hydra README

The project's README from github.com/ory/hydra. As one markdown file: README.md.

Ory Hydra - Open Source OAuth 2 and OpenID Connect server

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs

Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and consent app, giving you absolute control over the user interface and experience.

What is Ory Hydra?

Ory Hydra is a server implementation of the OAuth 2.0 authorization framework and the OpenID Connect Core 1.0. It follows cloud architecture best practices and focuses on:

We recommend starting with the Ory Hydra introduction docs to learn more about its architecture, feature set, and how it compares to other systems.

Why Ory Hydra

Ory Hydra is designed to:

OAuth2 and OpenID Connect: Open Standards

Ory Hydra implements Open Standards set by the IETF:

and the OpenID Foundation:

OpenID Connect Certified

Ory Hydra is an OpenID Foundation certified OpenID Provider (OP).

Ory Hydra is a certified OpenID Providier

The following OpenID profiles are certified:

To obtain certification, we deployed the reference user login and consent app (unmodified) and Ory Hydra v1.0.0.

Deployment options

You can run Ory Hydra in two main ways:

Use Ory Hydra on the Ory Network

The Ory Network is the fastest way to use Ory services in production. Ory OAuth2 & OpenID Connect is powered by the open source Ory Hydra server and is API compatible.

The Ory Network provides:

Sign up for a free developer account to get started.

Self-host Ory Hydra

You can run Ory Hydra yourself for full control over infrastructure, deployment, and customization.

The install guide explains how to:

This guide uses the open source distribution to get you started without license requirements. It is a great fit for individuals, researchers, hackers, and companies that want to experiment, prototype, or run unimportant workloads without SLAs. You get the full core engine, and you are free to inspect, extend, and build it from source.

If you run Hydra as part of a business-critical system, for example OAuth2 and OpenID Connect for all your users, you should use a commercial agreement to reduce operational and security risk. The Ory Enterprise License (OEL) layers on top of self-hosted Hydra and provides:

For guaranteed CVE fixes, current enterprise builds, advanced features, and support in production, you need a valid Ory Enterprise License and access to the Ory Enterprise Docker registry. To learn more, contact the Ory team.

Quickstart

Install the Ory CLI and create a new project to try Ory OAuth2 & OpenID Connect.

# Install the Ory CLI if you do not have it yet:
bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory
sudo mv ./ory /usr/local/bin/

# Sign in or sign up
ory auth

# Create a new project
ory create project --create-workspace "Ory Open Source" --name "GitHub Quickstart" --use-project

Try out the OAuth 2.0 Client Credentials flow:

ory create oauth2-client \
    --name "Client Credentials Demo" \
    --grant-type client_credentials
# Note the client ID and secret from output

ory perform client-credentials \
    --client-id <your-client-id> \
    --client-secret <your-client-secret>
# Note the access token from output

ory introspect token <your-access-token>

Try out the OAuth 2.0 Authorize Code + OpenID Connect flow:

ory create oauth2-client \
    --name "Authorize Code with OpenID Connect Demo" \
    --grant-type authorization_code,refresh_token \
    --response-type code \
    --redirect-uri http://127.0.0.1:4446/callback

ory perform authorization-code \
    --client-id <your-client-id> \
    --client-secret <your-client-secret>

Who is using Ory Hydra

The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 50.000 members and is growing. The Ory stack protects 7.000.000.000+ API requests every day across thousands of companies. None of this would have been possible without each and everyone of you!

The following list represents companies that have accompanied us along the way and that have made outstanding contributions to our ecosystem. If you think that your company deserves a spot here, reach out to [email protected] now!

Name Logo Website Case Study
OpenAI OpenAI openai.com OpenAI Case Study
Fandom Fandom fandom.com Fandom Case Study
Lumin Lumin luminpdf.com Lumin Case Study
Sencrop Sencrop sencrop.com Sencrop Case Study
OSINT Industries OSINT Industries osint.industries OSINT Industries Case Study
HGV HGV hgv.it HGV Case Study
Maxroll Maxroll maxroll.gg Maxroll Case Study
Zezam Zezam zezam.io Zezam Case Study
T.RowePrice T.RowePrice troweprice.com
Mistral Mistral mistral.ai
Axel Springer Axel Springer axelspringer.com
Hemnet Hemnet hemnet.se
Cisco Cisco cisco.com
Presidencia de la República Dominicana Presidencia de la República Dominicana presidencia.gob.do
Moonpig Moonpig moonpig.com
Booster Booster choosebooster.com
Zaptec Zaptec zaptec.com
Klarna Klarna klarna.com
Raspberry PI Foundation Raspberry PI Foundation raspberrypi.org
Tulip Tulip Retail tulip.com
Hootsuite Hootsuite hootsuite.com
Segment Segment segment.com
Arduino Arduino arduino.cc
Sainsbury's Sainsbury's sainsburys.co.uk
Contraste Contraste contraste.com
inMusic InMusic inmusicbrands.com
Buhta Buhta buhta.com
Amplitude amplitude.com amplitude.com
TIER IV Kyma Project Serlo Padis
Cloudbear Security Onion Solutions Factly All My Funds
Nortal OrderMyGear R2Devops Paralus
dyrector.io pinniped.dev pvotal.tech

Many thanks to all individual contributors

Ecosystem

We build Ory on several guiding principles when it comes to our architecture design:

Ory's architecture is designed to run best on a Container Orchestration system such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are small (5-15MB) and available for all popular processor types (ARM, AMD64, i386) and operating systems (FreeBSD, Linux, macOS, Windows) without system dependencies (Java, Node, Ruby, libxml, ...).

Ory Kratos: Identity and User Infrastructure and Management

Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with: Self-service Login and Registration, Multi-Factor Authentication (MFA/2FA), Account Recovery and Verification, Profile, and Account Management.

Ory Hydra: OAuth2 & OpenID Connect Server

Ory Hydra is an OpenID Certified™ OAuth2 and OpenID Connect Provider which easily connects to any existing identity system by writing a tiny "bridge" application. It gives absolute control over the user interface and user experience flows.

Ory Oathkeeper: Identity & Access Proxy

Ory Oathkeeper is a BeyondCorp/Zero Trust Identity & Access Proxy (IAP) with configurable authentication, authorization, and request mutation rules for your web services: Authenticate JWT, Access Tokens, API Keys, mTLS; Check if the contained subject is allowed to perform the request; Encode resulting content into custom headers (X-User-ID), JSON Web Tokens and more!

Ory Keto: Access Control Policies as a Server

Ory Keto is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.

Documentation

The full Ory Hydra documentation is available at www.ory.com/docs/hydra, including:

For upgrading and changelogs, check releases tab and CHANGELOG.md.

Developing Ory Hydra

See DEVELOP.md for information on:

Security

OAuth2 and OAuth2 related specifications are over 400 written pages. Implementing OAuth2 is easy, getting it right is hard. Ory Hydra is trusted by companies all around the world, has a vibrant community and faces millions of requests in production each day. Read the security guide for more details on cryptography and security concepts.

Disclosing vulnerabilities

If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. You can find all info for responsible disclosure in our security.txt.

Telemetry

Our services collect summarized, anonymized data that can optionally be turned off. Click here to learn more.

Libraries and third-party projects

Official:

Community:

Developer Blog:

hydra (ory/hydra)

Searching Database…

17.6K ·GitHub
Hydra
What is this?Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect server, written in Go, that issues and validates tokens, manages clients, and orchestrates login and consent. Run it self-hosted or as a managed service on the Ory Network.
Is this a library I add to my app, or a server I deploy?A standalone server you deploy and talk to over HTTP APIs. It deliberately contains no user management — it is the OAuth2/OIDC token engine, not your login system.
What's the fastest way to try it out?Install the Ory CLI and create a new project — you can run a Client Credentials flow or an Authorize Code + OpenID Connect flow in minutes. To self-host, install a Hydra binary or Docker image.
What does it need to run besides the binary?A backing database: PostgreSQL, MySQL, or CockroachDB. Architecture-wise it is designed to sit on a container orchestrator such as Kubernetes, CloudFoundry, or OpenShift.
Since it has no user management, how do logins actually work?Hydra delegates authentication to whatever identity system you already have — Ory Kratos, authboss, User Frosting, or a proprietary one — via a small login and consent 'bridge' app you write. That gives you total control over the UI and UX.
Will it run on my laptop, or is it a Linux/Kubernetes-only thing?Small (5-15MB) binaries ship for ARM, AMD64, and i386 across Linux, macOS, Windows, and FreeBSD, plus Docker. No system dependencies like Java, Node, or Ruby are required.
Does it phone home with telemetry?It collects summarized, anonymized usage data, and this can be switched off.
Can I run the open-source version in production without paying?The core engine is Apache-2.0 and free, but Ory pitches self-hosting without a license for experimenting and non-critical workloads. Business-critical use wants the paid Ory Enterprise License for CVE-patched releases, advanced features, and SLA support.
Why not just implement OAuth2 myself?Per the README, the OAuth2 spec family is over 400 written pages and implementing it is easy but getting it right is hard. Hydra is OpenID Foundation certified across Basic, Implicit, Hybrid, Configuration, and Dynamic OP profiles, and faces millions of production requests daily.
What does the rest of the Ory ecosystem look like?Kratos is an API-first identity and user management service (login, registration, MFA/2FA, recovery), Oathkeeper is a BeyondCorp/Zero Trust identity and access proxy, and Keto serves access control policies like AWS IAM. Each is standalone and pairs naturally with Hydra.
Who is actually using it?OpenAI, Klarna, Cisco, Mistral, Fandom, Hootsuite, Segment, and thousands of other companies. The Ory community counts over 50,000 members, and the stack protects more than 7 billion API requests every day.
What are similar projects?zitadel, authentik, casdoor, kratos, logto, dex, oauth2-proxy, keycloak
Which topics is it in?federation, openid-connect, identity, authorization, oidc, jwt, freebsd, sso, oauth2, oauth, mysql, authentication
Creator
ory
Size
123.2 MB
Stars
17.6K
Updated
CommitJul 29Releasev26.2.0Mar 20
Age
11y
Commits · 90 Days