ory/talosScalable API key server for issuing, verifying, and revoking credentials with token derivation for fine-grained capability tokens. Supports low-latency verification, horizontal scaling, and cloud-native deployment.
Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and derives API keys and short-lived tokens for high-throughput systems.
Ory Talos is a server for issuing, verifying, and managing API keys. It follows cloud architecture best practices and focuses on:
We recommend starting with the Ory Talos documentation to learn more about its architecture, feature set, and how it compares to other systems.
Ory Talos is designed to:
You can run Ory Talos in two main ways:
The Ory Network is the fastest way to use Ory Talos in production.
The Ory Network provides:
Sign up for a free developer account to get started.
You can run Ory Talos yourself for full control over infrastructure, deployment, and customization.
The install guide explains how to:
The open source distribution runs as a single instance against an embedded SQLite database. It is a great fit for individuals, researchers, hackers, and companies that want to experiment, prototype, or run low-traffic workloads without service level agreements (SLAs).
If you run Ory Talos as part of a business-critical system, for example API key verification on a hot path, you should use a commercial agreement to reduce operational and security risk. The Ory Enterprise License (OEL) layers on top of self-hosted Ory Talos and provides:
For guaranteed CVE fixes, current enterprise builds, advanced features, and production support, you need a valid Ory Enterprise License and access to the Ory Enterprise Docker registry. To learn more, contact the Ory team.
Install the Ory CLI and use the managed Ory Network, or run Ory Talos locally with Docker Compose.
# Install the Ory CLI if you do not have it yet:
bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory
sudo mv ./ory /usr/local/bin/
# Sign in or sign up
ory auth
# Create a new project
ory create project --create-workspace "Ory Open Source" --name "GitHub Quickstart" --use-project
To run Ory Talos locally:
# Open source edition (SQLite, single-node)
docker-compose -f docker-compose.oss.yaml up --build
The API will be available at http://localhost:4420
For end-to-end walkthroughs of issuing, verifying, and revoking keys, see the Quickstart guide and Issue and verify.
The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 50.000 members and is growing. The Ory stack protects 7.000.000.000+ API requests every day across thousands of companies. None of this would have been possible without each and everyone of you!
If you would like to be featured here once Ory Talos lands on the Network, reach out to [email protected].
Many thanks to all individual contributors
We build Ory on several guiding principles when it comes to our architecture design:
Ory's architecture is designed to run best on a container orchestration system such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are small and available for all popular processor types (ARM, AMD64, i386) and operating systems (FreeBSD, Linux, macOS, Windows) without system dependencies (Java, Node, Ruby, libxml, ...).
Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with: Self-service Login and Registration, Multi-Factor Authentication (MFA/2FA), Account Recovery and Verification, Profile, and Account Management.
Ory Hydra is an OpenID Certified™ OAuth2 and OpenID Connect Provider which easily connects to any existing identity system by writing a tiny "bridge" application. It gives absolute control over the user interface and user experience flows.
Ory Oathkeeper is a BeyondCorp/Zero Trust Identity & Access
Proxy (IAP) with configurable authentication, authorization, and request mutation rules for your web
services: Authenticate JWT, Access Tokens, API Keys, mTLS; Check if the contained subject is allowed
to perform the request; Encode resulting content into custom headers (X-User-ID), JSON Web Tokens
and more!
Ory Keto is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.
The Ory Talos documentation lives at www.ory.com/docs/talos.
See CONTRIBUTING.md for information on:
Ory Talos handles credentials on the hot path: raw API keys, derived tokens, and signing keys. The implementation uses constant-time comparisons, centralized credential routing, and per-tenant network isolation. Read the security model and security hardening guide for the details on cryptography, tenant isolation, and operational hardening.
If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. You can find all info for responsible disclosure in our security.txt.
Our services collect summarized, anonymized data that can optionally be turned off. Click here to learn more.
Ory Community: