// the find
ory/kratos
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
Ory Kratos is a headless identity server written in Go that handles login, registration, account recovery, MFA, and profile management as a standalone service your app talks to over HTTP. It's for teams that want to own their auth infrastructure without building it from scratch — the target is a self-hosted alternative to Auth0 or Firebase Auth, not a library you embed. OpenAI and Klarna are in the adopters list, so it's clearly production-hardened at scale.
The flow model is genuinely well-designed: browser flows and native app flows are first-class citizens handled separately, which avoids the usual mess of trying to shoehorn OAuth redirect flows into a mobile app. Identity schemas are defined in JSON Schema, meaning you can extend the identity model (add a `company_id` field, make `username` required) without forking the server — that flexibility is rare in identity systems. The courier/channel abstraction for email and SMS is clean; you can plug in HTTP webhooks, SMTP, or Twilio with config changes. The test surface is serious — snapshot tests, integration tests against real databases, and a calibration tool for Argon2 parameters.
SAML and organization SSO (the 'login with your company IdP' flow) are behind the enterprise license, which means self-hosters hit a wall exactly when their largest customers ask for it. The configuration surface is enormous — the main config schema has hundreds of keys, and getting passkeys + OIDC + MFA working together correctly requires reading a lot of docs before anything works. Upgrading between major versions has historically been painful; SQL migrations are cumulative and some have required manual intervention. If you need a simple 'username + password for an internal tool', Kratos is significant operational overhead compared to something like Authelia.