Authentication & Identity Management (IAM)
4.0/5.0
VerifiedFreemiumLast technical review:
Markdown for AI (.md)

Ory

API-first, cloud-native identity and access management (IAM) platform.

Pricing

$0/mo

Freemium
Score

4.0/5

Last technical review
2026-10-28
Available plansVisit website (opens in a new tab)

Technical Overview

Ory is a modular identity and access management (IAM) suite designed for modern applications and AI agents. It provides authentication (Kratos), OIDC/OAuth2 (Hydra), fine-grained authorization (Keto), zero-trust proxy (Oathkeeper), and non-human identity management (Talos). Its API-first architecture supports both managed cloud deployments and self-hosted environments, offering high flexibility for complex enterprise scaling requirements.

Analyst Evaluation: Pros and Limitations

Verified Advantages

  • Modular architecture allowing selective service deployment.
  • Native support for open standards like OIDC and OAuth2.
  • Versatile deployment options between managed cloud and self-hosting.

Technical Considerations

  • Steep learning curve due to the complexity of individual components.
  • Advanced configuration requires deep technical security knowledge.

Technical Capabilities & Features

7/7
Included:REST & GraphQL API
Included:SSO / SAML Authentication
Included:Self-Hosted Option
Included:Full Data Export
Included:Role-Based Access Control (RBAC)
Included:Custom Domains & SSL
Included:Immutable Audit Logs
Scorecard
Show detailsHide details

Technical Scorecard: Ory

70/100
DX & Tech Documentation
Favorable
77/100
Pricing Fairness
Favorable
76/100
Security & Governance
Favorable
64/100
Data Portability & Sovereignty
Improvable
58/100
Performance & Reliability
Favorable
76/100
Pricing & TCO
Show detailsHide details

Pricing

$0.00/mo

Model: FREEMIUM.

Free Tier Verification:

  • No credit card required
  • Commercial use allowed
  • Monthly recurring quota reset
  • No mandatory watermarks
Get Ory (opens in a new tab)

Billing Risks & Hidden Clauses: Ory

Free Tier Limits:

Core services are open-source with managed cloud tiers available.

Audited Billing Critical Points:
  • Self-hosting requires dedicated engineering resources for maintenance.
  • Enterprise-grade security features may be limited in free tiers.
Total Cost of Ownership (TCO) Projection: Ory$0.00/mo
Deterministic cost estimation at 12 and 36 months based on team size, including SSO tax premiums and annual prepay discounts.
Show detailsHide details
Indie / Solo (1 active user)

Solo developer or independent technical founder.

Base Monthly Cost
$12/month
1 active user
12-Month Investment
$122/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$366total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 3 active users

Calculated infrastructure: VPS 1 vCPU / 2GB RAM (~$5) + 0.5h DevOps/mes ($20)

Annual VPS + DevOps Cost$300/year
Differential vs SaaS LicensingSaaS is $178/year
Startup (10 active users)

Agile engineering team in validation and early traction stage.

Base Monthly Cost
$270/month
10 active users
12-Month Investment
$2,754/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$8,262total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 5 active users

Calculated infrastructure: VPS 2 vCPU / 8GB RAM (~$15) + 2h DevOps/mes ($80)

Annual VPS + DevOps Cost$1,140/year
Differential vs SaaS LicensingSavings of $1,614/year
Growth (25 active users)

Scaling company with team governance and granular access control requirements.

Base Monthly Cost
$675/month
25 active users
12-Month Investment
$6,885/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$20,655total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 13 active users

Calculated infrastructure: Cluster VPS 4 vCPU / 16GB RAM (~$45) + 6h DevOps/mes ($240)

Annual VPS + DevOps Cost$3,420/year
Differential vs SaaS LicensingSavings of $3,465/year
Scaleup (100 active users)

Established organization with enterprise security policies and mandatory SAML/SSO.

Base Monthly Cost
$2,700/month
100 active users
12-Month Investment
$27,540/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$82,620total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 35 active users

Calculated infrastructure: Infraestructura HA redundante + Backups (~$150) + 16h DevOps/mes ($640)

Annual VPS + DevOps Cost$9,480/year
Differential vs SaaS LicensingSavings of $18,060/year
Usage Surcharges & Bill Shock Simulator: OryWhat usage costs as you scale
Detect overage penalties before they impact engineering budget.
Show detailsHide details

Prototype / MVP (10 GB)

Included base quota in plan: 5 GB.
Low Risk / Predictable Bill
Base Monthly Rate
$20/mo
Fixed subscription or contracted tier
Overage Penalty
+$1/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$21/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Suitable for development; verify concurrent connection limits.

Base Production (50 GB)

Included base quota in plan: 5 GB.
Low Risk / Predictable Bill
Base Monthly Rate
$20/mo
Fixed subscription or contracted tier
Overage Penalty
+$8/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$28/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Implement table compression policies and temporal partitioning.

Active Growth (250 GB)

Included base quota in plan: 5 GB.
High Risk / Accelerated Overages
Base Monthly Rate
$20/mo
Fixed subscription or contracted tier
Overage Penalty
+$44/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$64/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Offload cold backups to standard object storage (S3).

Large Scale (1.000 GB (1 TB))

Included base quota in plan: 5 GB.
Critical Risk / Severe Bill Shock
Base Monthly Rate
$20/mo
Fixed subscription or contracted tier
Overage Penalty
+$179/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$199/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Migrate to dedicated instance or self-hosted cluster to curtail I/O fees.

Procurement Strategy & Discounts: OryB2B Negotiation Playbook
Corporate executive level with highest authority to approve budgetary exceptions.
Show detailsHide details

Fair Market Price & B2B Procurement Benchmark

Non-renewal notice: 30 days before expirationMedian achieved discount: -12%
Public List Price
Custom / Contact
100% baseline
Audited Market Average
-12% median
~88% of list price
Optimized Target Price
-20% target
Max achievable discount (Q4 / multi-year): -20%

Hidden Contract Add-ons & Cost Clauses

  • Recargos por sobreuso de API / llamadas adicionales
  • Costos de asientos de visualizador o invitados no declarados

Verified Tactical Savings Levers

  • Annual Upfront PrepayUp to -20%

    Consolidated discount for upfront annual billing versus monthly rate.

  • Startup Credits ProgramUp to -50%

    Credits and perks for early-stage startups and accelerator programs.

  • Volume Seat TiersUp to -15%

    Tiered volume pricing discounts when exceeding team seat thresholds.

Security & Data Exit
Show detailsHide details

Compliance & Security Standards: Ory

SOC 2 Type IINot reported
ISO 27001Not reported
GDPR / RGPDNot reported
HIPAANot reported
PCI-DSSNot reported
Jurisdiction & Legal Sovereignty
🇺🇸United States [US]Subject to US CLOUD ActGDPR DPA Available
SSO Availability (SAML Enterprise)
Enterprise-Only SSO
Data Residency
SELF_HOSTEDEUUSAWS
AI Privacy Policy
Not evaluated
Data Liberation & Migration Runbook: OryPG_DUMP · JSON · CSV
Actionable escape runbook and credential export guarantees to mitigate vendor lock-in.
Show detailsHide details
Supported Structured Export Formats
PG_DUMPJSONCSVPARQUET
Password Hash Portability
Exportable Hashes (Bcrypt / Argon2): Zero Forced Retention

Allows extracting password hashes in standard formats to migrate without forcing user resets.

CLI Command / Rescue Endpoint
docker exec -t ory pg_dump -U postgres > backup.sql
Exit Protocol & Migration Notes

Direct database-level export without proprietary password encryption.

Deployment & Infrastructure Requirements: OryDocker
Hardware specs and Docker directives to run on local servers, dedicated VPS, or Kubernetes without telemetry leak to the cloud.
Show detailsHide details
Minimum Memory1 GB RAM (Recommended)
Compute CPU1 vCPU
Runtime / LanguageTypeScript / Go / Rust
Code LicenseOpen Source
Docker CLI Directive
docker run -d --name ory -p 8080:8080 ory:latest
Companion Services & Dependencies:
PostgreSQL 15+Redis 7+
Community & Repository
Show detailsHide details

Technical Reputation of Ory

85/100 Technical Trust

Frequent Praises in Production

  • Modular architecture allowing selective service deployment.
  • Native support for open standards like OIDC and OAuth2.
  • Versatile deployment options between managed cloud and self-hosting.

Reported Production Frictions

  • Steep learning curve due to the complexity of individual components.
  • Advanced configuration requires deep technical security knowledge.
Commercial Treatment & Vendor Lock-in:Self-Service in Dashboard

Cancellation flow is autonomous via billing portal or subscription settings.

Frequently Asked Technical Questions (Ory)

Can I self-host Ory services?

Yes, all core Ory components such as Kratos, Hydra, and Keto are open-source and can be deployed in your own infrastructure using Docker containers or Kubernetes.

What services make up the Ory identity stack?

The stack includes Ory Kratos for identity, Ory Hydra for OAuth2, Ory Keto for policy-based authorization, Ory Oathkeeper for security proxying, and Ory Talos for machine identities.

Does Ory support SAML and SCIM authentication?

Ory Polis handles integration with external identity providers using SAML and SCIM protocols, facilitating the deployment of B2B IAM solutions for enterprises.

Head-to-Head Comparisons

Direct Alternatives

All tools in Ory
Embed Verification Badge
Official Badge
Show detailsHide details
TheJudex Verified - Ory