We run integration tests for both the Node.js and - [Host your own breached password detection API](https://www.ory.com/docs/kratos/guides/hosting-own-have-i-been-pwned-api): Ory Kratos uses the Have I Been Pwned (HiBP) API, with the k-anonymity flag, to check if the password the user registers with has - [Set up HTTPS (TLS)](https://www.ory.com/docs/kratos/guides/https-tls): If you want to run Ory Kratos using self-signed TLS certificates, you can do the following: - [Advanced base URL, CSRF and session cookie settings](https://www.ory.com/docs/kratos/guides/multi-domain-cookies): This document describes advanced strategies for multi-domain environments and other scenarios. - [Multitenancy](https://www.ory.com/docs/kratos/guides/multi-tenancy-multitenant): To set up Ory Kratos for multiple tenants, you have two options: - [Normalize phone numbers to E.164](https://www.ory.com/docs/kratos/guides/normalize-phone-numbers): Ory Kratos normalizes phone numbers to E.164 format when they're used as identifiers, - [Go to production](https://www.ory.com/docs/kratos/guides/production): Read this document to prepare for production when self-hosting Ory Kratos. - [Secret and Key Rotation](https://www.ory.com/docs/kratos/guides/secret-key-rotation): Ory Kratos needs secrets that are used for encrypting, decrypting, generating and validating signatures, and other cryptographic - [Cipher algorithm settings](https://www.ory.com/docs/kratos/guides/select-cipher-algorithm): Currently, the Ory Identities (Kratos) supports encryption and decryption for OIDC tokens only. You can choose one of these - [Cross-origin resource sharing (CORS) settings](https://www.ory.com/docs/kratos/guides/setting-up-cors): Ory Kratos' Public API supports CORS out of the box. A reference for this configuration can be found in the - [Argon2 password hashing parameters](https://www.ory.com/docs/kratos/guides/setting-up-password-hashing-parameters): Ory Kratos supports password hashing using Argon2 in the Argon2id variant. It's important to set up it's parameters to ensure a - [Distributed tracing](https://www.ory.com/docs/kratos/guides/tracing): Configuring Distributed Tracing (DT) will enable you to obtain a visualization of the call paths that take place in order to - [Zero Trust with Access Proxy guide](https://www.ory.com/docs/kratos/guides/zero-trust-iap-proxy-identity-access-proxy): The Quickstart covers a basic set up that uses client-side routing in SecureApp to forward requests to Ory - [Ory Actions](https://www.ory.com/docs/kratos/hooks/configure-hooks): Ory Actions are an extensibility mechanism provided by the Ory Network that allows you to integrate with third-party services: - [Initiate account recovery for a user](https://www.ory.com/docs/kratos/manage-identities/account-recovery): You can initiate account recovery for users using the admin API endpoints. You can initiate the flow even for users that don't - [Best practices for creating secure and functional accounts for your users](https://www.ory.com/docs/kratos/manage-identities/best-practices): Follow this guide to learn about best practices when creating custom identity schemas. - [Learn how to create accounts for users](https://www.ory.com/docs/kratos/manage-identities/create-users-identities): The goal of this flow is to create an identity and provide the end user with a way of signing in and setting their password (or - [Learn how to customize Ory identity schemas](https://www.ory.com/docs/kratos/manage-identities/customize-identity-schema): This document explains how to customize your identity model with a custom identity schema. A custom identity schema allows you to - [Learn how to delete user accounts and let users delete their own account](https://www.ory.com/docs/kratos/manage-identities/delete-users-identities): Ory Identities doesn't expose account deletion as a self-service flow, to prevent users from accidentally and irrecoverably - [Learn how to export Ory identities](https://www.ory.com/docs/kratos/manage-identities/export-user-accounts-identities): Ory Identities allows you to export identities including their hashed credentials using the include_credential attribute on the - [External Identifiers](https://www.ory.com/docs/kratos/manage-identities/external-id): This guide explains how to configure and use the external_id field in Ory Kratos to support external primary identifiers such as - [Identity schema - the model that defines the data that makes up user accounts](https://www.ory.com/docs/kratos/manage-identities/identity-schema): The identity schema implements the JSON Schema Standard and allows you to adjust Ory specifically to - [Learn how to import user accounts from other systems to Ory](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities): Ory allows you to import identities from any other system. To import identities, you use the same endpoint as for - [Learn how to invite users to Ory-powered applications](https://www.ory.com/docs/kratos/manage-identities/invite-users): If your application must be accessible only to a hand-picked group of specific individuals, and you don't want to make - [Learn about the types of data that make up user accounts in Ory](https://www.ory.com/docs/kratos/manage-identities/managing-users-identities-metadata): Identities have traits and metadata: - [What is an identity in Ory?](https://www.ory.com/docs/kratos/manage-identities/overview): Identities are sets of data that describe humans that sign up on a website or an application, for example online store customers, - [SCIM](https://www.ory.com/docs/kratos/manage-identities/scim): SCIM (System for Cross-domain Identity Management) is a standard for automating the exchange of user identity information between - [SCIM API reference](https://www.ory.com/docs/kratos/manage-identities/scim/api-reference): This page is a reference for the Ory Network SCIM server API. It describes the base URL and authentication, every available - [Provision from Google Workspace](https://www.ory.com/docs/kratos/manage-identities/scim/google-workspace): This page guides you through setting up SCIM provisioning from Google Workspace to Ory Network. Also refer to the Google Workspace - [Provision from MS Entra](https://www.ory.com/docs/kratos/manage-identities/scim/ms-entra): This page guides you through setting up SCIM provisioning from Microsoft Entra to Ory Network. - [Provision from Okta](https://www.ory.com/docs/kratos/manage-identities/scim/okta): This page guides you through setting up SCIM provisioning from Okta to Ory Network. Also refer to the - [Advanced identity search via API](https://www.ory.com/docs/kratos/manage-identities/search/identity-search-api): Advanced identity search allows you to perform full-text search on identity traits, public and admin metadata, combined with - [Identity search in Ory Console](https://www.ory.com/docs/kratos/manage-identities/search/identity-search-console): Search for identities by navigating to . - [Organizations](https://www.ory.com/docs/kratos/organizations): Organizations are a way to group users within one project. An organization always belongs to one Ory project. Within a project, an - [Quickstart](https://www.ory.com/docs/kratos/quickstart): Ory Kratos has several moving parts and getting everything right from the beginning can be challenging. This getting started guide - [Ory Identity Management Go SDK](https://www.ory.com/docs/kratos/sdk/go): In this document you can find code examples for the Ory Identities Go SDK. - [Software Development Kit (SDK)](https://www.ory.com/docs/kratos/sdk/overview): The Ory Kratos SDK allows for integration with a self-hosted Ory Kratos Identity Server. - [HTTP based email delivery](https://www.ory.com/docs/kratos/self-hosted/email-http): To send emails using an external mail provider instead of a local SMTP server, Ory Kratos can use an HTTP API (such as Mailchimp, - [Go](https://www.ory.com/docs/kratos/self-hosted/go): In this document you can find code examples for a self-hosted Ory Kratos Go SDK. - [Mail courier in self-hosted Ory Kratos](https://www.ory.com/docs/kratos/self-hosted/mail-courier-selfhosted): This document describes the behaviors and requirements of the mail courier that are applicable only when running a self-hosted - [Email templates in self-hosted Ory Kratos](https://www.ory.com/docs/kratos/self-hosted/mail-courier-templates): Configuration - [Configure multi-factor authentication in Ory Kratos](https://www.ory.com/docs/kratos/self-hosted/mfa): Enforce MFA - [Configure SMS message courier](https://www.ory.com/docs/kratos/self-hosted/sms-messages): For sending SMS, Ory Kratos uses an external SMS gateway, which must have HTTP API (such as Twilio, your local SMS sender, or your - [Self-service flows](https://www.ory.com/docs/kratos/self-service): Ory Identities implements flows that users perform themselves as opposed to administrative intervention. Facebook and Google both - [Recover access to accounts and perform password reset](https://www.ory.com/docs/kratos/self-service/flows/account-recovery-password-reset): Account recovery allows registered users to regain access to their account if they forget their password or lose access to the - [CAPTCHA challenge](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA): Ory Identities supports protecting self-service flows with CAPTCHA challenges. This is useful to prevent credential stuffing, - [User-facing errors](https://www.ory.com/docs/kratos/self-service/flows/user-facing-errors): Because Ory Kratos doesn't render User Interfaces, we implemented a flow that allows you to implement the error page in any way - [Login](https://www.ory.com/docs/kratos/self-service/flows/user-login): Please read the Self-Service Flows overview before continuing with this document. - [Logout](https://www.ory.com/docs/kratos/self-service/flows/user-logout): The logout flow is used to terminate an Ory Identities session. Ory provides logout on all supported clients: - [Registration](https://www.ory.com/docs/kratos/self-service/flows/user-registration): Please read the Self-Service Flows overview before continuing with this document. - [Settings and profile updates](https://www.ory.com/docs/kratos/self-service/flows/user-settings): Please read the Self-Service Flows overview before continuing with this document. - [Verify addresses associated with users accounts](https://www.ory.com/docs/kratos/self-service/flows/verify-email-account-activation): Ory allows users to verify email addresses or phone numbers associated with their accounts. This is important to prove that the - [List, revoke, and get sessions as user or admin](https://www.ory.com/docs/kratos/session-management/list-revoke-get-sessions): Sessions can be managed by: - [Overview of sessions, Ory Session Cookies, and Ory Session Tokens](https://www.ory.com/docs/kratos/session-management/overview): When a user authenticates, for example by signing in with their username and password, they receive a session. The session is - [Refresh sessions](https://www.ory.com/docs/kratos/session-management/refresh-extend-sessions): For certain use cases, sessions need to be refreshed on user activity or administrative action. - [Revoke other active user sessions after changing the password](https://www.ory.com/docs/kratos/session-management/revoke-sessions-hook): In certain use cases, it is important to increase security by terminating active user sessions when they change their password. To - [Adjusting user session lifespan in Ory](https://www.ory.com/docs/kratos/session-management/session-lifespan): Each session is valid for a set amount of time. This time is the session's lifespan. When the session lifespan expires, the user - [Add Amazon as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/amazon): To add Amazon as a social sign-in provider, you need a Amazon Developer account. Go to - [Add Apple as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/apple): To add Apple as a social sign-in provider, you need an Apple Developer account. Go to - [Add Auth0 as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/auth0): Follow these steps to add Auth0 as a social sign-in provider to your project using the Ory Console: - [Learn how to map data from social sign-in providers to Ory identity traits](https://www.ory.com/docs/kratos/social-signin/data-mapping): Every social sign-in provider returns different data in their payloads. Some providers use usernames, others emails, and so on. - [Add DingTalk as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/dingtalk): Follow these steps to add DingTalk as a social sign-in provider to your project using the Ory CLI: - [Add Discord as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/discord): Discord doesn't implement OpenID Connect. Ory makes a request to - [Add Facebook as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/facebook): To add Facebook as a social sign-in provider, you need a Facebook Developer account. Go to - [Federated Credential Management (FedCM)](https://www.ory.com/docs/kratos/social-signin/fedcm): Overview - [Add any OpenID Connect certified social sign-in provider to your Ory project](https://www.ory.com/docs/kratos/social-signin/generic): The "Generic Provider" option allows you to add any OpenID Connect-certified provider that doesn't require custom API calls to get - [Learn how to get OIDC/OAuth 2.0 access, refresh, and ID tokens issued by social sign-in providers](https://www.ory.com/docs/kratos/social-signin/get-tokens): You can get the OIDC / OAuth 2.0 access, refresh, and ID tokens issued for the identity by social sign-in providers. - [Add GitHub as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/github): Troubleshooting - [Add GitLab as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/gitlab): Troubleshooting - [Add Google as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/google): To add Google as a social sign-in provider, you need a Google Developer account. Go to - [Add lark as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/lark): Follow these steps to add Lark as a social sign-in provider to your project using the Ory CLI: - [Add LINE as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/line): Next you will need to create a LINE application and configure it to work with Ory. Here's how you can do that: - [Manage social login providers linked to user accounts](https://www.ory.com/docs/kratos/social-signin/link-multiple-provider-account): Ory supports four types of account linking: - [Add LinkedIn as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/linkedin): Troubleshooting - [Add Microsoft as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/microsoft): To add Microsoft as a social sign-in provider, you need an Azure account with an active subscription. Follow - [Social sign-in for native and mobile apps](https://www.ory.com/docs/kratos/social-signin/native-apps): Overview - [Add NetID as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/netid): Troubleshooting - [PKCE for Social Sign-in and B2B SSO](https://www.ory.com/docs/kratos/social-signin/oidc-pkce): Ory Identities supports the PKCE (Proof Key for Code Exchange) extension to the OpenID - [Add Ory OAuth2 or Ory Hydra as a social sign-in provider](https://www.ory.com/docs/kratos/social-signin/ory): This document explains how to add Ory OAuth2 as an OIDC provider to your Ory Network project. - [Set up social sign-in and connect with OAuth2 and OpenID Connect providers](https://www.ory.com/docs/kratos/social-signin/overview): Out of the box, Ory comes with custom-tailored connectors for 15+ social sign-in providers such as GitHub, Google, or Facebook. - [Add Patreon as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/patreon): Follow these steps to add Patreon as a social sign-in provider to your project using the Ory CLI: - [Add Salesforce as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/salesforce): Follow these steps to add Salesforce as a social sign-in provider to your project using the Ory Console: - [Add Slack as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/slack): Troubleshooting - [Add Spotify as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/spotify): Troubleshooting - [Add Twitch as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/twitch): Follow these steps to add Twitch as a social sign-in provider to your project using the Ory CLI: - [Add UAE PASS as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/uaepass): UAE PASS is the UAE's official digital identity platform. It allows UAE nationals, residents, and visitors - [Carry over upstream multi-factor authentication](https://www.ory.com/docs/kratos/social-signin/upstream-mfa): Your project can enforce AAL2 through step-up - [Add VKontakte as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/vk): Follow these steps to add VKontakte as a social sign-in provider to your project using the Ory CLI: - [Add X / Twitter as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/x-twitter): Next you will need to create a Twitter application and configure it to work with Ory. Here's how you can do that: - [Add Yandex as a social sign-in provider in Ory](https://www.ory.com/docs/kratos/social-signin/yandex): Follow these steps to add Yandex as a social sign-in provider to your project using the Ory CLI: ## Migrate to Ory - [Understand your current IAM system](https://www.ory.com/docs/migrate-to-ory/migrate): Before you can migrate smoothly, you need a complete picture of how your identity management system works today. This step ensures - [Migrate user identities from Auth0 to Ory](https://www.ory.com/docs/migrate-to-ory/migrate-from-auth0): This guide shows you how to migrate user accounts from Auth0 to Ory. The instructions in this document assume that your Auth0 - [Create an Ory Network project](https://www.ory.com/docs/migrate-to-ory/migrate/create-project): Now that you have chosen your migration strategy, you can begin the actual migration process. Perform the migration in a - [Design your identity schema](https://www.ory.com/docs/migrate-to-ory/migrate/design-id-schema): To align identities from your current system with Ory, you can customize the identity schema to meet your specific requirements. - [Go live](https://www.ory.com/docs/migrate-to-ory/migrate/go-live): After successfully migrating your data and testing the integration in your development or staging environment, it's time to go - [Integrate your backend](https://www.ory.com/docs/migrate-to-ory/migrate/integrate-backend): When the frontend makes an API call to your backend, it will include the necessary cookies. Your backend must then forward these - [Integrate your frontend](https://www.ory.com/docs/migrate-to-ory/migrate/integrate-frontend): To make authenticated API calls using Ory, start by properly configuring your domain and subdomains. By default the cookie domain - [Map your existing functionality to Ory Network capabilities](https://www.ory.com/docs/migrate-to-ory/migrate/map-to-orycap): Using your list of identity-related flows, create a side-by-side table to map existing functionality to Ory Network’s equivalent - [Migrate your existing identities](https://www.ory.com/docs/migrate-to-ory/migrate/migrate-identities): With authentication now set up on your frontend and backend, the next step is to prepare your existing user identities for - [Choose your IAM migration strategy](https://www.ory.com/docs/migrate-to-ory/migrate/migrate-strategies): This section covers two aspects of migrating to Ory: transferring user identities and rolling out IAM functionality to your - [Understand your current identity management system](https://www.ory.com/docs/migrate-to-ory/migrate/migrate-to-ory): Below are example IAM scenarios supported by Ory Network. Use them to identify which scenario best fits your specific IAM needs - [Test and validate your integration](https://www.ory.com/docs/migrate-to-ory/migrate/test-validate): Before going live with your Ory Network integration, thorough testing across multiple environments is essential to ensure your ## Ory Oathkeeper - [Introduction to Ory Oathkeeper Zero Trust Proxy](https://www.ory.com/docs/oathkeeper): Ory Oathkeeper authorizes incoming HTTP requests. It can be the Policy Enforcement Point in your cloud architecture, i.e. a - [API access rules](https://www.ory.com/docs/oathkeeper/api-access-rules): Ory Oathkeeper reaches decisions to allow or deny access by applying Access Rules. Access Rules can be stored on the file system, - [Configure and deploy](https://www.ory.com/docs/oathkeeper/configure-deploy): The Ory Oathkeeper HTTP serve process oathkeeper serve opens two ports exposing the - [gRPC middleware](https://www.ory.com/docs/oathkeeper/grpc-middleware): In addition to exposing Ory Oathkeeper as a HTTP proxy, you can directly embed it into your Go application as a gRPC middleware. - [Define WebSockets rules](https://www.ory.com/docs/oathkeeper/guides/proxy-websockets): This guide shows how to use Ory Oathkeeper with WebSockets. - [Request path normalization and validation](https://www.ory.com/docs/oathkeeper/guides/request-path-security): Ory Oathkeeper decides whether to allow a request by matching its URL path against your access rules. - [Traefik proxy integration](https://www.ory.com/docs/oathkeeper/guides/traefik-proxy-integration): Traefik is modern HTTP proxy and load balancer for microservices, oathkeeper can be integrated - [Upgrade Ory Oathkeeper OSS](https://www.ory.com/docs/oathkeeper/guides/upgrade): Follow this guide when you upgrade Ory Oathkeeper OSS to a newer version. Upgrade to the latest version for the newest features, - [Installation](https://www.ory.com/docs/oathkeeper/install) - [Connect to Ory Hydra OAuth2 Token introspection](https://www.ory.com/docs/oathkeeper/oauth2-token-introspection-hydra): This document is a work in progress. - [Access rule pipeline](https://www.ory.com/docs/oathkeeper/pipeline): Read more about the principal components and execution pipeline of access rules if you haven't already. - [Authenticators](https://www.ory.com/docs/oathkeeper/pipeline/authn): An authenticator is responsible for authenticating request credentials. Ory Oathkeeper supports different authenticators and we - [Authorizers](https://www.ory.com/docs/oathkeeper/pipeline/authz): An "authorizer" is responsible for properly permissioning a subject. Ory Oathkeeper supports different kinds of authorizers. The - [Error handlers](https://www.ory.com/docs/oathkeeper/pipeline/error): A error handler is responsible for executing logic after, for example, authentication or authorization failed. Ory Oathkeeper - [Mutators](https://www.ory.com/docs/oathkeeper/pipeline/mutator): A mutator transforms the credentials from incoming requests to credentials that your backend understands. For example, the - [Software Development Kit (SDK)](https://www.ory.com/docs/oathkeeper/sdk): The Ory Oathkeeper SDK allows for integration with Ory Oathkeeper. ## OAuth 2.0 and OpenID Connect - [Introduction to Ory Hydra OAuth2](https://www.ory.com/docs/oauth2-oidc): OAuth2 is the industry-standard protocol that enables secure machine-to-machine communication and grants limited access to data - [OAuth2 authorization code flow](https://www.ory.com/docs/oauth2-oidc/authorization-code-flow): OAuth2 and OpenID Connect are widely used authorization and authentication delegation protocols that enable secure access to APIs - [OAuth2 client credentials flow](https://www.ory.com/docs/oauth2-oidc/client-credentials): OAuth2 is a protocol that allows third-party applications to access a user's data, without having to expose their credentials to - [User login and consent flow](https://www.ory.com/docs/oauth2-oidc/custom-login-consent/flow): This guide will walk you through the process of customizing Ory OAuth2 and OpenID Connect to work with your user database, login - [Device Authorization](https://www.ory.com/docs/oauth2-oidc/device-authorization): The OAuth 2.0 Device Authorization Grant (RFC 8628) brings OAuth to devices with internet connectivity but limited input - [Identity Provider Integration Settings](https://www.ory.com/docs/oauth2-oidc/identity-provider-integration-settings): Overview - [Change the OAuth2 issuer URL](https://www.ory.com/docs/oauth2-oidc/issuer-url): When your OAuth2 or OpenID Connect client complains that the issuer URL is incorrect, this can have the following reasons: - [Opaque and JWT access tokens](https://www.ory.com/docs/oauth2-oidc/jwt-access-token): JSON Web Tokens (JWTs) are a widely used format for representing claims securely between parties. They can be used as access - [OpenID Connect logout](https://www.ory.com/docs/oauth2-oidc/oidc-logout): Ory OAuth2 and OpenID Connect allows you to implement: - [Customize OpenID Connect scope and claims](https://www.ory.com/docs/oauth2-oidc/openid-connect-claims-scope-custom): In this document you will learn how OpenID Connect scope and claims work with Ory OAuth2 and OpenID Connect. It will also cover - [An overview of OAuth2 concepts and use cases](https://www.ory.com/docs/oauth2-oidc/overview/oauth2-concepts): OAuth2 is an authorization framework that enables applications to access user accounts on an HTTP service. This document describes - [OpenID Connect overview](https://www.ory.com/docs/oauth2-oidc/overview/oidc-concepts): OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. At its core, it allows an application to securely - [OAuth2 refresh token grant](https://www.ory.com/docs/oauth2-oidc/refresh-token-grant): In OAuth2 and OpenID Connect (OIDC) protocols, access tokens and ID tokens have an expiration time. When the token expires, the - [OAuth2 resource owner password credentials grant](https://www.ory.com/docs/oauth2-oidc/resource-owner-password-grant): The OAuth 2.0 Resource Owner Password Credentials Grant is an OAuth 2.0 grant where the application exchanges the user's username - [Revoke user consent](https://www.ory.com/docs/oauth2-oidc/revoke-consent): You can revoke user consent on a per-application basis, or for all applications to which the user granted their consent. - [Skip consent and logout consent](https://www.ory.com/docs/oauth2-oidc/skip-consent): In first-party scenarios, you may want to skip the consent screen and automatically grant consent to the client. This can be done - [OpenID Connect userinfo endpoint](https://www.ory.com/docs/oauth2-oidc/userinfo-oidc): The OpenID Connect (OIDC) userinfo endpoint is a protected resource that provides information about a user when a service provider - [OAuth2.0 & OpenID Connect well-known endpoint discovery](https://www.ory.com/docs/oauth2-oidc/wellknown-endpoint-discovery): There are two types of well-known discovery endpoints. The OAuth2.0 and the OpenID Connect (OIDC) discovery endpoints. Both ## Ory Polis - [Ory Polis enterprise single sign-on](https://www.ory.com/docs/polis): Configure enterprise SSO with SAML and OpenID Connect identity providers using Ory Polis. - [Get started with Admin Portal](https://www.ory.com/docs/polis/admin-portal): Ory Polis comes with an Admin Portal that allows you to manage Enterprise SSO, Directory Sync and Setup Links products - [Manage Directory Sync with admin portal](https://www.ory.com/docs/polis/admin-portal/directory-sync): On the Admin Portal Directory Sync menu, you can see the Directory connections. - [Manage Enterprise SSO with admin portal](https://www.ory.com/docs/polis/admin-portal/enterprise-sso): On the Admin Portal Enterprise SSO menu, you can see the SSO Connections details. - [Guides](https://www.ory.com/docs/polis/admin-portal/guides) - [Setup links Directory Sync](https://www.ory.com/docs/polis/admin-portal/setup-links-directory-sync): The Setup link is used to create a shareable link that can be used to create an Directory Sync without exposing any sensitive - [Setup Links for Ory Polis](https://www.ory.com/docs/polis/admin-portal/setup-links-enterprise-sso): Setup link to create a SSO Connection - [Container Signing and Verification](https://www.ory.com/docs/polis/container-signing): Ory Polis container images are signed and can be verified using cosign. - [Environment Variables](https://www.ory.com/docs/polis/deploy/env-variables): The env vars are only applicable to the Ory Polis service. If you are using the npm library then look for the options below when - [Pre-loaded SSO Connections](https://www.ory.com/docs/polis/deploy/pre-loaded-connections): SAML - [Directory Sync](https://www.ory.com/docs/polis/directory-sync): Directory sync helps organizations automate the provisioning and de-provisioning of their users. It is based on the System for - [Directory Sync API Reference](https://www.ory.com/docs/polis/directory-sync/api-reference): The following guides provide information about the APIs and SDKs that are available for the Directory Sync service. - [Directory Sync Webhook Events](https://www.ory.com/docs/polis/directory-sync/events): Ory Polis uses webhooks to notify your application any time changes are made to directory, users, groups, and memberships. - [Examples and Resources for Directory Sync](https://www.ory.com/docs/polis/directory-sync/examples): Examples - [Faq](https://www.ory.com/docs/polis/directory-sync/faq): Frequently asked questions about the common issues and limitations of the directory sync providers. - [Guides](https://www.ory.com/docs/polis/directory-sync/guides) - [Implement Directory Sync (SCIM) to your Express.js App using Ory Polis](https://www.ory.com/docs/polis/directory-sync/guides/express): This guide will teach you to implement SCIM Provisioning in your Express.js app. - [Implement Directory Sync (SCIM) to your Next.js App using Ory Polis](https://www.ory.com/docs/polis/directory-sync/guides/nextjs): This guide will teach you to implement SCIM Provisioning in your Next.js app. - [Observability for Directory Sync](https://www.ory.com/docs/polis/directory-sync/observability): Ory Polis provides first-class observability on the back of OpenTelemetry. Currently we support the following metrics. Traces and - [Directory providers](https://www.ory.com/docs/polis/directory-sync/providers) - [Microsoft Azure Entra ID SCIM v2.0](https://www.ory.com/docs/polis/directory-sync/providers/azure): The following guide will walk you through the process of configuring Ory Polis to use the Microsoft Entra ID SCIM v2.0 directory - [Google Workspace Directory](https://www.ory.com/docs/polis/directory-sync/providers/google): Google Workspace SCIM support is pretty minimal, so we directly tap into their APIs to give you the full benefit of SCIM-like - [jumpcloud](https://www.ory.com/docs/polis/directory-sync/providers/jumpcloud): The following guide will walk you through the process of configuring Ory Polis to use the JumpCloud SCIM v2.0 directory provider. - [Okta SCIM v2.0](https://www.ory.com/docs/polis/directory-sync/providers/okta): The following guide will walk you through the process of configuring Ory Polis to use the Okta as a directory sync provider. - [OneLogin SCIM v2.0](https://www.ory.com/docs/polis/directory-sync/providers/onelogin): The following guide will walk you through the process of configuring Ory Polis to use the OneLogin SCIM v2.0 directory provider. - [Quickstart](https://www.ory.com/docs/polis/directory-sync/quickstart): There are two ways to integrate the Directory Sync within your application: - [Directory sync webhooks](https://www.ory.com/docs/polis/directory-sync/webhooks): A webhook is an HTTP request, triggered by an event in a source system and sent to a destination system (Eg: your app), often with - [Enterprise SSO Webhook Events](https://www.ory.com/docs/polis/events): Ory Polis uses webhooks to notify your application any time changes are made to the connections. We'll notify you of the following - [UI Best Practices for Configuring SAML Single Sign-On](https://www.ory.com/docs/polis/guides/configuring-saml-sso): This guide aims to give you some ideas about configuring the SAML SSO for your tenants and the best practices you can follow while - [Deploy Enterprise SSO on Heroku](https://www.ory.com/docs/polis/guides/deployment/heroku): This guide will walk you through the configuration and deployment of Ory Polis on Heroku. We'll be using the Deploy to Heroku - [Deploy Enterprise SSO on Vercel](https://www.ory.com/docs/polis/guides/deployment/vercel): This guide will walk you through the configuration and deployment of Ory Polis on Vercel. We'll be using the Vercel Deploy - [Examples & Resources](https://www.ory.com/docs/polis/guides/examples): Examples - [Add SAML SSO to AdonisJS App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/adonis): This guide assumes that you have a AdonisJS app and want to enable SAML Single Sign-On authentication for your enterprise - [Add SAML SSO to Django App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/django): This guide assumes that you have a Django app and want to enable SAML Single Sign-On authentication for your enterprise customers. - [Add SAML SSO to Express.js App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/express): This guide assumes that you have a Express.js app and want to enable SAML Single Sign-On authentication for your enterprise - [Add SAML SSO to Laravel App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/laravel): This guide assumes that you have a Laravel app and want to enable SAML Single Sign-On authentication for your enterprise - [Add SAML SSO to Next.js App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/nextjs): This guide assumes that you have a Next.js app and want to enable SAML Single Sign-On authentication for your enterprise - [Add SAML SSO to Ruby on Rails App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/rails): This guide assumes that you have a Ruby on Rails app and want to enable SAML Single Sign-On authentication for your enterprise - [Add SAML SSO to React App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/react): This guide assumes that you have a React app and want to enable SAML Single Sign-On authentication for your enterprise customers. - [Add SAML SSO to Remix App with BoxyHQ](https://www.ory.com/docs/polis/guides/frameworks/remix): Let's look at how to authenticate users in a remix app using Enterprise Single-Sign-On (SSO). - [UI Best Practices for Log in with SAML Single Sign-On](https://www.ory.com/docs/polis/guides/login-with-saml-sso): Let's see how enterprise apps have implemented the SAML SSO into their authentication flow. - [Embedded quickstart](https://www.ory.com/docs/polis/guides/npm-library): Ory Polis is available as an npm package that can be integrated into any - [Service quickstart](https://www.ory.com/docs/polis/guides/service): Health Check - [Getting Started with Ory Polis](https://www.ory.com/docs/polis/install): This guide will help you to setup and run Ory Polis in development mode. - [Observability for Enterprise SSO](https://www.ory.com/docs/polis/observability): Ory Polis provides first-class observability on the back of OpenTelemetry. Currently we support the following metrics. Traces and - [Quickstart](https://www.ory.com/docs/polis/quickstart): Ory Polis can be used with any web application to integrate Single Sign-On (SSO) authentication. - [SAML Federation](https://www.ory.com/docs/polis/saml-federation): SAML Federation is an enterprise feature and you need to have an enterprise license to use this feature. - [Software Bill Of Materials (SBOM) Reports](https://www.ory.com/docs/polis/sbom): SBOM is a list of components in a piece of software. It is like a list - [Security](https://www.ory.com/docs/polis/security): In general most OAuth 2.0 security guidelines apply to Ory Polis as well but there are a few minor differences. - [Single Sign-On](https://www.ory.com/docs/polis/sso-flow): Ory Polis takes a multi-tenanted approach to implementing SSO, abstracting away all the complexities of the underlying SAML/OIDC - [Example flow](https://www.ory.com/docs/polis/sso-flow/example-flow): Let's say you have a customer acme.com who is using two of your SaaS offerings. For now let's call them: - [SAML SSO Providers](https://www.ory.com/docs/polis/sso-providers): Ory Polis supports the following SSO providers: - [Set up your own custom SAML application for Auth0 SAML](https://www.ory.com/docs/polis/sso-providers/auth0): In this section, we will show you how to set up your own custom SAML application for Auth0 SAML. - [Set up your own custom SAML application for Microsoft Entra ID SAML](https://www.ory.com/docs/polis/sso-providers/azure): In this section, we will show you how to set up your own custom SAML application for Microsoft Entra ID SAML. - [Set up app in your OpenID Connect Identity Provider](https://www.ory.com/docs/polis/sso-providers/generic-oidc): To allow apps or clients to login using an OIDC Identity Provider, we must register an application with the IdP. The process might - [Set up your own custom SAML application for a Generic IdP](https://www.ory.com/docs/polis/sso-providers/generic-saml): This guide explains the settings you’d need to use to configure SAML with your Identity Provider. Once this is set up you should - [Set up your own custom SAML application for Google SAML](https://www.ory.com/docs/polis/sso-providers/google): In this section, we will show you how to set up your own custom SAML application for Google SAML. - [Set up your own custom SAML application for JumpCloud SAML](https://www.ory.com/docs/polis/sso-providers/jumpcloud): In this section, we will show you how to set up your own custom SAML application for JumpCloud SAML. - [Set up your own custom SAML application for Microsoft AD FS](https://www.ory.com/docs/polis/sso-providers/microsoft-adfs): In this section, we will show you how to set up your own custom SAML application for Microsoft AD FS. - [Set up your own custom SAML application for Okta SAML](https://www.ory.com/docs/polis/sso-providers/okta): In this section, we will show you how to set up your own custom SAML application for Okta SAML. - [Set up your own custom SAML application for OneLogin SAML](https://www.ory.com/docs/polis/sso-providers/onelogin): In this section, we will show you how to set up your own custom SAML application for OneLogin SAML. - [Set up your own custom SAML application for PingOne SAML](https://www.ory.com/docs/polis/sso-providers/pingone): In this section, we will show you how to set up your own custom SAML application for PingOne SAML. - [Set up your own custom SAML application for Rippling SAML](https://www.ory.com/docs/polis/sso-providers/rippling): This section will show you how to set up your own custom SAML application for Rippling SAML. - [Upgrade](https://www.ory.com/docs/polis/upgrade): Upgrading to v1.44.0 ## Products - [Ory products, ecosystem, and architecture](https://www.ory.com/docs/products/products-overview): Ory's identity and access management platform is modular; each product handles a specific capability, and you combine them based ## SDK - [Software Development Kits (SDKs) for Ory](https://www.ory.com/docs/sdk): The Ory SDK allows for integration with Ory services, including Ory Identities, Ory Permissions, and Ory OAuth2. - [Ory Network SDK Reference](https://www.ory.com/docs/sdk/new): Index of REST operations from the generated OpenAPI docs, grouped by tag. ## Security model - [Cookie-based security model](https://www.ory.com/docs/security-model): Ory Identities supports both mobile (native) and browser applications. Because of the broad capabilities browsers offer, they pose ## Self-hosted - [Common CSRF pitfalls](https://www.ory.com/docs/self-hosted/hydra/debug/csrf): Same-site in Chrome - [Social sign-in](https://www.ory.com/docs/self-hosted/kratos/configuration/oidc): Follow these steps to add a social sign-in provider when self-hosting Ory Kratos. - [Passwords settings](https://www.ory.com/docs/self-hosted/kratos/configuration/password): To enable or disable passwords, update your configuration file: - [Introduction to Ory Enterprise License](https://www.ory.com/docs/self-hosted/oel): The Ory Enterprise License (OEL) is a commercial license designed for businesses and organizations that rely on Ory's open-source - [High-performance database connection pooling](https://www.ory.com/docs/self-hosted/oel/high-performance-pooling): High-performance pooling is available for CockroachDB and PostgreSQL with an Ory Enterprise License (OEL). It provides additional - [Changelog for Ory Keto OEL](https://www.ory.com/docs/self-hosted/oel/keto/changelog) - [Configuration file](https://www.ory.com/docs/self-hosted/oel/keto/configuration) - [Changelog for Ory Kratos OEL](https://www.ory.com/docs/self-hosted/oel/kratos/changelog): 2025-07-25 - [Configuration file](https://www.ory.com/docs/self-hosted/oel/kratos/configuration) - [Upgrade Ory Kratos OEL to a newer version](https://www.ory.com/docs/self-hosted/oel/kratos/upgrade): Follow this guide when you upgrade Ory Kratos Enterprise License (OEL) to a newer version. Upgrade to the latest version for the - [Monitoring](https://www.ory.com/docs/self-hosted/oel/monitoring): This guide presents exemplary monitoring configuration that will work with OEL applications. - [Changelog for Ory Oathkeeper OEL](https://www.ory.com/docs/self-hosted/oel/oathkeeper/changelog): 2025-05-08 - [Configuration file](https://www.ory.com/docs/self-hosted/oel/oathkeeper/configuration) - [Upgrade Ory Oathkeeper OEL to a newer version](https://www.ory.com/docs/self-hosted/oel/oathkeeper/upgrade-oathkeeper): Follow this guide when you upgrade Ory Oathkeeper Enterprise License (OEL) to a newer version. Upgrade to the latest version for - [Changelog for Ory Hydra OEL](https://www.ory.com/docs/self-hosted/oel/oauth2/changelog): 2025-06-11 - [Configuration file](https://www.ory.com/docs/self-hosted/oel/oauth2/configuration) - [Migrate to Ory Hydra OEL from Self-Hosted Ory Hydra](https://www.ory.com/docs/self-hosted/oel/oauth2/migrate): This guide outlines the steps to upgrade from self-hosted Ory Hydra to Ory Hydra Enterprise License (OEL). Upgrading to OEL - [PostgreSQL TTL jobs for Hydra OEL](https://www.ory.com/docs/self-hosted/oel/oauth2/migrate-postgresql-ttl): This guide outlines the steps to enable and configure the PostgreSQL TTL jobs for Ory Hydra. The TTL jobs are executed - [Revert database migrations](https://www.ory.com/docs/self-hosted/oel/oauth2/revert-database-migrations): This guide outlines the steps to revert a database migration in Ory Hydra using the custom jobs functionality provided in the Ory - [Stateless JWT access tokens](https://www.ory.com/docs/self-hosted/oel/oauth2/stateless-jwt): This document explains how to configure stateless JWT access tokens in Ory Hydra. When enabled, JWT access tokens are issued as - [Custom OAuth2 token prefix](https://www.ory.com/docs/self-hosted/oel/oauth2/token-prefix): This document explains how to configure the token prefix for OAuth2 access tokens, refresh tokens, and authorization codes. By - [Upgrade Ory Hydra OEL to a newer version](https://www.ory.com/docs/self-hosted/oel/oauth2/upgrade): This document provides a comprehensive guide on how to upgrade your Ory Hydra Enterprise License (OEL) version. Upgrading to the - [Changelog for Ory Polis OEL](https://www.ory.com/docs/self-hosted/oel/polis/changelog): 2025-07-28 - [Quickstart](https://www.ory.com/docs/self-hosted/oel/quickstart): The Ory Hydra Enterprise license includes additional features and support for enterprise customers: - [API access control](https://www.ory.com/docs/self-hosted/operations/api-access-control): If you have ideas how to improve this document, please open an issue. - [Logs and audit trails](https://www.ory.com/docs/self-hosted/operations/logging): Log output is sent to stdout/stderr. There is no option to change the log destination. You should use bash pipes instead, for - [Observability](https://www.ory.com/docs/self-hosted/operations/observability): Prometheus - [Scalability](https://www.ory.com/docs/self-hosted/operations/scalability): Ory services are running in high-scale production environments that handle millions of requests per day. To scale Ory, spin up - [Distributed tracing](https://www.ory.com/docs/self-hosted/operations/tracing): Configuring Distributed Tracing (DT) will enable you to obtain a visualization of the call paths that take place in order to ## Ory Talos - [Ory Talos](https://www.ory.com/docs/talos): Ory Talos is an API key management service. It handles the full lifecycle of API credentials: issuing keys, verifying them, - [Concepts](https://www.ory.com/docs/talos/concepts): How Ory Talos works, from credential types to the security model. - [Architecture](https://www.ory.com/docs/talos/concepts/architecture): Ory Talos is an API credential service. It issues and verifies API keys, derives short-lived JWT and macaroon tokens from those - [Caching and consistency](https://www.ory.com/docs/talos/concepts/caching): Talos caches verification results to reduce database load and improve latency. The OSS edition ships a no-op cache. In-memory and - [Credential types](https://www.ory.com/docs/talos/concepts/credential-types): Compare the four Ory Talos credential types - issued and imported API keys, derived JWTs, and derived macaroons - and pick the right one for your use case. - [IP restrictions](https://www.ory.com/docs/talos/concepts/ip-restrictions): CIDR-based allowlists that restrict which client IPs can use an API key - [Rate limiting](https://www.ory.com/docs/talos/concepts/rate-limiting): Per-key rate limit policies with metadata-only (OSS) or server-side enforcement (Commercial) - [Security model](https://www.ory.com/docs/talos/concepts/security-model): How Ory Talos protects credentials with keyed hashing, signed tokens, and tenant isolation - [Token format](https://www.ory.com/docs/talos/concepts/token-format): Issued API keys use a versioned format: - [Integrate](https://www.ory.com/docs/talos/integrate): Add API key authentication to your application - [Batch operations](https://www.ory.com/docs/talos/integrate/batch-operations): Verify and import multiple credentials in a single request - [Derive tokens](https://www.ory.com/docs/talos/integrate/derive-tokens): Mint short-lived JWT or macaroon tokens from API keys - [Error handling](https://www.ory.com/docs/talos/integrate/error-handling): Error response format, error codes, and retry logic - [Import existing keys](https://www.ory.com/docs/talos/integrate/import-keys): Import API keys from external systems into Ory Talos - [IP restrictions](https://www.ory.com/docs/talos/integrate/ip-restrictions): Restrict API key usage to specific IP addresses or CIDR ranges - [Issue and verify API keys](https://www.ory.com/docs/talos/integrate/issue-and-verify): Issue API keys and verify them through the admin endpoints - [Key lifecycle](https://www.ory.com/docs/talos/integrate/key-lifecycle): Update, rotate, and revoke API keys - [Rate limiting](https://www.ory.com/docs/talos/integrate/rate-limiting): Attach and enforce rate limit policies on API keys - [curl cheat sheet](https://www.ory.com/docs/talos/integrate/sdk/curl): Every Ory Talos API endpoint as a copy-paste curl command - [Go SDK](https://www.ory.com/docs/talos/integrate/sdk/go): Using the generated Go HTTP client - [Self-revocation](https://www.ory.com/docs/talos/integrate/self-revocation): Allow API key holders to revoke their own keys - [Operate](https://www.ory.com/docs/talos/operate): Install, configure, and deploy Ory Talos - [Benchmarks](https://www.ory.com/docs/talos/operate/benchmarks): Performance benchmarks and load testing for Ory Talos - [Cache](https://www.ory.com/docs/talos/operate/cache): Ory Talos caches verification results to reduce database load and lower latency. - [In-memory cache](https://www.ory.com/docs/talos/operate/cache/memory): The in-memory cache stores verification results inside each Ory Talos process. It uses - [Redis cache](https://www.ory.com/docs/talos/operate/cache/redis): Redis gives every Ory Talos instance a shared cache. A cache hit on one instance serves all instances, which cuts database load. - [Configure](https://www.ory.com/docs/talos/operate/configure): Configuration reference for Ory Talos - [Database](https://www.ory.com/docs/talos/operate/database): Talos stores API key data in a relational database. The db.dsn scheme selects the backend driver. - [CockroachDB](https://www.ory.com/docs/talos/operate/database/cockroachdb): CockroachDB provides distributed SQL with automatic sharding and multi-region replication. - [Migrations](https://www.ory.com/docs/talos/operate/database/migrations): Ory Talos has built-in database migrations. Run them before first use and after each upgrade. - [MySQL](https://www.ory.com/docs/talos/operate/database/mysql): The commercial edition supports MySQL as a production database. - [PostgreSQL](https://www.ory.com/docs/talos/operate/database/postgresql): PostgreSQL is the recommended production database backend for Ory Talos. It provides connection pooling, ACID transactions, and - [SQLite](https://www.ory.com/docs/talos/operate/database/sqlite): SQLite is the default database for the OSS edition. It needs no external dependencies. - [Deploy](https://www.ory.com/docs/talos/operate/deploy): Deploy Ory Talos as a standalone binary or Docker container. - [Separate admin and public APIs](https://www.ory.com/docs/talos/operate/deploy/deployment-modes): Ory Talos is a single binary with two HTTP surfaces: - [Docker](https://www.ory.com/docs/talos/operate/deploy/docker): Don't use the latest tag in production. Pin to a specific Talos version (for example, oryd/talos:v1.2.3) so a new release - [Edge proxy](https://www.ory.com/docs/talos/operate/deploy/edge-proxy): Run a caching reverse proxy as a sidecar next to your application. Verify requests hit localhost, so cache hits return from - [Install](https://www.ory.com/docs/talos/operate/install): Install Ory Talos with Homebrew or Scoop, a Docker image, or a pre-built binary - [Monitoring](https://www.ory.com/docs/talos/operate/monitoring): Talos exposes Prometheus metrics, OpenTelemetry tracing, and health endpoints. - [Health checks](https://www.ory.com/docs/talos/operate/monitoring/health-checks): Ory Talos exposes two health endpoints on both the main HTTP port (default 4420) and the metrics port (default 4422). Probe - [Prometheus metrics](https://www.ory.com/docs/talos/operate/monitoring/metrics): Scrape Ory Talos Prometheus metrics from the commercial edition's /metrics endpoint. - [OpenTelemetry tracing](https://www.ory.com/docs/talos/operate/monitoring/tracing): Ory Talos emits distributed traces through OpenTelemetry in commercial builds only. The commercial build tag gates the tracer; - [Multi-tenancy](https://www.ory.com/docs/talos/operate/multi-tenancy): Ory Talos routes each request to a tenant based on the request hostname. Each tenant has fully isolated data and its own - [Secret management](https://www.ory.com/docs/talos/operate/secrets): Ory Talos uses a single configured secret family, secrets.hmac.*. The HMAC secret signs API key checksums and seeds two derived - [Security hardening](https://www.ory.com/docs/talos/operate/security-hardening): Get three things right before you expose Ory Talos to traffic: protect the admin endpoints, terminate TLS in front of every - [Admin protection](https://www.ory.com/docs/talos/operate/security/admin-protection): Ory Talos exposes its admin surface (/v2alpha1/admin/*) without any built-in authentication or authorization. Place the admin - [TLS configuration](https://www.ory.com/docs/talos/operate/tls): Ory Talos has no built-in TLS for its HTTP server. Terminate TLS at a reverse proxy such as nginx, Envoy, or Caddy: - [Troubleshooting](https://www.ory.com/docs/talos/operate/troubleshooting): Common issues - [Commercial quickstart](https://www.ory.com/docs/talos/quickstart/docker-commercial): Run the Ory Talos commercial (OEL) edition locally with Docker and Postgres. This guide pulls the published commercial image, - [Open source quickstart](https://www.ory.com/docs/talos/quickstart/open-source): Issue, verify, and revoke your first API key with the Ory Talos open-source edition ## Troubleshooting - [Account linking response code change (OTA-032025-01)](https://www.ory.com/docs/troubleshooting/account-linking-response-code): Starting no sooner than April 13, 2025, Ory Network will return a 400 Bad Request instead of a 200 OK when a user signs up - [BCrypt hashed passwords and secrets have 72 character limit](https://www.ory.com/docs/troubleshooting/bcrypt-secret-length): BCrypt hashed passwords and secrets have a 72 character limit. This is a limitation of the BCrypt algorithm and the Golang BCrypt - [Troubleshoot CSRF and cookie-related issues](https://www.ory.com/docs/troubleshooting/csrf): When you get 401 Unauthorized or 400 Bad Request responses when your application sends requests to Ory Identities APIs, it is - [Troubleshoot iframe related issues](https://www.ory.com/docs/troubleshooting/iframes): Iframes can pose a significant security risk for authentication services due to many attack vectors such as clickjacking, iframe - [Magic links use old custom domain name](https://www.ory.com/docs/troubleshooting/magic-link-verification-url): After updating their custom domain, some users reported an error that caused the verification emails to come with magic links - [Mandatory `redirect_uri` for OpenID Connect Flows (OTA-072024-01)](https://www.ory.com/docs/troubleshooting/mandatory-redirect-uri): Starting no sooner than August 1st, 2024, Ory Network will enforce the inclusion of redirect_uri in OpenID Connect flow - [Troubleshooting OAuth2 JWT Profile](https://www.ory.com/docs/troubleshooting/oauth2-trust-audience): If you're experiencing issues on Ory Network related to the required audience for the - [Google One Tap fails](https://www.ory.com/docs/troubleshooting/one-tap-nonce-provided-google): If you receive an error such as - [SecurityError when using WebAuthn or Passkeys](https://www.ory.com/docs/troubleshooting/passkeys-webauthn-security-error): Relying party ID mismatch - [Invalid SMTP courier URL format (OTA-112022-01)](https://www.ory.com/docs/troubleshooting/smtp-courier-OTA-112022-01): If you get an error that points you to this document, it means that your email configuration (SMTP URL) is incorrect. The most - [Troubleshoot Ory Actions Webhook issues](https://www.ory.com/docs/troubleshooting/troubleshoot-actions): This document describes common issues with Ory Actions and how to solve them. - [Troubleshooting social sign-in integrations](https://www.ory.com/docs/troubleshooting/troubleshooting-social-sign-in): Redirect loops after registration ## API and CLI reference - [ory](https://www.ory.com/docs/cli/ory): ory - [Ory Elements Reference](https://www.ory.com/docs/elements/reference): Learn about the most important Ory Elements concepts! - [Basic functionality](https://www.ory.com/docs/guides/cli/cli-basics): To get a full list of commands available in Ory CLI, run this command: - [Migration Guide to Ory CLI v1](https://www.ory.com/docs/guides/cli/cli-migration-v1): The Ory CLI v1 got a big lift in terms of usability and features. This guide helps you migrate from Ory CLI v0 to Ory CLI v1. - [Configure projects with Ory CLI](https://www.ory.com/docs/guides/cli/config-with-cli): All Ory components use the same configuration format and APIs whether they are self-hosted or used through Ory Network. - [Configure Ory Permissions](https://www.ory.com/docs/guides/cli/configure-permission-service): Using the Ory CLI, you can quickly adjust the configuration of Ory Permissions and apply config from the Ory Network environment - [Configure Identities](https://www.ory.com/docs/guides/cli/identity-cli): Using the Ory CLI, you can quickly adjust the configuration of the Ory Identities and apply config from the Ory Network - [Installation](https://www.ory.com/docs/guides/cli/installation): The Ory CLI is a convenient and easy-to-use tool that helps you manage and configure Ory Network projects. - [Configure Ory OAuth2 and OpenID](https://www.ory.com/docs/guides/cli/oauth2-cli): Using the Ory CLI, you can quickly adjust the configuration of the Ory OAuth2 and OpenID and apply config from the Ory Network - [Ory Tunnel](https://www.ory.com/docs/guides/cli/proxy-and-tunnel): The CLI contains two tools that help with local development: - [hydra](https://www.ory.com/docs/hydra/cli/hydra): hydra - [hydra create](https://www.ory.com/docs/hydra/cli/hydra-create): hydra create - [hydra create client](https://www.ory.com/docs/hydra/cli/hydra-create-client): hydra create client Create an OAuth 2.0 Client - [hydra create jwk](https://www.ory.com/docs/hydra/cli/hydra-create-jwk): hydra create jwk - [hydra create jwks](https://www.ory.com/docs/hydra/cli/hydra-create-jwks): hydra create jwks Create a JSON Web Key Set with a JSON Web Key - [hydra create oauth2-client](https://www.ory.com/docs/hydra/cli/hydra-create-oauth2-client): hydra create oauth2-client - [hydra delete](https://www.ory.com/docs/hydra/cli/hydra-delete): hydra delete - [hydra delete access-tokens](https://www.ory.com/docs/hydra/cli/hydra-delete-access-tokens): hydra delete access-tokens - [hydra delete client](https://www.ory.com/docs/hydra/cli/hydra-delete-client): hydra delete client Delete one or more OAuth 2.0 Clients by their ID(s) - [hydra delete jwk](https://www.ory.com/docs/hydra/cli/hydra-delete-jwk): hydra delete jwk - [hydra delete jwks](https://www.ory.com/docs/hydra/cli/hydra-delete-jwks): hydra delete jwks Delete one or more JSON Web Key Sets by their set ID - [hydra delete oauth2-client](https://www.ory.com/docs/hydra/cli/hydra-delete-oauth2-client): hydra delete oauth2-client - [hydra get](https://www.ory.com/docs/hydra/cli/hydra-get): hydra get - [hydra get client](https://www.ory.com/docs/hydra/cli/hydra-get-client): hydra get client Get one or more OAuth 2.0 Clients by their ID(s) - [hydra get jwk](https://www.ory.com/docs/hydra/cli/hydra-get-jwk): hydra get jwk - [hydra get jwks](https://www.ory.com/docs/hydra/cli/hydra-get-jwks): hydra get jwks Get a JSON Web Key Set by its ID(s) - [hydra get oauth2-client](https://www.ory.com/docs/hydra/cli/hydra-get-oauth2-client): hydra get oauth2-client - [hydra import](https://www.ory.com/docs/hydra/cli/hydra-import): hydra import - [hydra import client](https://www.ory.com/docs/hydra/cli/hydra-import-client): hydra import client Import OAuth 2.0 Clients from files or STDIN - [hydra import jwk](https://www.ory.com/docs/hydra/cli/hydra-import-jwk): hydra import jwk - [hydra import oauth2-client](https://www.ory.com/docs/hydra/cli/hydra-import-oauth2-client): hydra import oauth2-client - [hydra introspect](https://www.ory.com/docs/hydra/cli/hydra-introspect): hydra introspect - [hydra introspect token](https://www.ory.com/docs/hydra/cli/hydra-introspect-token): hydra introspect token - [hydra janitor](https://www.ory.com/docs/hydra/cli/hydra-janitor): hydra janitor - [hydra list](https://www.ory.com/docs/hydra/cli/hydra-list): hydra list - [hydra list clients](https://www.ory.com/docs/hydra/cli/hydra-list-clients): hydra list clients List OAuth 2.0 Clients - [hydra list oauth2-clients](https://www.ory.com/docs/hydra/cli/hydra-list-oauth2-clients): hydra list oauth2-clients - [hydra migrate](https://www.ory.com/docs/hydra/cli/hydra-migrate): hydra migrate Various migration helpers - [hydra migrate gen](https://www.ory.com/docs/hydra/cli/hydra-migrate-gen): hydra migrate gen Generate migration files from migration templates - [hydra migrate sql](https://www.ory.com/docs/hydra/cli/hydra-migrate-sql): hydra migrate sql Create SQL schemas and apply migration plans - [hydra migrate status](https://www.ory.com/docs/hydra/cli/hydra-migrate-status): hydra migrate status Get the current migration status - [hydra perform](https://www.ory.com/docs/hydra/cli/hydra-perform): hydra perform - [hydra perform authorization-code](https://www.ory.com/docs/hydra/cli/hydra-perform-authorization-code): hydra perform authorization-code - [hydra perform client-credentials](https://www.ory.com/docs/hydra/cli/hydra-perform-client-credentials): hydra perform client-credentials - [hydra perform device-code](https://www.ory.com/docs/hydra/cli/hydra-perform-device-code): hydra perform device-code - [hydra revoke](https://www.ory.com/docs/hydra/cli/hydra-revoke): hydra revoke - [hydra revoke token](https://www.ory.com/docs/hydra/cli/hydra-revoke-token): hydra revoke token - [hydra serve](https://www.ory.com/docs/hydra/cli/hydra-serve): hydra serve - [hydra serve admin](https://www.ory.com/docs/hydra/cli/hydra-serve-admin): hydra serve admin - [hydra serve all](https://www.ory.com/docs/hydra/cli/hydra-serve-all): hydra serve all - [hydra serve public](https://www.ory.com/docs/hydra/cli/hydra-serve-public): hydra serve public - [hydra update](https://www.ory.com/docs/hydra/cli/hydra-update): hydra update - [hydra update client](https://www.ory.com/docs/hydra/cli/hydra-update-client): hydra update client Update an OAuth 2.0 Client - [hydra update oauth2-client](https://www.ory.com/docs/hydra/cli/hydra-update-oauth2-client): hydra update oauth2-client - [hydra version](https://www.ory.com/docs/hydra/cli/hydra-version): hydra version - [HTTP API documentation](https://www.ory.com/docs/hydra/reference/api): Ory Hydra HTTP API documentation - [Configure Ory Hydra](https://www.ory.com/docs/hydra/reference/configuration) - [Configuration editor](https://www.ory.com/docs/hydra/reference/configuration-editor) - [keto](https://www.ory.com/docs/keto/cli/keto): keto - [keto check](https://www.ory.com/docs/keto/cli/keto-check): keto check - [keto expand](https://www.ory.com/docs/keto/cli/keto-expand): keto expand - [keto migrate](https://www.ory.com/docs/keto/cli/keto-migrate): keto migrate - [keto migrate down](https://www.ory.com/docs/keto/cli/keto-migrate-down): keto migrate down - [keto migrate status](https://www.ory.com/docs/keto/cli/keto-migrate-status): keto migrate status - [keto migrate up](https://www.ory.com/docs/keto/cli/keto-migrate-up): keto migrate up - [keto namespace](https://www.ory.com/docs/keto/cli/keto-namespace): keto namespace Read and manipulate namespaces - [keto namespace migrate](https://www.ory.com/docs/keto/cli/keto-namespace-migrate): keto namespace migrate Migrate a namespace - [keto namespace migrate down](https://www.ory.com/docs/keto/cli/keto-namespace-migrate-down): keto namespace migrate down Migrate a namespace down - [keto namespace migrate legacy](https://www.ory.com/docs/keto/cli/keto-namespace-migrate-legacy): keto namespace migrate legacy Migrate a namespace from v0.6.x to v0.7.x and later. - [keto namespace migrate status](https://www.ory.com/docs/keto/cli/keto-namespace-migrate-status): keto namespace migrate status Get the current namespace migration status - [keto namespace migrate up](https://www.ory.com/docs/keto/cli/keto-namespace-migrate-up): keto namespace migrate up Migrate a namespace up - [keto namespace validate](https://www.ory.com/docs/keto/cli/keto-namespace-validate): keto namespace validate Validate namespace definitions - [keto relation-tuple](https://www.ory.com/docs/keto/cli/keto-relation-tuple): keto relation-tuple - [keto relation-tuple create](https://www.ory.com/docs/keto/cli/keto-relation-tuple-create): keto relation-tuple create - [keto relation-tuple delete](https://www.ory.com/docs/keto/cli/keto-relation-tuple-delete): keto relation-tuple delete - [keto relation-tuple delete-all](https://www.ory.com/docs/keto/cli/keto-relation-tuple-delete-all): keto relation-tuple delete-all - [keto relation-tuple get](https://www.ory.com/docs/keto/cli/keto-relation-tuple-get): keto relation-tuple get - [keto relation-tuple parse](https://www.ory.com/docs/keto/cli/keto-relation-tuple-parse): keto relation-tuple parse - [keto serve](https://www.ory.com/docs/keto/cli/keto-serve): keto serve - [keto status](https://www.ory.com/docs/keto/cli/keto-status): keto status - [keto version](https://www.ory.com/docs/keto/cli/keto-version): keto version - [Configuration](https://www.ory.com/docs/keto/reference/configuration) - [Configuration editor](https://www.ory.com/docs/keto/reference/configuration-editor) - [Ory Permission Language](https://www.ory.com/docs/keto/reference/ory-permission-language): Ory Keto (Permissions) uses a relationship-based access control model (ReBAC) in which permissions are derived from the - [Protocol buffers API](https://www.ory.com/docs/keto/reference/proto-api): Table of Contents - [HTTP API documentation](https://www.ory.com/docs/keto/reference/rest-api): Ory Keto HTTP API documentation - [kratos](https://www.ory.com/docs/kratos/cli/kratos): kratos - [kratos cleanup](https://www.ory.com/docs/kratos/cli/kratos-cleanup): kratos cleanup - [kratos cleanup sql](https://www.ory.com/docs/kratos/cli/kratos-cleanup-sql): kratos cleanup sql - [kratos courier](https://www.ory.com/docs/kratos/cli/kratos-courier): kratos courier - [kratos courier watch](https://www.ory.com/docs/kratos/cli/kratos-courier-watch): kratos courier watch - [kratos delete](https://www.ory.com/docs/kratos/cli/kratos-delete): kratos delete - [kratos delete identity](https://www.ory.com/docs/kratos/cli/kratos-delete-identity): kratos delete identity - [kratos format](https://www.ory.com/docs/kratos/cli/kratos-format): kratos format - [kratos format jsonnet](https://www.ory.com/docs/kratos/cli/kratos-format-jsonnet): kratos format jsonnet - [kratos get](https://www.ory.com/docs/kratos/cli/kratos-get): kratos get - [kratos get identity](https://www.ory.com/docs/kratos/cli/kratos-get-identity): kratos get identity - [kratos hashers](https://www.ory.com/docs/kratos/cli/kratos-hashers): kratos hashers - [kratos hashers argon2](https://www.ory.com/docs/kratos/cli/kratos-hashers-argon2): kratos hashers argon2 - [kratos hashers argon2 calibrate](https://www.ory.com/docs/kratos/cli/kratos-hashers-argon2-calibrate): kratos hashers argon2 calibrate - [kratos hashers argon2 hash](https://www.ory.com/docs/kratos/cli/kratos-hashers-argon2-hash): kratos hashers argon2 hash - [kratos hashers argon2 load-test](https://www.ory.com/docs/kratos/cli/kratos-hashers-argon2-load-test): kratos hashers argon2 load-test - [kratos identities](https://www.ory.com/docs/kratos/cli/kratos-identities): kratos identities Tools to interact with remote identities - [kratos identities delete](https://www.ory.com/docs/kratos/cli/kratos-identities-delete): kratos identities delete Delete identities by ID - [kratos identities get](https://www.ory.com/docs/kratos/cli/kratos-identities-get): kratos identities get Get one or more identities by ID - [kratos identities import](https://www.ory.com/docs/kratos/cli/kratos-identities-import): kratos identities import Import identities from files or STD_IN - [kratos identities list](https://www.ory.com/docs/kratos/cli/kratos-identities-list): kratos identities list List identities - [kratos identities patch](https://www.ory.com/docs/kratos/cli/kratos-identities-patch): kratos identities patch Patch identities by ID (not yet implemented) - [kratos identities put](https://www.ory.com/docs/kratos/cli/kratos-identities-put): kratos identities put Put identities from files or STD_IN - [kratos identities validate](https://www.ory.com/docs/kratos/cli/kratos-identities-validate): kratos identities validate Validate local identity files - [kratos import](https://www.ory.com/docs/kratos/cli/kratos-import): kratos import - [kratos import identities](https://www.ory.com/docs/kratos/cli/kratos-import-identities): kratos import identities - [kratos jsonnet](https://www.ory.com/docs/kratos/cli/kratos-jsonnet): kratos jsonnet Helpers for linting and formatting JSONNet code - [kratos jsonnet format](https://www.ory.com/docs/kratos/cli/kratos-jsonnet-format): kratos jsonnet format - [kratos jsonnet lint](https://www.ory.com/docs/kratos/cli/kratos-jsonnet-lint): kratos jsonnet lint - [kratos lint](https://www.ory.com/docs/kratos/cli/kratos-lint): kratos lint - [kratos lint lint](https://www.ory.com/docs/kratos/cli/kratos-lint-lint): kratos lint lint - [kratos list](https://www.ory.com/docs/kratos/cli/kratos-list): kratos list - [kratos list identities](https://www.ory.com/docs/kratos/cli/kratos-list-identities): kratos list identities - [kratos migrate](https://www.ory.com/docs/kratos/cli/kratos-migrate): kratos migrate - [kratos migrate normalize-phone-numbers](https://www.ory.com/docs/kratos/cli/kratos-migrate-normalize-phone-numbers): kratos migrate normalize-phone-numbers - [kratos migrate sql](https://www.ory.com/docs/kratos/cli/kratos-migrate-sql): kratos migrate sql Create SQL schemas and apply migration plans - [kratos remote](https://www.ory.com/docs/kratos/cli/kratos-remote): kratos remote - [kratos remote status](https://www.ory.com/docs/kratos/cli/kratos-remote-status): kratos remote status - [kratos remote version](https://www.ory.com/docs/kratos/cli/kratos-remote-version): kratos remote version - [kratos serve](https://www.ory.com/docs/kratos/cli/kratos-serve): kratos serve - [kratos validate](https://www.ory.com/docs/kratos/cli/kratos-validate): kratos validate - [kratos validate identity](https://www.ory.com/docs/kratos/cli/kratos-validate-identity): kratos validate identity - [kratos version](https://www.ory.com/docs/kratos/cli/kratos-version): kratos version - [REST API documentation](https://www.ory.com/docs/kratos/reference/api): Ory Kratos REST API documentation - [Configuration](https://www.ory.com/docs/kratos/reference/configuration) - [Configuration editor](https://www.ory.com/docs/kratos/reference/configuration-editor) - [HTML Form Parser](https://www.ory.com/docs/kratos/reference/html-forms): If you're using HTML Forms to sign users up or update profiles, Ory Kratos needs to assert the type of each field, as HTML Form - [JSON schema and JSON paths](https://www.ory.com/docs/kratos/reference/json-schema-json-paths): JSON Schema is a vocabulary that allows you to annotate and validate JSON documents. It's a IETF - [Data mapping with Jsonnet](https://www.ory.com/docs/kratos/reference/jsonnet): Some modules, like the OpenID Connect and OAuth2 Method, support Jsonnet, - [oathkeeper](https://www.ory.com/docs/oathkeeper/cli/oathkeeper): oathkeeper A cloud native Access and Identity Proxy - [oathkeeper credentials](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-credentials): oathkeeper credentials Generate RSA, ECDSA, and other keys and output them as JSON Web Keys - [oathkeeper credentials generate](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-credentials-generate): oathkeeper credentials generate Generate a key for the specified algorithm - [oathkeeper health](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-health): oathkeeper health Commands for checking the status of an ORY Oathkeeper deployment - [oathkeeper health alive](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-health-alive): oathkeeper health alive Checks if an ORY Oathkeeper deployment is alive - [oathkeeper health ready](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-health-ready): oathkeeper health ready Checks if an ORY Oathkeeper deployment is ready - [oathkeeper rules](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-rules): oathkeeper rules Commands for managing rules - [oathkeeper rules get](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-rules-get): oathkeeper rules get Get access rule - [oathkeeper rules list](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-rules-list): oathkeeper rules list List access rules - [oathkeeper serve](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-serve): oathkeeper serve Starts the HTTP/2 REST API and HTTP/2 Reverse Proxy - [oathkeeper version](https://www.ory.com/docs/oathkeeper/cli/oathkeeper-version): oathkeeper version Display this binary's version, build time and git hash of this build - [HTTP API documentation](https://www.ory.com/docs/oathkeeper/reference/api): Ory Oathkeeper HTTP API documentation - [Configuration](https://www.ory.com/docs/oathkeeper/reference/configuration) - [Configuration editor](https://www.ory.com/docs/oathkeeper/reference/configuration-editor) - [Polis REST HTTP API Documentation](https://www.ory.com/docs/polis/reference/api) - [Ory REST HTTP API Documentation](https://www.ory.com/docs/reference/api) - [Reference](https://www.ory.com/docs/reference/reference-overview): These tools are intended for Ory Network integrations only. You must use the service-specific tools for Ory OEL or Ory OSS - [Reference](https://www.ory.com/docs/talos/reference): API, configuration, and technical reference - [Ory Talos API](https://www.ory.com/docs/talos/reference/api/ory-talos-api): Ory Talos is a high-performance API key management service. It handles the full API key lifecycle: issuing keys, verifying them at low latency, deriving short-lived tokens (JWT and Macaroon), and revoking access. - [talos](https://www.ory.com/docs/talos/reference/cli/talos): talos