Ory Kratos

Ory Kratos is a production-grade, security-reviewed headless identity server — it handles identity flows (registration, login, recovery, verification, settings) via a REST API while leaving the UI entirely to the application (headless). This makes it flexible for custom UI design while providing battle-tested security for the auth logic. Part of the broader Ory ecosystem (Keto for permissions, Hydra for OAuth2). Self-hostable or managed via Ory Network. Confidence is docs-derived.

REST API (self-hosted: http://localhost:4433, Ory Network: {project}.projects.oryapis.com). Flow-based model: GET /self-service/login/browser initializes a login flow; client renders form; POST /self-service/login submits credentials. Identity management: GET /admin/identities lists identities; POST /admin/identities creates an identity; GET /sessions/whoami returns current session. OAuth2 social sign-in configured via Ory Network or self-hosted config. SDK: ory/sdk-node, ory/sdk-go, ory/sdk-python.

Admin API: ory-api-key header for admin operations (identity CRUD, session management). Self-hosted: API key in config. Ory Network: workspace token for admin API. Public API (flows, session check): no auth required (sessions managed via HTTP cookies or bearer tokens). HTTPS enforced on Ory Network. TLS for self-hosted production.

Flow model prevents CSRF and replay attacks by design. Session tokens short-lived with configurable expiry. Recovery flows time-boxed. Security-reviewed codebase (Ory is security-focused by mission). Self-hosted: reliability is operator's responsibility (PostgreSQL backing required for production). Ory Network uptime at status.ory.sh.

ory.sh/docs/kratos covers quickstart, identity schema, flow types (login/registration/recovery/settings), social sign-in, and self-hosting guide. Getting started: ory tunnel (Ory Network dev) or docker-compose (self-hosted). SDK for Node.js, Go, Python. Community via Ory Slack and GitHub.