Ory review 2026: open-source identity, authentication and permissions infrastructure. Compare Ory Network pricing, features, pros, cons and alternatives.
Ory is an open-source identity and access management platform built around a modular set of components: Kratos for identity, Hydra for OAuth2/OIDC, Keto for permissions, and Oathkeeper for API access control. Each piece can be run independently, self-hosted, or consumed together through the managed Ory Network cloud service.
Founded in 2015 in Munich, Germany, Ory grew from an open-source project into a venture-backed company after raising a $22 million Series A led by Insight Partners. The company positions itself as infrastructure for developers who want authentication and authorization without building it from scratch or locking into a closed-source vendor.
Ory Kratos provides self-service registration, login, account recovery, and multi-factor and passwordless authentication as headless, API-first identity management. Ory Hydra is a certified OAuth2 and OpenID Connect server for building SSO and API authorization flows.
Ory Keto implements a Zanzibar-inspired permissions engine for fine-grained authorization at scale, and Ory Oathkeeper acts as an identity-aware proxy for zero-trust API gateways. All four components are open source under Apache 2.0 and can be deployed self-hosted or via the managed Ory Network.
Ory's free Developer tier is intended for evaluation and prototyping, with two development environments and community-only support, and the open-source components can always be self-hosted for free.
Paid Ory Network plans scale from Production at $70/month (one production project, usage-based token and permission-check pricing) to Growth at $9,350/year for larger, multi-tenant deployments, up to custom Enterprise pricing for large organizations with compliance needs.
Yes. Ory's core components (Kratos, Hydra, Keto, Oathkeeper) are open source under the Apache 2.0 license and free to self-host. The managed Ory Network also offers a free Developer tier for evaluation and prototyping.
Ory Kratos is Ory's identity management component, handling user registration, login, multi-factor authentication, and account recovery through a headless, API-first architecture.
Self-hosting means running the open-source Ory components (Kratos, Hydra, Keto, Oathkeeper) on your own infrastructure for free. Ory Network is Ory's fully managed cloud version of the same components, priced on a freemium, usage-based model starting at $70/month for production use.
Ory Network has a free Developer tier, a Production plan starting at $70/month, a Growth plan starting at $9,350/year, and custom Enterprise pricing, with usage-based charges for items like machine-to-machine tokens and permission checks.
Yes, Ory supports passwordless and passkey-based authentication, along with social sign-on and traditional password and multi-factor authentication flows.
Ory Keto is a fine-grained permissions and authorization engine modeled on Google's Zanzibar paper, used to model complex access-control relationships between users, groups, and resources.
Ory's main competitors include Auth0 (owned by Okta), Keycloak, FusionAuth, WorkOS, and AWS Cognito.
Yes, Ory offers a custom Enterprise plan on Ory Network with dedicated support and compliance features, in addition to its open-source components that enterprises can self-host under their own security controls.