Ory Hydra

Ory Hydra is the gold-standard open-source OAuth2/OIDC server — used by enterprises that need full control over their authorization server infrastructure without vendor lock-in. Hydra separates concerns cleanly: it handles OAuth2 token issuance while delegating user identity to a separate identity provider (Ory Kratos or existing IdP). For agents: the Admin API manages OAuth2 clients (create/update/delete), introspects tokens, manages consent requests, and controls login/logout flows. Self-hostable with Postgres or MySQL backend. Ory Network provides managed hosting. Confidence is docs-derived.

Admin REST API at {hydra_admin_url}. OAuth2 Clients: POST /admin/clients creates client ({client_id, client_secret, grant_types: ["client_credentials"], scope: "api", redirect_uris}). GET /admin/clients lists clients. PUT /admin/clients/{id} updates client. DELETE /admin/clients/{id} deletes client. Token introspection: POST /admin/oauth2/introspect ({token}) → {active, scope, client_id, exp}. Consent flow: GET /admin/oauth2/auth/requests/consent?consent_challenge={challenge} retrieves consent request. PUT /admin/oauth2/auth/requests/consent/accept accepts consent ({grant_scope, session: {id_token}}). GET /admin/oauth2/tokens lists active tokens (filter by client, subject). Public endpoints (no auth): POST /oauth2/token ({grant_type: client_credentials, scope, client_id, client_secret}) issues token. GET /.well-known/openid-configuration OIDC discovery.

Admin API: no auth by default — must network-isolate admin port (default 4445) from public access. Recommended: deploy behind API gateway with IP allowlist or mTLS for admin endpoints. Public API (port 4444): standard OAuth2 client auth (client_id + client_secret for client_credentials flow). HTTPS enforced in production (Ory Network). Token signing: RSA or ECDSA key pairs managed by Hydra. Client credentials: stored hashed in Postgres/MySQL. Ory Network: API key auth for cloud console management.

Standard HTTP status codes with JSON error bodies ({error, error_description}). 404 for unknown client. Token introspection: inactive=true for expired/revoked tokens (not HTTP error). Consent flow: tight timing — consent request expires after configurable timeout. Database: Postgres (recommended) or MySQL required for persistence. Hydra uptime (Ory Network): status.ory.sh. Self-hosted: operator-managed reliability. Migration: DSN migration script required for schema updates. Consent app: teams must build their own consent UI (Hydra provides only the OAuth2 protocol layer).

ory.sh/hydra/docs covers Admin API reference, consent flow guide, Docker deployment, Postgres setup, and client credential management. Getting started: docker run ory/hydra start, first client created in under 10 minutes. Official SDKs: ory/client-go, ory/client-typescript, ory/client-python, ory/client-php, ory/client-java, ory/client-dotnet. Open-source (GitHub: ory/hydra, 15k+ stars). Community via Ory Slack (active) and GitHub. Documentation is thorough for an infrastructure-level OAuth2 server.