Ory is an open-source identity and access management platform that handles login, single sign-on, and permissions for web applications and services. Teams add authentication with its identity APIs and hosted flows instead of building registration, recovery, and access control themselves, then run it as self-hosted open source or as the managed Ory Network service.[1][2][3]
Quick verdict
Teams that want to own their login stack without building identity from scratch benefit most from Ory. Its Kratos identity flows, Hydra OAuth2 tokens, and Keto permissions cover sign-up, single sign-on, and authorization over open standards, self-hosted or on Ory Network. The constraint is operational and commercial: self-hosting a modular IAM system needs container and database operations, while Network SSO tiers and the Enterprise License raise the bill. If you want open-source control of identity with a managed escape hatch, choose Ory; if you want a fully managed login with no infrastructure of your own, stay with Auth0 instead.[1][2][3][4]
Key features
Passwordless sign-in Offer passkeys and Magic Link beside passwords, so users register and log in without inventing another credential to forget.[1]
Social sign-in over OIDC Accept social identity providers through standard OpenID Connect flows that interoperate with existing OIDC libraries.[1][2]
Enterprise SSO Connect customer identity providers over SAML and OIDC with SCIM directory sync, billed on upper Network tiers such as Growth.[1][2][3]
Multi-factor authentication Add a second factor to login flows, including TOTP and SMS options, with MFA-ready flow support in Kratos.[1][2]
Modular IAM ecosystem Combine Kratos for identities, Hydra for OAuth2 tokens, Keto for permissions, and Polis for enterprise federation instead of adopting one monolith.[1]
Self-hosted open-source core Run the Apache-2.0 core on your own infrastructure with Docker or Kubernetes packaging and complete access to the codebase.[1][2][3]
Managed Ory Network Skip operations with Production, Growth, and Enterprise plans carrying environments, analytics, B2B features, and data-residency options.[1]
APIs, SDKs, and CLI Drive users, sessions, and permissions from code across REST APIs, framework SDKs, and the command line, with shared standards on every deployment option.[1]
Who will love it
Teams replacing home-grown authentication: Kratos, Hydra, and Keto map directly onto registration, login, token, and permission requirements the team would otherwise build.[1][2]
Enterprises needing data control: the self-hosted core and Enterprise License keep user data inside infrastructure they control, with premium support and SLAs.[1][2]
Standards-driven shops: OAuth2, OIDC, and SAML with identical APIs across deployment options avoid proprietary lock-in and permit moving between self-hosted and Network later.[1]
Who should avoid it
Teams with no one to run infrastructure: self-hosting a modular IAM system assumes container and database operations, and the managed alternative is a paid plan once usage grows.[1][2]
Buyers wanting SSO on the cheapest tier: enterprise SSO is a Growth-and-up capability, so pilots that must prove customer SSO before paying should look elsewhere.[1]
Non-technical site owners: everything from SDK integration to permission modeling assumes developers; a no-code membership plugin fits them better.[1][2]
Alternatives and compatibility
Auth0 is the incumbent in the published catalogue relationship and Ory positions Kratos as its replacement, which decides the control question for buyers choosing between managed and runnable identity.[1][2]
Auth0 fits teams that want fully managed customer identity with no infrastructure and guided setup.[1][2]
Keycloak, Authentik, and Logto fit teams comparing self-hosted or open-core OIDC and SSO platforms; switching identity providers is SDK, connection, role, and user-migration work, not data export.[1][2]
Questions worth asking
What is the best Ory alternative for non-technical users?
Is Ory really no-code?
How much does Ory cost per month?
Self-hosting the Apache-2.0 core costs nothing in licensing; the servers are yours. Ory Network lists Production at $770 per year and Growth at $9,350 per year, with Enterprise and the self-hosted Enterprise License on custom quotes, and developers can trial on test systems. Checked October 12, 2026.[1][2]
Can you self-host Ory?
Yes. The Apache-2.0 core deploys on your own infrastructure with Docker or Kubernetes per the repository and deployment docs, and the Enterprise License adds premium self-hosted features with production support. Managed-only Network metering and vendor SLAs do not transfer to a self-hosted install.[1][2][3]
Sources and editorial review
Source research. Reviewed on October 12, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- Ory on OpenAlternative (discovery lead)
official · Observed October 12, 2026
Discovery lead: open-source alternative to Auth0, Firebase, Clerk; ory/kratos repo, Apache-2.0, self-hosted Yes, about 13.9k stars, v26.2.0, opencollective sponsorship.
- Ory homepage (official)
official · Observed October 12, 2026
Official homepage: IAM for applications, enterprises, AI agents; cloud-native, API-first, self-hostable; Fortune-500 trust; SDKs and migration guides.
- Ory pricing (official)
official · Observed October 12, 2026
Network Production 770 USD/year, Growth 9,350 USD/year, Enterprise custom; Enterprise License self-hosted custom; developer trial; SLA support on Enterprise.
- ory/kratos on GitHub (official)
official · Observed October 12, 2026
Headless cloud-native auth in Go; replaces Homegrown/Auth0/Okta/Firebase; Passkeys, Social Sign In, OIDC, Magic Link, MFA, SMS, SAML, TOTP; Docker and Kubernetes; links to www.ory.com and Network.
- Ory developer docs (official)
official · Observed October 12, 2026
REST API, SDK, CLI references; framework quick-starts; Network, Enterprise License, and Open Source deployment options.
- Ory products and ecosystem (official)
official · Observed October 12, 2026
Modular IAM: Kratos identities, Keto permissions, Hydra OAuth2/OIDC, Polis enterprise SSO with SCIM; same standards and APIs across deployments.