Ory gives software teams the building blocks for login, authorisation and permissions inside their own products, for consumers, business customers and now AI agents. It suits companies that want full control of the sign-in experience and the identity data behind it, rather than a hosted login page they cannot change.
The components are open source and can be run by Ory as a managed service or by the customer, so the same identity layer serves a startup and a regulated enterprise.
At A Glance
| Vendor | Ory |
|---|---|
| Category | Customer, B2B and agent identity and access management |
| Identities covered | Customers, business users, machine-to-machine clients, API keys, AI agents |
| Deployment | Ory Network (managed SaaS), Ory Enterprise License (self-hosted), open source |
| Agentic AI | Agent IAM, Ory MCP Server, Talos capability tokens |
| Customers | OpenAI, Societe Generale, Mistral AI, T. Rowe Price, RetailMeNot |
| Certifications | ISO 27001, SOC 2 Type 2, PCI DSS SAQ D for Service Providers |
| Market classification | Customer Identity & Access |
What Ory Does
Developers building an app need registration, sign-in, MFA, OAuth for partners and rules about who can see what. Ory supplies these as headless APIs, so the customer keeps “unlimited UI/UX ownership” and designs every screen while Ory handles the security logic. The same APIs and protocols work whether the customer runs open source, self-hosts under licence or uses the managed network, so a team can start small and move without rewriting.
The platform is organised around three audiences: customer IAM, B2B IAM and Agent IAM. Its guiding rule is that every request, whether from a person, an app or an AI agent, is verified and authorised.
Products
Ory Network
Ory Network is the hosted service for teams that want Ory’s components without running them. A no-code Console, the Account Experience login UI and Ory Elements components speed up building the front end.
- Passkeys and MFA with FaceID, TouchID, YubiKeys and other passkeys, plus social sign-in and enterprise SSO
- B2B organisations, multi-tenancy, audit logs and GDPR and CCPA data-homing
- Management through CLI, GUI and a Terraform provider
Open-Source Components
Each component solves one identity problem and can be used on its own or combined.
| Kratos | Identity management, registration and sign-in. |
|---|---|
| Hydra | A certified OAuth 2.0 and OpenID Connect server. |
| Keto | A permission server modelled on Google Zanzibar, supporting RBAC, ABAC and ACL. |
| Polis | SAML and OIDC federation for B2B customers. |
| Oathkeeper | An IAM proxy in front of applications and APIs. |
Ory Talos
Talos tackles the risk of long-lived API keys. It turns them into “short-lived capability tokens for non human identities” based on Macaroons, whose permissions can be narrowed but never widened. Tokens carry IP allowlists and expiry times, revoking a parent key kills every token derived from it, and recognisable prefixes let secret scanners spot leaked keys. Talos ships with the Ory Enterprise License and Ory Network, with a pruned open-source version.
How It Works
| Component | What it does |
|---|---|
| Ory Network | Ory hosts and operates the service in three super regions, Europe, North America and Japan, on Google Cloud Platform across multiple data centres and zones. CockroachDB handles failover and replicates data across regions, services are stateless, and tenant workloads are isolated. |
| Self-hosted | The Ory Enterprise License delivers Ory’s codebase with premium support for on-premises, private cloud or air-gapped installations. The Ory CLI migrates open-source deployments to Ory Network. |
| Tokens | Ory Network issues stateless JWT access tokens and supports OAuth 2.1 and token exchange. |
Identities And Systems Covered
| Customers | Registration, passwordless sign-in and social login. |
|---|---|
| Business users | Organisations, enterprise SSO and directory sync. |
| Machine identities | OAuth 2.0 clients and API keys used by microservices. |
| AI agents | Agent identities that record “which agent, on whose behalf, with what permissions.” |
Agentic AI Capabilities
Agent IAM
Agent IAM applies the platform to AI agents and autonomous workflows. Agents authenticate and refresh tokens through headless APIs without a login page, with their permission policies held centrally in Keto and their credentials issued through Talos. MCP authentication is supported, and parameter-level authorisation of agent calls to MCP tools is available through a partner integration.
Ory MCP Server
The Ory MCP Server, published as the npm package @ory/mcp-server, runs locally and lets an AI assistant manage identities, OAuth2 clients, permission relationships and Ory Network settings from a chat session.
Integrations
| Area | Integrations |
|---|---|
| AI agent tools | Anthropic Claude Agent SDK, Gemini CLI, OpenAI Codex, Claude Code, Cursor |
| Infrastructure | AWS API Gateway, Terraform provider |
Company Background
| Founded | The open-source project started in 2015, and the founders formed the company in 2019 to build a cloud business. |
|---|---|
| Headquarters | Doylestown, United States, with an office in Munich, Germany. |
| Founders | Thomas Aidan Curran and Aeneas Rekkas, now CTO, who designed Ory Hydra and Ory Kratos. |
| Leadership | Jeff Kukowski (CEO), Greg Vesper (Chief Product Officer), Justin Dolly (Chief Customer and Security Officer), Rob Murray (Chief Revenue Officer) and Colleen Shannon (CFO). |
| Funding | A $22.5M Series A led by Insight Partners in January 2022. |
| Scale | A reported 3.3 billion identities managed; OpenAI uses Ory for more than 1.2 billion weekly active users. |
Note: This overview is compiled from Ory’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.