Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs

Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and derives API keys and short-lived tokens for high-throughput systems.

---

• What is Ory Talos?
  • Why Ory Talos
• Deployment options
  • Use Ory Talos on the Ory Network
  • Self-host Ory Talos
• Quickstart
• Who is using Ory Talos
• Ecosystem
  • Ory Kratos: Identity and User Infrastructure and Management
  • Ory Hydra: OAuth2 & OpenID Connect Server
  • Ory Oathkeeper: Identity & Access Proxy
  • Ory Keto: Access Control Policies as a Server
• Documentation
• Developing Ory Talos
• Security
  • Disclosing vulnerabilities
• Telemetry

What is Ory Talos?

Ory Talos is a server for issuing, verifying, and managing API keys. It follows cloud architecture best practices and focuses on:

• Issuing, verifying, and revoking API keys at scale
• Importing externally-issued API keys for unified verification
• Deriving short-lived JWT and macaroon tokens from long-lived keys
• Side-car deployment for fast API key verification
• Low-latency verification with caching and eventual revocation
• Predictable operations through structured logging, metrics, and tracing

We recommend starting with the Ory Talos documentation to learn more about its architecture, feature set, and how it compares to other systems.

Why Ory Talos

Ory Talos is designed to:

• Run as a single binary with three deployment modes: admin, self-service, or all-in-one
• Verify API keys against the database with caching for low latency, while derived JWT and macaroon tokens verify offline without a database lookup
• Separate admin and self-service surfaces so key creation, revocation, derivation, and verification scale and are secured independently from proof-of-possession self-revocation
• Scale horizontally with external databases (Postgres, MySQL, CockroachDB) and optional distributed caching
• Fit modern cloud-native environments such as Kubernetes and managed platforms
• Mint reduced-scope, short-lived tokens offline so agents, CI/CD jobs, and services don't call the server on every request
• Keep credential routing, hashing, and verification centralized and constant-time

Deployment options

You can run Ory Talos in two main ways:

• As a managed service on the Ory Network
• As a self-hosted service under your own control, with or without the Ory Enterprise License

Use Ory Talos on the Ory Network

The Ory Network is the fastest way to use Ory Talos in production.

The Ory Network provides:

• API key issuance, verification, and derivation with low-latency global edge
• OAuth2 and OpenID Connect for single sign on, API access, and machine to machine authorization
• Identity and credential management that scales to billions of users and devices
• Registration, login, and account management flows for passkeys, biometrics, social login, SSO, and multi factor authentication
• Prebuilt login, registration, and account management pages and components
• Low latency permission checks based on the Zanzibar model with the Ory Permission Language
• GDPR friendly storage with data locality and compliance in mind
• Web based Ory Console and Ory CLI for administration and operations
• Cloud native APIs compatible with the open source servers
• Fair, usage based pricing

Sign up for a free developer account to get started.

Self-host Ory Talos

You can run Ory Talos yourself for full control over infrastructure, deployment, and customization.

The install guide explains how to:

• Install Ory Talos on Linux, macOS, Windows, and Docker
• Configure databases such as SQLite, PostgreSQL, MySQL, and CockroachDB
• Deploy to Kubernetes and other orchestration systems

The open source distribution runs as a single instance against an embedded SQLite database. It is a great fit for individuals, researchers, hackers, and companies that want to experiment, prototype, or run low-traffic workloads without service level agreements (SLAs).

If you run Ory Talos as part of a business-critical system, for example API key verification on a hot path, you should use a commercial agreement to reduce operational and security risk. The Ory Enterprise License (OEL) layers on top of self-hosted Ory Talos and provides:

• Multi-node deployments backed by external databases (Postgres, MySQL, CockroachDB)
• Multi-tenancy, distributed caching, rate-limit enforcement, and edge verification nodes
• Regular security releases, including CVE patches, with SLAs
• Support for advanced scaling and complex deployments
• Premium support options with response SLAs, direct access to engineers, and onboarding help
• Access to a private Docker registry with frequent, vetted enterprise builds

For guaranteed CVE fixes, current enterprise builds, advanced features, and production support, you need a valid Ory Enterprise License and access to the Ory Enterprise Docker registry. To learn more, contact the Ory team.

Quickstart

Install the Ory CLI and use the managed Ory Network, or run Ory Talos locally with Docker Compose.

# Install the Ory CLI if you do not have it yet:
bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory
sudo mv ./ory /usr/local/bin/

# Sign in or sign up
ory auth

# Create a new project
ory create project --create-workspace "Ory Open Source" --name "GitHub Quickstart" --use-project

To run Ory Talos locally:

# Open source edition (SQLite, single-node)
docker-compose -f docker-compose.oss.yaml up --build

The API will be available at http://localhost:4420

For end-to-end walkthroughs of issuing, verifying, and revoking keys, see the Quickstart guide and Issue and verify.

Who is using Ory Talos