Ory Hydra — Open-Source OAuth 2.0 and OpenID Connect Server

What it is

Ory Hydra is a hardened, OpenID Foundation-certified OAuth 2.0 and OpenID Connect provider written in Go. Unlike full identity platforms like Keycloak or Auth0, Hydra focuses exclusively on the OAuth/OIDC protocol layer: token issuance, consent flows, client management, and token introspection. It deliberately does not include user management or login UI, letting you bring your own.

It targets teams that need standards-compliant OAuth 2.0 infrastructure but want to keep control over their user database, login experience, and registration flows.

How it saves time or tokens

Implementing OAuth 2.0 correctly from scratch is a multi-month effort with significant security risk. Hydra provides a certified, battle-tested implementation that handles the hard parts (token lifecycle, PKCE, consent management, token revocation) while integrating with your existing user store. You write the login UI and user lookup; Hydra handles everything else.

How to use

1. Deploy Hydra using Docker or the binary release. Configure it with a PostgreSQL or MySQL database for persistence.
2. Register OAuth 2.0 clients with hydra create client --grant-type authorization_code --response-type code.
3. Implement two endpoints in your application: a login endpoint and a consent endpoint. Hydra redirects users to these during the OAuth flow.

Example

# Start Hydra with Docker
docker run -d --name hydra \
  -p 4444:4444 -p 4445:4445 \
  -e DSN='postgres://hydra:secret@db:5432/hydra?sslmode=disable' \
  -e URLS_SELF_ISSUER='https://auth.example.com/' \
  -e URLS_LOGIN='https://app.example.com/login' \
  -e URLS_CONSENT='https://app.example.com/consent' \
  oryd/hydra serve all

# Create an OAuth 2.0 client
hydra create client \
  --endpoint http://localhost:4445 \
  --grant-type authorization_code \
  --response-type code \
  --scope openid,offline \
  --redirect-uri https://app.example.com/callback

Related on TokRepo

• Security tools — Authentication and authorization solutions
• Self-hosted tools — Run your own identity infrastructure

Common pitfalls

• Hydra does not include user management. You must build or integrate a separate user store and login UI. This is by design but surprises teams expecting a full IdP.
• The admin API (port 4445) must never be exposed to the internet. It allows client creation and token management without authentication.
• Database migrations must run before starting a new Hydra version. Skipping migrations causes runtime errors.