Stars
Forks
Watchers
Developer links
Ory Hydra
Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider that plugs into any existing user database or authentication system through a headless consent and login bridge, letting you own your authorization infrastructure without rebuilding identity management from scratch. The Go binary ships at under 15MB with zero system dependencies and exposes two distinct API surfaces: a public endpoint on port 4444 handling authorization code flows, token exchanges, PKCE challenges, device authorization grants per RFC 8628, and OpenID Connect discovery, plus an admin endpoint on port 4445 managing client registration, token introspection, consent session lifecycle, and JWKS rotation. Access tokens can be issued as opaque reference tokens or signed JWTs for stateless validation at resource servers, while refresh token rotation, token revocation per RFC 7009, and pairwise subject identifiers provide granular security controls. Persistent storage spans PostgreSQL, MySQL, and CockroachDB with automatic schema migrations, and the architecture supports horizontal scaling behind load balancers with shared database state. Dynamic client registration per RFC 7591 enables automated provisioning, and the OAuth 2.0 Threat Model security considerations are implemented as default behaviors rather than optional add-ons. Trusted by OpenAI and other internet-scale platforms. Helm charts and Docker Compose quickstarts provide production-ready deployment paths alongside the broader Ory ecosystem including Kratos for identity management, Oathkeeper for zero-trust API proxying, and Keto for fine-grained permissions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.
Benefits
- Headless Identity-Agnostic Architecture
- Delegates login and consent to your existing identity system via API bridge, giving absolute control over authentication UX without vendor lock-in to any specific user management framework.
- OpenID Certified Compliance
- Passes the official OpenID Foundation conformance test suite, implementing OAuth 2.0, OpenID Connect Core, PKCE, token introspection, revocation, and dynamic client registration as certified behaviors.
- High Throughput Low Latency
- Go binary under 15MB with zero runtime dependencies serves thousands of token requests per second with sub-millisecond latency, scaling horizontally behind load balancers with shared database state.
- Flexible Database Backend Support
- Stores clients, tokens, and consent data in PostgreSQL, MySQL, or CockroachDB with automatic schema migrations, supporting both single-node and distributed database topologies.
Features
- OAuth 2.0 Grant Types
- Supports authorization code with PKCE, client credentials, refresh token rotation, device authorization per RFC 8628, and legacy implicit flow for comprehensive protocol coverage.
- JWT and Opaque Tokens
- Issues access tokens as signed JWTs for stateless resource server validation or opaque reference tokens with server-side introspection via the admin API.
- JWKS Key Management
- Manages JSON Web Key Sets with automatic rotation, supporting RSA and ECDSA signing algorithms for ID token and JWT access token cryptographic operations.
- Dynamic Client Registration
- Implements RFC 7591 and RFC 7592 for automated OAuth client provisioning and management, enabling programmatic multi-tenant onboarding without manual configuration.
- Consent Session Management
- Login and consent flow orchestration via admin API enables custom approval screens, session persistence, forced re-authentication, and consent revocation per client or subject.