Ory Kratos — Cloud-Native Identity and User Management

What it is

Ory Kratos is a headless, API-first identity and user management server. It handles registration, login, multi-factor authentication, account recovery, profile management, and session handling without bundling a UI. You build your own frontend and call Kratos APIs, keeping full control over the user experience.

Platform engineers, security teams, and backend developers who need production-grade identity management without vendor lock-in use Kratos. It is part of the Ory ecosystem alongside Hydra (OAuth2), Oathkeeper (API gateway), and Keto (permissions).

How it saves time or tokens

Kratos handles the security-critical parts of identity (password hashing, session tokens, CSRF protection, account enumeration prevention) so developers do not build and maintain these themselves. The self-service flow system covers registration, login, settings, recovery, and verification with configurable identity schemas, reducing custom code.

How to use

1. Run Kratos with Docker:

docker run --rm -p 4433:4433 -p 4434:4434 \
  -e DSN=memory \
  oryd/kratos:latest serve --dev

1. Access the public API at http://localhost:4433 and admin API at http://localhost:4434.
2. Initiate a registration flow:

curl -s http://localhost:4433/self-service/registration/api | python3 -m json.tool

Example

# Create a registration flow
FLOW=$(curl -s http://localhost:4433/self-service/registration/api)
ACTION=$(echo $FLOW | python3 -c "import sys,json; print(json.load(sys.stdin)['ui']['action'])")

# Submit registration
curl -X POST "$ACTION" \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "password",
    "traits": {"email": "user@example.com"},
    "password": "secure-password-123"
  }'

Related on TokRepo

• AI tools for security — Security and identity tools
• AI tools for self-hosted — Self-hosted infrastructure tools

Common pitfalls

• Kratos is headless, meaning you must build your own login/registration UI. If you want a pre-built UI, check the Ory Account Experience or use the community reference implementations.
• Running Kratos with --dev flag in production. The dev mode disables security features like CSRF and cookie security. Always use proper configuration for production deployments.
• Confusing Kratos (identity) with Hydra (OAuth2). Kratos manages users and sessions. Hydra provides OAuth2/OIDC flows. They are separate services that work together.