Need support?

Need to move quickly?

• Full OAuth 2.0 spec coverage

  Implements the complete OAuth 2.0 standard as defined by the IETF — authorization code, client credentials, refresh token, PKCE, and token exchange flows. Integrates with Ory Kratos or any open-source or proprietary identity provider.

• OpenID Certified®

  The OpenID Foundation has certified Ory Hydra as a conformant OpenID Connect provider. All flows specified by the IETF and OpenID Foundation are implemented and tested against the certification suite.

• Bring your own UX

  Use your own branding, login screens, and consent pages for every OAuth 2.0 and OpenID Connect flow. Ory Hydra exposes the protocol; you control the UX. Powered by a documented REST API and CLI.

• Compatible with MITREid

  Drop-in migration path from MITREid Connect. Hydra ships with documentation for migrating client registrations, key material, and active sessions with minimal downtime.

• Cryptographic key storage

  Cryptographic keys for JWT signing are stored encrypted at rest. Manage OAuth 2.0 clients, rotate signing keys, and issue tokens directly from the CLI or Admin API.

• Production-grade scale and performance

  Stateless, horizontally scalable architecture. Ory Hydra serves tokens to systems with millions of users and tens of millions of weekly token issuances — battle-tested for security incident reduction and operational simplicity.

How to de-risk identity at scale with Ory

OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.

Deploy Ory Hydra on your preferred infrastructure

Run the same OAuth 2.0 and OpenID Connect server three ways — fully open source, self-hosted with a commercial license, or fully managed on Ory Network. Same APIs, same OpenID Certified® engine, same protocol semantics across all three.

const express = require('express');
const app = express();
const { AuthorizationCode } = require("simple-oauth2")
const client = new AuthorizationCode({
  client: {
    id: process.env.CLIENT_ID,
    secret: process.env.CLIENT_SECRET,
  },
  auth: {
    tokenHost: "https://<your-project>.projects.oryapis.com",
    tokenPath: "/oauth2/token",
    authorizePath: "/oauth2/auth",
  },
})
app.get("/", (req, res) => {
  const authorizationUri = client.authorizeURL({
    redirect_uri: REDIRECT_URI,
    scope: "openid offline",
  })
  res.redirect(authorizationUri)
})
app.get("/callback", async (req, res) => {
  const { code } = req.query
  try {
    const accessToken = await client.getToken({
      code,
      redirect_uri: process.env.REDIRECT_URI,
      scope: "openid offline",
    })
    res.json(accessToken.token)
  } catch (error) {
    res.status(500).json({ error: error.message })
  }
})