awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
·
ory avatar

ory/hydra

0
View on GitHub↗
17,236 stars·1,583 forks·Go·Apache-2.0·19 viewswww.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra↗

Hydra

Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface.

The project distinguishes itself through a headless architecture, allowing external management of login and consent flows. It provides specialized capabilities for dynamic client registration, JSON Web Token issuance, and a system for rotating encryption secrets without service downtime.

The system covers a broad range of identity operations, including the orchestration of authentication sequences, identity provisioning, and token lifecycle management. It supports state persistence via adapters for PostgreSQL, MySQL, and CockroachDB, and includes observability tools through Prometheus-compatible metrics and distributed tracing.

Administrative access is managed through port-based API isolation to separate privileged endpoints from public-facing protocol APIs.

Features

  • Identity Providers - Functions as a centralized identity provider delivering unified authentication and authorization via standard protocols.
  • Identity Servers - Provides a centralized platform for authentication, authorization, and federation services as a headless server.
  • Headless Architectures - Implements a headless architecture that decouples identity protocol logic from the user interface via management APIs.
  • JWT Format Tokens - Generates access tokens in JSON Web Token format to enable local verification by clients.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI
  • API Access Control - Secures APIs by issuing JWT access tokens and managing scopes to control resource permissions.
  • Login and Consent Handlers - Provides secure endpoints to accept or reject user authentication and scope authorization requests.
  • Authentication Scope Management - Validates and matches requested OAuth2 scopes to control client access levels.
  • Authorization Handshake APIs - Exposes APIs to implement the technical handshake of authentication without prescribing the user interface.
  • Authentication Orchestration - Coordinates complex authentication and authorization sequences, including login and user consent flows.
  • Client Registration Protocols - Implements standardized procedures for the secure onboarding and registration of new client applications.
  • Identity Provider Integrations - Integrates existing user databases with the authorization server to manage login and consent flows.
  • Identity Token Services - Issues cryptographically signed JSON Web Tokens to authorize access to protected resources.
  • Key Management - Manages the generation and rotation of cryptographic key pairs for signing tokens.
  • OAuth2 Client Management - Provides tools for registering and scoping external application access via OAuth2.
  • OAuth2 Implementations - Implements standard OAuth2 authorization sequences, including code, implicit, and hybrid flows.
  • OIDC Identity Token Issuance - Acts as an OIDC provider to issue identity tokens based on internal roles.
  • OIDC Protocol Implementations - Executes standardized OpenID Connect authorization flows and discovery endpoints for specification compatibility.
  • OpenID Connect Providers - Functions as a certified OpenID Connect and OAuth2 provider for standardized single sign-on.
  • Token Validation - Verifies that requested scopes and audiences are whitelisted before issuing new tokens during refresh.
  • Single Sign-On Solutions - Enables users to authenticate once and access multiple independent applications via standardized identity protocols.
  • Application Registration - Provides mechanisms for registering third-party applications that request access to protected resources.
  • OAuth2 Access Token Issuance - Generates signed JSON Web Tokens as access tokens to facilitate secure resource authorization.
  • Token Management - Provides headless APIs to manage the full lifecycle of active access tokens.
  • JSON Web Tokens - Issues signed JSON Web Tokens containing identity and session data for local verification by relying parties.
  • CockroachDB Integrations - Supports state and configuration persistence using CockroachDB.
  • PostgreSQL Persistence - Utilizes PostgreSQL to ensure reliable storage of identity and authorization data across restarts.
  • MySQL Integrations - Supports state and identity data persistence using MySQL.
  • Authorization State Adapters - Uses interchangeable database adapters to maintain authorization state across PostgreSQL, MySQL, and CockroachDB.
  • OIDC Discovery - Publishes a standardized discovery endpoint to provide clients with authentication, token, and authorization server locations.
  • Dynamic Client Registrations - Implements dynamic client registration and trust establishment using metadata and dynamic endpoints.
  • Token Metadata Retrievals - Implements a secure validation endpoint for inspecting the metadata and current status of access and refresh tokens.
  • Audience Restrictions - Ensures access tokens are only used at authorized endpoints by defining the intended audience.
  • Lifespan Configuration - Provides configurable expiration timeouts for login, consent, and refresh tokens.
  • Client Authentication Configurations - Allows defining whether a client authenticates at the token endpoint using HTTP Basic or a POST body.
  • Automated Secret Rotation - Maintains a rotation array of encryption keys to allow seamless secret updates without service downtime.
  • OAuth 2.1 Implementations - Adheres to the latest OAuth 2.1 standards for internet-scale authentication.
  • Refresh Token Grants - Supports the issuance of new identity tokens during refresh token grant flows.
  • JWKS Distribution - Exposes a JSON Web Key Set endpoint for clients to verify signed tokens using rotating public keys.
  • Token Introspection - Implements token revocation and introspection to verify and invalidate active security tokens.
  • Session Termination Services - Executes front-channel and back-channel logout flows to terminate user sessions across identity providers.
  • Identity and Access Providers - Open-source server for OIDC and OAuth2 protocols.
  • API Security - High-performance OAuth2 and OpenID Connect server implementation.
  • Cryptography and Identity - Hardened OAuth 2.0 and OpenID Connect provider.
  • Security And Privacy - OpenID Connect and OAuth2 provider.

    • Star history

    Star history chart for ory/hydraStar history chart for ory/hydra

    Frequently asked questions

    What does ory/hydra do?

    Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface.

    What are the main features of ory/hydra?

    The main features of ory/hydra are: Identity Providers, Identity Servers, Headless Architectures, JWT Format Tokens, API Access Control, Login and Consent Handlers, Authentication Scope Management, Authorization Handshake APIs.

    What are some open-source alternatives to ory/hydra?

    Open-source alternatives to ory/hydra include: dexidp/dex — Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various… openiddict/openiddict-core — This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0… doorkeeper-gem/doorkeeper — Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the… panva/node-oidc-provider — node-oidc-provider is a framework for building OpenID Certified authorization servers and identity providers within… casdoor/casdoor — Casdoor is a centralized identity and access management platform that functions as an OAuth 2.0 authorization server.… quarkusio/quarkus — Quarkus is a Kubernetes-native Java framework designed for building high-performance, memory-efficient applications.…

    Open-source alternatives to Hydra

    Similar open-source projects, ranked by how many features they share with Hydra.
    • dexidp/dexdexidp avatar

      dexidp/dex

      10,902View on GitHub↗

      Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various upstream sources into a unified OpenID Connect interface. It functions as a multi-protocol identity broker, enabling client applications to implement a single standard while delegating user verification to external identity providers. The project distinguishes itself through a pluggable connector architecture that bridges disparate protocols including LDAP, SAML, and OAuth2. It provides specific integrations for services such as GitHub, Google, GitLab, and Microsoft, while offer

      Gohacktoberfestidentity-provideridp
      View on GitHub↗10,902
    • openiddict/openiddict-coreopeniddict avatar

      openiddict/openiddict-core

      5,168View on GitHub↗

      This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0 identity providers. It provides the core logic required to issue and validate security tokens and manage user authentication across various grant types and protocol flows. The framework includes a protocol translation layer that bridges OpenID Connect and SAML to enable interoperability between different identity providers. It also supports a stateless mode of operation, which removes built-in validation and storage to allow for manual control over token and client verification. Th

      C#
      View on GitHub↗5,168
    • doorkeeper-gem/doorkeeperdoorkeeper-gem avatar

      doorkeeper-gem/doorkeeper

      5,501View on GitHub↗

      Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the necessary framework to build an authorization server that issues and validates security tokens for third-party applications, effectively acting as a security middleware to protect API endpoints. The project integrates an identity layer via OpenID Connect to verify user identities and retrieve profile information. It supports a variety of security patterns, including the implementation of the PKCE flow for public clients and the issuance of stateless JSON Web Tokens. Its broade

      Ruby
      View on GitHub↗5,501
    • panva/node-oidc-providerpanva avatar

      panva/node-oidc-provider

      3,756View on GitHub↗

      node-oidc-provider is a framework for building OpenID Certified authorization servers and identity providers within Node.js environments. It provides a comprehensive suite of tools for managing the full lifecycle of OAuth 2.0 and OpenID Connect services, including user authentication, client registration, and the issuance and validation of identity and access tokens. The project distinguishes itself through a highly modular architecture that allows developers to integrate authentication services directly into existing web application stacks. It supports advanced customization through a middle

      JavaScriptauthorizationauthorization-serverconnect
      View on GitHub↗3,756
    See all 30 alternatives to Hydra→