● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
O

ORY Hydra

Provisioning & Security
Open source · Apache-2.0

ORY Hydra is a headless OAuth2 and OpenID Connect Certified server.

updated 2026-07-01

What it is

ORY Hydra is a headless OAuth2 and OpenID Connect Certified server. It handles token issuance, authorization flows, and consent management, but it deliberately does not manage user identities, passwords, or login UI — that's delegated to a separate "login and consent" app you build or buy. This split is the core design decision: Hydra is infrastructure for authorization, not a full identity provider.

Despite being listed here under Provisioning, its actual job is runtime auth — issuing and validating OAuth2/OIDC tokens for APIs and services. If you're expecting user provisioning/deprovisioning workflows out of the box, that's not what this does.

Who builds it and why

Built by ORY (the company behind Ory Kratos, Keto, and Oathkeeper), a German-based open-source identity infrastructure vendor. Their bet is that identity should be composed from small, focused services rather than one monolithic IAM platform. Hydra is the OAuth2/OIDC piece of that stack — it's meant to be paired with Kratos (identity) and Keto (permissions) or with whatever identity system you already run.

321 contributors on a Go codebase is a healthy, broad base — this isn't a single-maintainer project, though ORY the company clearly drives the roadmap and employs the core team.

Production readiness signal

17,367 GitHub stars and a commit as recent as 2026-07-01 indicates active, ongoing development — this is not an abandoned project. Latest release v26.2.0 shows a mature version history with substantial iteration behind it.

CNCF maturity level is not publicly available — Hydra is not a CNCF project; it's independently governed by ORY. Apache-2.0 licensing means no copyleft surprises for commercial use. Founded date is not publicly available, but based on version numbering and community size, this has been in production use for years across companies running their own auth infrastructure.

No public data here on SLA guarantees, security audit history, or CVE response times — check ORY's own security disclosures before betting critical auth infrastructure on it.

Who should use this

  • Teams building API-first products who need a standards-compliant OAuth2/OIDC server without vendor lock-in.
  • Platform teams that already have (or want) a separate identity/user store and just need the token issuance and consent layer.
  • Organizations that need OpenID Connect Certified compliance for enterprise/B2B integrations.
  • Engineers comfortable operating stateful Go services and managing PostgreSQL/MySQL as the backing store.

Who should NOT use this

  • Teams wanting a turnkey identity solution with login pages, MFA, and user management baked in — you'll need to build or buy that layer separately (ORY Kratos, or a hosted IdP).
  • Small teams without dedicated platform/security engineering capacity — self-hosting an OAuth2 server correctly (token rotation, key management, consent flow security) is not trivial and mistakes here are security incidents, not bugs.
  • Organizations that need a vendor with contractual SLAs and enterprise support out of the box and don't want to negotiate ORY's commercial tier or build in-house expertise.
  • Anyone expecting "Provisioning" in the SCIM/user-lifecycle sense — this is not a user provisioning tool.

Alternatives

  • Keycloak — full-featured, all-in-one IAM (auth + user management + admin UI), heavier but more batteries-included.
  • Auth0 / Okta — hosted, commercial IDaaS with SLAs and support, trades control and cost for reduced operational burden.
  • Ory's own Kratos + Hydra combo, or Dex — for teams wanting a lighter-weight, Kubernetes-native OIDC provider often used as a connector in front of other identity backends.

Pricing

Fully open source under Apache-2.0 — self-host at no licensing cost. ORY also sells "Ory Network," a hosted/managed version with commercial support; pricing for that is not publicly available here and should be confirmed directly with ORY.

Frequently asked

What is ORY Hydra?+
ORY Hydra is a headless OAuth2 and OpenID Connect Certified server. It handles token issuance, authorization flows, and consent management, but it deliberately does not manage user identities, passwords, or login UI — that's delegated to a separate "login and consent" app you build or buy.
Who builds ORY Hydra?+
Built by ORY (the company behind Ory Kratos, Keto, and Oathkeeper), a German-based open-source identity infrastructure vendor. Their bet is that identity should be composed from small, focused services rather than one monolithic IAM platform.
Is ORY Hydra production ready?+
17,367 GitHub stars and a commit as recent as 2026-07-01 indicates active, ongoing development — this is not an abandoned project. Latest release v26.2.0 shows a mature version history with substantial iteration behind it.
Who should use ORY Hydra?+
Teams building API-first products who need a standards-compliant OAuth2/OIDC server without vendor lock-in. Platform teams that already have (or want) a separate identity/user store and just need the token issuance and consent layer.
Who should not use ORY Hydra?+
Teams wanting a turnkey identity solution with login pages, MFA, and user management baked in — you'll need to build or buy that layer separately (ORY Kratos, or a hosted IdP).
What are the alternatives to ORY Hydra?+
Keycloak — full-featured, all-in-one IAM (auth + user management + admin UI), heavier but more batteries-included. Auth0 / Okta — hosted, commercial IDaaS with SLAs and support, trades control and cost for reduced operational burden.
How much does ORY Hydra cost?+
Fully open source under Apache-2.0 — self-host at no licensing cost. ORY also sells "Ory Network," a hosted/managed version with commercial support; pricing for that is not publicly available here and should be confirmed directly with ORY.