Ory

Overview

Ory is an identity and access management platform for customer applications, business partners, machines and AI agents. It is best suited to teams that need flexible authentication and access controls and want to choose between self-hosting and managed cloud. The breadth is useful, but B2B authentication requires a higher-priced tier than Developer or Production.

Key features

Ory brings authentication and identity management together with OAuth2 and OIDC, single sign-on, multi-factor authentication and fine-grained permissions. Customer SSO, social login, passkeys and customer profiles are supported, along with directory synchronization, lifecycle provisioning and adaptive access policies. This range can serve products with complex access needs; a project looking only for a basic sign-in component may find the platform broader than necessary.

Deployment choices include open-source self-hosted components, a self-hosted enterprise license and managed cloud IAM through Ory Network. Its modular, headless architecture lets teams build the interface around their product's own experience. That control suits teams with the capacity to own their UI, but is less appealing to those seeking a ready-made customer-facing interface.

SSO protocols include SAML 2.0, OpenID Connect and OAuth 2.0. MFA options span TOTP, WebAuthn/FIDO2, SMS, email and recovery codes. The integrations directory includes Amazon SES, AWS API Gateway, GitHub, Google Workspace, Microsoft Entra ID and HubSpot, with protocols such as SCIM, JWT, REST API and webhooks also represented.

Ory describes security practices that include CI/CD vulnerability scanning, runtime container monitoring, third-party penetration tests and a public disclosure and reward program. It says it enforces HTTPS with TLS 1.2 or higher, encrypts stored data with AES-256 and hashes passwords using salted bcrypt. Its cloud runs on Google Cloud Platform, logs access for auditing and incident analysis, and distributes services across multiple data centers and zones. Ory describes its products as GDPR compliant and privacy focused; its company timeline says it achieved PCI DSS compliance in 2026.

Pricing

Ory uses a freemium model, but the Developer tier has no published price or included limits in the plan details. It may suit evaluation or early development, though teams should compare its needs against the concrete environment allowances in paid tiers before settling on it.

Production costs $770 a year, billed at $770 per year. It includes one production environment, three staging environments, five development environments and $21.00 in monthly credit. This is a defined entry point for teams deploying Ory Network, but it does not include B2B authentication.

Growth costs $9,350 a year, billed at $9,350 per year. It provides two production, five staging and 20 development environments, $255.00 in monthly credit, and B2B SSO using OIDC only. Teams that need B2B authentication must choose Growth or Enterprise; the substantial annual step up from Production is the central pricing trade-off.

Enterprise has custom pricing and includes multi-region deployments with data residency, multi-tenancy, premium support with SLAs and a 99.99% uptime SLA. The Ory Enterprise License also has custom pricing; it is self-hosted, gives teams full control of hosting, and includes premium enterprise integrations and premium support with SLAs. It is the relevant route for organizations requiring self-hosting with enterprise support rather than managed Ory Network.

Platforms

Ory spans API, Linux, macOS, self-hosted, web and Windows environments. Its CLI installation instructions cover macOS, Linux and Windows, offering a practical fit for teams working across those operating systems.

Who it's for

Ory is a strong fit for product and platform teams building customer or partner identity flows that need several authentication methods, fine-grained permissions and control over deployment. Managed Ory Network fits teams seeking cloud IAM; open-source components and the Enterprise License offer self-hosting paths. Teams that need B2B SSO should budget for Growth or Enterprise, while a narrowly scoped or cost-sensitive project may be better served by a simpler option.

Pros and cons

• Pros: Broad identity capabilities cover customer SSO, social login, passkeys, MFA, provisioning and adaptive access policies.
• Pros: Managed cloud, open-source self-hosting and a self-hosted enterprise license give teams meaningful deployment choice.
• Pros: Growth includes B2B SSO, while Enterprise adds multi-region deployment, data residency and a 99.99% uptime SLA.
• Cons: Developer and Production do not include B2B authentication, limiting lower-tier options for partner identity needs.
• Cons: Production and Growth are annual commitments, and Growth's $9,350 annual price is a major step above Production.
• Cons: Headless architecture gives teams UI control but leaves them to create the customer-facing experience.

Alternatives

Choose FusionAuth if a self-hosted, free Community plan with unlimited use and core authentication features is the priority. miniOrange Identity and Access Management is worth considering for customer identity with two to three social logins on its free plan, or when a free trial matters. AWS IAM Access Analyzer is a more focused option when the need is free IAM policy validation or policy generation rather than a broad identity platform.

Clerk may suit teams looking for a free plan with 50,000 monthly retained users per app, up to three dashboard seats and three social connections. Descope is an alternative for teams that value open-source SDKs and a free plan with 7,500 monthly active users. Evolveum midPoint is a free, open-source option for self-hosting, though clustering and selected features require an active support subscription.

Frontegg may appeal to teams seeking a free pay-as-you-go tier with 7,500 monthly active users, five enterprise connections and unlimited organizations. Google Cloud Identity is another option, with a Premium annual plan at $6 a month that includes enterprise security features and automated user provisioning.

Browse Identity and Access Management Software, Biometric Authentication Software, Single Sign-On Software, Passwordless Authentication Software, Passkey Authentication Software and Customer Identity and Access Management Software for more options by category.

Verdict

Choose Ory if your team needs a broad identity platform, values control over deployment and interface, and can fund the tier required for its access needs. Its strongest case is the combination of extensive authentication capabilities with managed and self-hosted routes. Look elsewhere if you need B2B authentication without the Growth-or-Enterprise commitment, or want a ready-made interface instead of a headless system.