Existing OAuth and OpenID Connect solutions lack flexibility and granular control, limiting adaptability to specific business needs. Ory Hydra — the open-source, OpenID Certified® OAuth 2.0 server — integrates with your infrastructure, giving you complete control over how access tokens are issued, scoped, and validated.
Millions of users. Unlimited scale.
Ory Hydra powers OAuth 2.0 and OpenID Connect for systems with millions of users, serving thousands of token issuances per second.
SDKs for every stack
Hydra is written in Go with official SDKs for every major language — .NET, Java, Node.js, PHP, Python, Ruby, Rust, Dart, and TypeScript. It works with any login system and integrates with your existing identity provider, so engineers can add OAuth 2.0 in hours, not weeks.
OpenID Certified® OAuth 2.0
The most advanced open-source OAuth 2.0 and OpenID Connect server — and the only one OpenID Certified®. Integrates with any login system and federates identity to any application, anywhere.
Powered by Open Source
Ory Hydra offers deployment flexibility. With open source roots, Ory Hydra has grown to offer different models to suit your business needs. Deploy open-source, opt for Ory Enterprise License with additional features, commercial SLAs, and support, or use the fully managed Ory Network for a seamless SaaS experience.
OpenAI wanted a partner that could help enable our vision for owning our identity processes, data, and success. We have a lot of partners, and Ory is one of our best.
OAuth 2.0 and OpenID Connect features for production
Full OAuth 2.0 spec coverage
Implements the complete OAuth 2.0 standard as defined by the IETF — authorization code, client credentials, refresh token, PKCE, and token exchange flows. Integrates with Ory Kratos or any open-source or proprietary identity provider.
OpenID Certified®
The OpenID Foundation has certified Ory Hydra as a conformant OpenID Connect provider. All flows specified by the IETF and OpenID Foundation are implemented and tested against the certification suite.
Bring your own UX
Use your own branding, login screens, and consent pages for every OAuth 2.0 and OpenID Connect flow. Ory Hydra exposes the protocol; you control the UX. Powered by a documented REST API and CLI.
Compatible with MITREid
Drop-in migration path from MITREid Connect. Hydra ships with documentation for migrating client registrations, key material, and active sessions with minimal downtime.
Cryptographic key storage
Cryptographic keys for JWT signing are stored encrypted at rest. Manage OAuth 2.0 clients, rotate signing keys, and issue tokens directly from the CLI or Admin API.
Production-grade scale and performance
Stateless, horizontally scalable architecture. Ory Hydra serves tokens to systems with millions of users and tens of millions of weekly token issuances — battle-tested for security incident reduction and operational simplicity.
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
OSS
OEL
Ory Network
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance-ready
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Global multi-region architecture
Global multi-region architecture
Multi-region capable
Global multi-region architecture
Purpose-based data retention
Purpose-based data retention
Purpose-based data retention
24/7 SLA support
24/7 SLA support
24/7 SLA support
CVE security patching
CVE security patching
CVE security patching
Unified control plane for ease of management
CLI
Unified control plane for ease of management
CLI & GUI
Unified control plane for ease of management
CLI & GUI
Production Helm Charts
Production Helm Charts
Production Helm Charts
n/a
Managed infrastructure
Managed infrastructure
n/a
Managed infrastructure
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
OAuth 2.0 + OpenID Connect with OAuth 2.1 support*
OpenID Certified®
OpenID Certified®
OpenID Certified®
High performance pooling
High performance pooling
High performance pooling
Stateless JWT access tokens
Stateless JWT access tokens
Stateless JWT access tokens
Credential rotation
Credential rotation
Credential rotation
Token exchange
Token exchange
Token exchange
Resource Owner Password Credentials (ROPC)
Resource Owner Password Credentials (ROPC)
Resource Owner Password Credentials (ROPC)
Deploy Ory Hydra on your preferred infrastructure
Run the same OAuth 2.0 and OpenID Connect server three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same OpenID Certified® engine, same protocol semantics across all three.
Open Source deployment — Explore and experiment with Ory Hydra, an OAuth2 and OpenID Connect server. Ideal for developers building proofs of concept, testing integrations, or learning how Ory identity flows work. 
Ory Enterprise License
OEL deployment — Run Ory Hydra with enterprise-grade performance and support. Get optimized code, security updates, and compliance features for mission-critical identity workloads, on-premises or in your private cloud. 
Ory Network
Ory Network deployment — Use Hydra-powered OAuth2 and OpenID Connect services instantly, without managing infrastructure. Ory Network delivers global scale, built-in compliance, and the fastest path to secure identity.
Get Started
Ready to try Ory Hydra?
Spin up Ory Hydra locally in under five minutes, or jump to the OAuth 2.0 integration guide if you're scoping a production deployment.
oauth2-client.js
const express = require('express');
const app = express();
const { AuthorizationCode } = require("simple-oauth2")
const client = new AuthorizationCode({
client: {
id: process.env.CLIENT_ID,
secret: process.env.CLIENT_SECRET,
},
auth: {
tokenHost: "https://<your-project>.projects.oryapis.com",
tokenPath: "/oauth2/token",
authorizePath: "/oauth2/auth",
},
})
app.get("/", (req, res) => {
const authorizationUri = client.authorizeURL({
redirect_uri: REDIRECT_URI,
scope: "openid offline",
})
res.redirect(authorizationUri)
})
app.get("/callback", async (req, res) => {
const { code } = req.query
try {
const accessToken = await client.getToken({
code,
redirect_uri: process.env.REDIRECT_URI,
scope: "openid offline",
})
res.json(accessToken.token)
} catch (error) {
res.status(500).json({ error: error.message })
}
})
More on Ory Hydra
March 17, 2025
OpenAI uses open source Ory to authenticate over 400M weekly active users
Powering OpenAI's OAuth2 infrastructure - discover how Ory Hydra scaled to web-scale with reliable, straightforward technology.
