You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hydra — needs an identity provider. It's deliberately "headless"—it issues OAuth tokens but doesn't manage users. It asks "who is this user?" and needs Kratos (or another IdP) to answer.
30
+
Hydra — needs an identity provider. It's deliberately "headless"—it issues OAuth tokens but doesn't manage users. It asks "who is
31
+
this user?" and needs Kratos (or another IdP) to answer.
30
32
31
-
Keto — needs an identity provider. It answers "can this subject do this action?" but needs something upstream to authenticate who the subject is.
33
+
Keto — needs an identity provider. It answers "can this subject do this action?" but needs something upstream to authenticate who
34
+
the subject is.
32
35
33
36
## Authentication & Authorization
34
37
35
-
Kratos + Keto — when you need authentication and fine-grained permissions within your own application(s). Users log in via Kratos, and Keto controls what they can access internally.
38
+
Kratos + Keto — when you need authentication and fine-grained permissions within your own application(s). Users log in via Kratos,
39
+
and Keto controls what they can access internally.
36
40
37
-
Kratos + Hydra — when you need authentication plus OAuth 2.0/OIDC capabilities: SSO across multiple apps, third-party integrations, or federating identity to external services.
41
+
Kratos + Hydra — when you need authentication plus OAuth 2.0/OIDC capabilities: SSO across multiple apps, third-party
42
+
integrations, or federating identity to external services.
38
43
39
44
Kratos + Hydra + Keto — when you need all three: user login, token issuance/SSO, and fine-grained permissions.
40
45
41
46
The choice depends on whether you're solving for internal permissions vs. external/delegated access.
42
47
43
-
```mermaid
48
+
````mermaid
44
49
flowchart TD
45
50
Start([What are you building?]) --> Q1{Need to manage<br>user identities?}
46
-
51
+
47
52
Q1 -->|Yes| Kratos[✓ Kratos]
48
53
Q1 -->|No, using existing IdP| ExternalIdP[Use your existing IdP]
0 commit comments