# ory

Source: https://startwithidentity.com/vendors/open-source/ory/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

Ory builds a set of independently deployable identity components rather than a single platform: Kratos for identity and credentials, Hydra for OAuth 2.0 and OIDC, Keto for Zanzibar-style relationship authorization, Oathkeeper as an identity proxy, Polis for enterprise SSO and SCIM, and Talos for machine-to-machine credentials. Every one is Apache 2.0.

That licence position is the differentiator. While [HashiCorp](https://startwithidentity.com/vendors/machine-identity/hashicorp-vault/) moved to BUSL and open-core vendors reserve proprietary directories, Ory has had no relicensing event. It is also now US-headquartered in Scottsdale, Arizona with a Munich subsidiary, having been German-founded, and its primary domain moved from ory.sh to ory.com. Ory states 3.3 billion identities managed and 685 million Docker pulls, and the Hydra project names OpenAI as a user.

## What it is good at

Composability. Because each server runs standalone, you can adopt Hydra purely as a certified OAuth 2.0 and OIDC provider, or Keto purely as an authorization engine, without taking an opinionated platform. Standards coverage is strong: OAuth 2.0 and 2.1, OpenID Connect certified, SAML, SCIM, WebAuthn and passkeys, the Device Authorization Grant, and FedCM at the enterprise tier. Since October 2025 all components share synchronised calendar versioning in a YY.Q.N scheme, so v26.3.14 reads unambiguously as 2026, quarter 3.

The May 2025 [BoxyHQ acquisition](https://www.einpresswire.com/article/816963926/ory-acquires-boxyhq-to-help-enterprises-modernize-identity-management-unshackle-from-monolithic-identity-providers), rebranded Ory Polis, filled a real gap in enterprise SSO and directory sync.

## Where it falls short

Apache 2.0 everywhere does not mean the free build equals the paid one. B2B organisations and multi-tenancy in Kratos, several Hydra capabilities, and guaranteed CVE patching under SLA ship only in Ory Enterprise License binaries, distributed from a private registry. The gating is real even though the licence is not restrictive.

Pricing on average daily active users rather than monthly active users makes cross-vendor comparison genuinely hard, and permission checks and machine tokens bill separately.

Composability also means assembly. Teams wanting one product that does everything will find Ory more work than a managed platform.

In March 2026 Ory disclosed two CVSS 7.2 SQL injection flaws in admin list endpoints, exploitable via a publicly known default secret when pagination secrets are unconfigured. Self-hosters should verify that setting.

## Pricing

Developer free; Production 770 dollars per year; Growth 9,350 dollars per year; Enterprise custom. Usage adds 0.14 or 0.12 dollars per aDAU per month plus token and permission-check charges. Self-hosted open source is free. Model it with our [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Ory when open licensing and component independence genuinely matter, or when you need only one piece of the stack. Choose [Keycloak](https://startwithidentity.com/vendors/open-source/keycloak/) or [Zitadel](https://startwithidentity.com/vendors/open-source/zitadel/) for a self-hosted platform without commercial feature-gating, or a managed CIAM product if assembly is not appealing. See [Keycloak vs Zitadel](https://startwithidentity.com/compare/keycloak-vs-zitadel/).

## Bottom line

The most genuinely open-licensed identity stack available, best suited to teams that want composable standards-compliant components rather than a platform.