Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs

Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and consent app, giving you absolute control over the user interface and experience.

---

• What is Ory Hydra?
  • Why Ory Hydra
  • OAuth2 and OpenID Connect: Open Standards
  • OpenID Connect Certified
• Deployment options
  • Use Ory Hydra on the Ory Network
  • Self-host Ory Hydra
• Quickstart
• Who is using Ory Hydra
• Ecosystem
  • Ory Kratos: Identity and User Infrastructure and Management
  • Ory Hydra: OAuth2 & OpenID Connect Server
  • Ory Oathkeeper: Identity & Access Proxy
  • Ory Keto: Access Control Policies as a Server
• Documentation
• Developing Ory Hydra
• Security
  • Disclosing vulnerabilities
• Telemetry
• Libraries and third-party projects

What is Ory Hydra?

Ory Hydra is a server implementation of the OAuth 2.0 authorization framework and the OpenID Connect Core 1.0. It follows cloud architecture best practices and focuses on:

• OAuth 2.0 and OpenID Connect flows
• Token issuance and validation
• Client management
• Consent and login flow orchestration
• JWKS management
• Low latency and high throughput

We recommend starting with the Ory Hydra introduction docs to learn more about its architecture, feature set, and how it compares to other systems.

Why Ory Hydra

Ory Hydra is designed to:

• Be a standalone OAuth 2.0 and OpenID Connect server without user management
• Connect to any existing identity provider through a login and consent app
• Give you absolute control over the user interface and experience flows
• Work with any authentication endpoint: Ory Kratos, authboss, User Frosting, or your proprietary system
• Scale to large numbers of clients and tokens
• Fit into modern cloud native environments such as Kubernetes and managed platforms

OAuth2 and OpenID Connect: Open Standards

Ory Hydra implements Open Standards set by the IETF:

• The OAuth 2.0 Authorization Framework
• OAuth 2.0 Threat Model and Security Considerations
• OAuth 2.0 Token Revocation
• OAuth 2.0 Token Introspection
• OAuth 2.0 for Native Apps
• OAuth 2.0 Dynamic Client Registration Protocol
• OAuth 2.0 Dynamic Client Registration Management Protocol
• Proof Key for Code Exchange by OAuth Public Clients
• JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

and the OpenID Foundation:

• OpenID Connect Core 1.0
• OpenID Connect Discovery 1.0
• OpenID Connect Dynamic Client Registration 1.0
• OpenID Connect Front-Channel Logout 1.0
• OpenID Connect Back-Channel Logout 1.0

OpenID Connect Certified

Ory Hydra is an OpenID Foundation certified OpenID Provider (OP).

The following OpenID profiles are certified:

• Basic OpenID Provider (response types code)
• Implicit OpenID Provider (response types id_token, id_token+token)
• Hybrid OpenID Provider (response types code+id_token, code+id_token+token, code+token)
• OpenID Provider Publishing Configuration Information
• Dynamic OpenID Provider

To obtain certification, we deployed the reference user login and consent app (unmodified) and Ory Hydra v1.0.0.

Deployment options

You can run Ory Hydra in two main ways:

• As a managed service on the Ory Network
• As a self hosted service under your own control, with or without the Ory Enterprise License

Use Ory Hydra on the Ory Network

The Ory Network is the fastest way to use Ory services in production. Ory OAuth2 & OpenID Connect is powered by the open source Ory Hydra server and is API compatible.

The Ory Network provides:

• OAuth2 and OpenID Connect for single sign on, API access, and machine to machine authorization
• Identity and credential management that scales to billions of users and devices
• Registration, login, and account management flows for passkeys, biometrics, social login, SSO, and multi factor authentication
• Prebuilt login, registration, and account management pages and components
• Low latency permission checks based on the Zanzibar model with the Ory Permission Language
• GDPR friendly storage with data locality and compliance in mind
• Web based Ory Console and Ory CLI for administration and operations
• Cloud native APIs compatible with the open source servers
• Fair, usage based pricing

Sign up for a free developer account to get started.

Self-host Ory Hydra

You can run Ory Hydra yourself for full control over infrastructure, deployment, and customization.

The install guide explains how to:

• Install Hydra on Linux, macOS, Windows, and Docker
• Configure databases such as PostgreSQL, MySQL, and CockroachDB
• Deploy to Kubernetes and other orchestration systems
• Build Hydra from source