Overview
Ory builds identity as separate, headless services: Kratos for registration, login, MFA and account recovery; Hydra as an OAuth2 and OpenID Connect server; Keto for Zanzibar-style permissions; and Oathkeeper as an identity proxy. Because it is headless, you build every screen yourself or start from Ory's UI examples, and you keep full control of UX. Ory reports 48,000 GitHub stars across its projects and 3.3 billion managed identities.
You can self-host the open-source components for free, buy an Enterprise License for a supported self-hosted build, or use Ory Network, the managed SaaS. The Network's free Developer plan is for building only: it has development environments but no production environment.
Production costs $770 a year with one production and three staging environments, then bills $0.14 per average daily active user each month after a $21 monthly credit, plus small charges for M2M tokens and permission checks. Growth, at $9,350 a year, adds analytics and OIDC-based B2B SSO, while SAML-grade enterprise features, multi-tenancy and data residency sit in Enterprise. Ory is a strong fit for large-scale or highly custom systems, and more work than drop-in auth for a small app.
Pricing and plans
Free tier
Open-source components free to self-host; the Ory Network Developer plan is free for 1 member and 2 development environments, with no production environment
At the limit Not stated The vendor does not say what happens at the limit, or we have not found it yet.
| Plan | Price | What you get |
|---|---|---|
| Open source | Free | Self-host Ory components |
| Developer | Free | Ory Network, 1 member, 2 development environments, no production |
| Production | $770/yr | 1 production + 3 staging envs, $21/mo usage credit, $0.14/aDAU, $0.007/M2M token |
| Growth | $9,350/yr | 2 production envs, analytics, B2B SSO (OIDC only), $255/mo credit, $0.12/aDAU |
| Enterprise | Custom | Multi-region data residency, multi-tenancy, 99.99% SLA |
| Enterprise License | Custom | Self-hosted optimized build with premium support |
What it does
- Ory Kratos
- Identity and user management: registration, login, passwordless, MFA, account recovery and verification via APIs.
- Ory Hydra
- OAuth2 and OpenID Connect server to make your app an identity provider for other apps.
- Ory Keto
- Relationship-based permission checks modelled on Google Zanzibar, billed per check on the Network.
- Headless design
- No forced UI; you own every login and settings screen.
- aDAU billing
- Usage is billed on average daily active users rather than monthly actives.
- Agent security
- Identity and runtime permissions for AI agents across tools such as coding agents.
Strengths and limitations
Strengths
- Open-source core that can be self-hosted anywhere
- Modular: use only the OAuth2 server or only permissions if that is all you need
- Full control over the login UI
- Stateless services designed for horizontal scaling
Limitations
- The free Network plan has no production environment
- B2B SSO on the Network needs Growth at $9,350/yr and is OIDC-only there
- Headless design means building your own UI
- Data residency and multi-tenancy on the Network are Enterprise features
Who it suits
Good for
- Platform teams building identity into large products
- Teams that need an OAuth2/OIDC server of their own
- Apps needing fine-grained, relationship-based permissions
Look elsewhere if
- Small apps that want prebuilt login UI components
- Early B2B products needing cheap SAML SSO on a managed plan
Alternatives to Ory Network
| Tool | From | Free option | Stages |
|---|---|---|---|
| Authgear Open-source CIAM (cloud, VPC or one-time self-host licence) | $50/mo | Free tier | |
| Scalekit Auth for AI agents and MCP servers | $99/mo | Free tier | |
| Zitadel Open-source multi-tenant identity (cloud or self-hosted) | $100/mo | Free tier | |
| Auth0 Hosted customer identity (CIAM) | $35/mo | Free tier | |
| WorkOS AuthKit Hosted auth with enterprise SSO | $125/mo | Free tier | |
| Stytch Hosted auth API (B2B and consumer) | $125/mo | Free tier |
Questions
Is Ory open source?
Yes. Ory's components such as Kratos, Hydra and Keto can be run on your own infrastructure; the managed Ory Network and Enterprise License are paid.
How much does Ory Network cost?
Production is $770 a year, which includes a $21 monthly usage credit, then $0.14 per average daily active user per month.
What is an aDAU?
An average daily active user, the unit Ory Network uses to bill identity usage.
Can I use Ory Network free in production?
No. The free Developer plan includes only development environments; production needs a paid plan.
Sources read for this page