Can a CI pipeline read our identity schemas without holding a user session?

lets a workspace API key call the schema-listing endpoint directly, so a service account gets the same data a logged-in admin would see

Will a wildcard in my return URL or CORS origin match more than I intended?

matches the wildcard only within a single DNS label, so a pattern that used to span multiple labels no longer applies and any request relying on that broader match now fails

Who owns the email domain we're about to enable SSO for?

verifies ownership through a DNS-TXT record the organization publishes, replacing a manual back-and-forth with a check anyone can confirm by looking up the record

Which data region does a given identity actually live in?

shows and lets you change the region assignment for one identity directly from its details page, without scripting an API call

Is an event stream still configured after we've paused it?

reports the stream's status as active or paused and keeps the full configuration in place while paused, so resuming needs no rebuild

Ory release history — The Cyber Toolchain

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis, Ory Elements v26.4.9 released Oct 30, 2026 · issue 126

Ory Network adds per-stream event type filtering to control which events an event stream delivers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Filter an event stream to a specific set of event types by setting event_types on the stream, instead of receiving all events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

changelog Oct 25, 2026 · issue 120

Ory v26.4.3–v26.4.6: admin API attribution in events, external-ID event matching, new Console layout, and configurable OTP codes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Navigate the redesigned Ory Console — no migration or opt-in required, it is live for every workspace.

📍1. Go to https://console.ory.sh 2. Log in to your Ory Network account 3. Select any workspace or project — the new layout and navigation are active automatically

Adds configurable length and character set for one-time codes in Ory Kratos Identities via Ory Network⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds external-ID matching for identity, login, registration, recovery, settings, verification, and session events in the Ory Network event stream
Events emitted by Ory Identities, Ory OAuth2, and Ory Permissions now show who made an admin API request
Introduces a new layout and navigation for the Ory Console, rolled out to all Ory Network workspaces and projects

Adds configurable length and character set for one-time codes in Ory Kratos Identities via Ory Network⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a new layout and navigation for the Ory Console, rolled out to all Ory Network workspaces and projects

2 more in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto v26.4.5 released Oct 22, 2026 · issue 117

Ory Hydra admin API events now capture who made the request, giving audit trails for Identities, OAuth2, and Permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis v26.4.4 released Oct 21, 2026 · issue 116

Ory Network v26.4.4 adds external-ID matching for identity and session event stream events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The new Ory Console is available on Ory Network Oct 21, 2026 · issue 116

Ory Network rolls out a redesigned Console with a new layout and navigation for all workspaces and projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Network, Ory Hydra, Ory Kratos, Ory Polis, Ory Elements v26.4.3 released Oct 19, 2026 · issue 113

Ory Network v26.4.3 lets you configure the length and character set of one-time codes in Ory Kratos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports configuring the length and characters of one-time codes issued by Ory Kratos Identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

changelog Oct 17, 2026 · issue 111

Ory v26.4.x adds TraceID correlation in live event streams and finer latency histogram buckets in Ory Hydra.

Adds TraceID key in eventAttributes for events delivered through a live event stream, enabling correlation of all events from a single request
New supported platformRefines the http_requests_duration_seconds and http_response_time_seconds request latency histogram buckets in Ory Hydra for finer granularity

2 details in Everything

Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis, Ory Elements v26.4.2 released Oct 15, 2026 · issue 110

Ory v26.4.2 refines request latency histogram buckets for http_requests_duration_seconds and http_response_time_seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis v26.4.1 released Oct 14, 2026 · issue 109

Ory v26.4.1 adds FIPS 140-3 container images and Helm chart support for Kratos, Hydra, and Polis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Polis, Ory Elements v26.4.0 released Oct 13, 2026 · issue 108

Ory Network v26.4.0 adds TraceID to live event stream payloads for cross-event request correlation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Kratos v26.3.18 released Sep 30, 2026 · issue 090

Ory Kratos v26.3.18 lets after-login webhooks require sign-in with a specific OpenID Connect provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Hydra, Ory Kratos, Ory Polis v26.3.17 released Sep 24, 2026 · release notes

Ory Hydra adds strict OAuth loopback scheme matching; Kratos supports OIDC Front-Channel Logout; Polis improves bulk deletes and tenant lookups.

Enforces that OAuth2 redirect_uris match the scheme of the requested loopback URI, rejecting mixed http/https flows (RFC 8252 section 7.3).
Supports OpenID Connect Front-Channel Logout to end Ory sessions when upstream providers sign out users.
Enables SSO_TRACES_TTL to keep traces indefinitely when set to an empty string, correcting previous silent capping at seven days.
Makes bulk deletes for SSO connections and traces page through all records instead of stopping after DB_PAGE_LIMIT (default 50).
Adds tenant and product filtering to Admin Portal lists and GET /api/admin/connections and GET /api/admin/directory-sync endpoints.

+2 more show less

Adds email lookup for users (GET /api/admin/directory-sync/{directoryId}/users) and name lookup for groups (GET /api/admin/directory-sync/{directoryId}/groups) in the Admin Portal.
Implements proper pagination (startIndex, count, totalResults) for SCIM user and group listings in Polis.

7 details in Everything

└──▷ BREAKING ON UPGRADE

!OAuth2 authorization requests fail if the client registers an https loopback URI but the app requests an http loopback URI with a dynamic port; update redirect_uris to match the scheme.
!DSYNC_WEBHOOK_LOGS_TTL values containing non-duration tokens (e.g., 1d garbage) now fall back to the seven-day default and log a warning instead of using the parsed duration.
!A deployment with an empty SSO_TRACES_TTL value now keeps traces indefinitely instead of capping them at seven days; remove or set a valid retention if indefinite storage is unwanted.

Ory Kratos, Ory Polis v26.3.16 released Sep 23, 2026 · release notes

Ory Kratos expands phone validation; Polis adds an evaluation-only FIPS-mode image and clearer webhook delivery details.

Adds a polis-oel-fips preview image using FIPS-approved algorithms; it is not CMVP/FIPS 140-3 validated or published to the enterprise registry/Cloudsmith. Contact Ory to evaluate it.
Shows event types and subject counts directly in Admin Portal webhook delivery rows without opening the JSON payload
Expands phone number validation to accept Unicode decimal digits (e.g., Devanagari, Bengali) normalizing to E.164 format in Ory Kratos identity traits

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The +963 91x, +963 92x, and +963 97x phone number ranges are withdrawn and no longer assignable in Ory Kratos
!The +386 49x range for Slovenia is withdrawn, causing formatted sign-in to fail with generic invalid-credentials error
!The +377 49x and +377 049x ranges for Monaco are withdrawn from Ory Kratos validation
!The +298 88x range for Faroe Islands is withdrawn from Ory Kratos validation
!The +84 80xx range for Vietnam is withdrawn from Ory Kratos validation
!The +47 4536x range for Norway/Svalbard is withdrawn from Ory Kratos validation
!The +995 5441x range for Georgia is withdrawn from Ory Kratos validation

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis v26.3.15 released Sep 22, 2026 · issue 082

Ory Network gains workspace contact registration for technical, business, security, and privacy roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Assign contacts for each role in a workspace so the right person is reached for security incidents or billing questions.

📍In the Ory Network console, open your workspace, go to Settings, and fill in the technical, business, security, and privacy contact fields.

Ory Network, Ory Hydra, Ory Kratos, Ory Polis v26.3.14 released Sep 17, 2026 · release notes

Custom domains with timed-out or expired certificates now pass validation again.

└──▷ HOW TO FIND IT

Restore service access for a custom domain after its TLS cert expired by re-validating it without manual intervention.

📍In the console, go to Domains › <domain> and click Validate or wait for automatic validation resume.

Resumes certificate validation for custom domains whose checks previously timed out or expired.

1 detail in Everything

Ory Network,Ory Hydra, Ory Kratos, Ory Keto, Ory Polis v26.3.13 released Sep 10, 2026 · issue 070

Ory Network v26.3.13 adds a temporary workaround for firewalls that reject post-quantum TLS handshakes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Ory Hydra, Ory Polis v26.3.12 released Sep 9, 2026 · issue 069

Ory Hydra now validates grant_types on OAuth 2.0 client creation and update.

Ory Hydra v26.3.11 released Aug 27, 2026 · release notes

Ory Hydra v26.3.11 adds controlled client secret rotation via API and fixes device flow compliance.

POST /admin/clients/{id}/secrets/rotate now accepts an optional client_secret request body field to set a specific secret value during rotation
device_code is now strictly single-use, returning invalid_grant on reuse instead of allowing duplicate token issuance
Device authorization grant responses now correctly include the id_token when the openid scope is requested and granted
Symmetric keys (e.g., HS256) are now omitted from public JSON Web Key projections (GET /.well-known/jwks.json and hydra get jwk --public) instead of causing 500 errors

4 details in Everything

└──▷ BREAKING ON UPGRADE

!In @ory/client, positional rotateOAuth2ClientSecret functions from OAuth2ApiFp and OAuth2ApiAxiosParamCreator now take the optional body second and Axios options third; object-parameter class/factory APIs are unchanged.

Ory Hydra v26.3.10 released Aug 24, 2026 · release notes

Ory Hydra v26.3.10 adds configurable admin JWK exposure and fixes device code timing defaults

Adds jwks.admin_api.expose_private_keys to withhold private keys from admin GET and POST key responses; PUT responses are unaffected and the default remains true.
Device authorization lifespan and polling interval settings now take effect instead of hardcoded defaults
Dynamic client registration omits optional metadata fields like client_uri when empty to comply with RFC 7591

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Upgrading from Hydra 1.0.0-rc or earlier without intermediate migration fails because hydra migrate sql up no longer converts pre-1.0.0 tables (e.g., hydra_client_migration) automatically

Ory Network, Ory Hydra, Ory Oathkeeper v26.3.9 released Aug 20, 2026 · issue 051

Ory Network v26.3.9 refreshes the Console UI with a new design system for self-hosted and enterprise deployments.

Ory Kratos, Ory Elements v26.3.8 released Aug 18, 2026 · release notes

Ory Kratos v26.3.8 expands OIDC-scoped hooks to native id_token logins; Ory Elements requires trustedOrigins in Next.js middleware

oidc-scoped login and registration hooks now trigger for native id_token logins (e.g., Sign in with Apple) instead of only unscoped hooks
Hook payloads and events for native id_token flows set the flow's active method to oidc

2 details in Everything

└──▷ BREAKING ON UPGRADE

!createOryMiddleware in @ory/nextjs throws at startup when trustedOrigins is unset or empty

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Polis, Ory Elements v26.3.7 released Aug 13, 2026 · release notes

Kratos strengthens required-AAL enforcement; Keto tightens OPL validation; Polis adds SAML IdP logout and client-authentication checks.

Setting session.whoami.required_aal: aal2 now requires every session to reach AAL2, routing users without a second factor to enrollment.
Strengthens OPL validation in Keto; use /opl/syntax/check on the new version to find rejected configurations before upgrading.
Enables SAML IdP Single Logout (SLO) capability in Ory Polis for identity federation
Requires client_secret on token requests for IdP-initiated authorization codes in Ory Polis
Adds rate_limited and unexpected_error events to Ory Elements components for handling HTTP 429 and other errors

5 details in Everything

└──▷ BREAKING ON UPGRADE

!IdP-initiated authorization code exchange in Polis now requires client_secret; omitting it returns a 401 error.
!Configurations with duplicate namespace or relation declarations in Ory Keto will fail to load.

Ory Network, Ory Oathkeeper, Ory Polis, Ory Elements v26.3.6 released seen Aug 12, 2026 · issue 043

Ory Network gains DNS-TXT record verification for organization SSO email domains.

Ory Hydra, Ory Kratos, Ory Keto v26.3.5 released seen Aug 11, 2026 · issue 042

Ory Hydra gains oauth2.grant_types_disabled config key to block specific OAuth 2.0 grant types.

Ory Network, Ory Hydra, Ory Kratos v26.3.3 released seen Jul 28, 2026 · issue 028

Ory Network v26.3.3 adds configurable legal footer links (ToS, Privacy Policy, Contact) to Account Experience UI.

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Elements v26.3.4 released Jul 28, 2026 · release notes

Ory v26.3.4 adds YugabyteDB support (OEL), OAuth2 secret rotation, Kratos row-TTL migration, and console session lifespan override.

└──▷ TRY IT

For Kratos Enterprise License on CockroachDB, apply default TTL cleanup settings; this replaces custom TTL settings on affected tables.

$ kratos migrate row-ttl up

Perform a partial update of an OAuth2 client in Hydra without resetting other fields.

$ hydra update oauth2-client <id> --name "new name"

Adds opt-in kratos migrate row-ttl up for Kratos Enterprise License on CockroachDB; it replaces custom TTL settings with the documented defaults.
Supports zero-downtime OAuth2 client secret rotation in Hydra
Allows workspace administrators to override Console session lifespan for organization SSO members via workspace SSO settings
Enables YugabyteDB support for Ory Kratos, Hydra, and Keto (OEL only)

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Scripts relying on hydra update oauth2-client to reset unspecified fields to defaults must now pass a complete client definition with --file to get replace semantics

New rate limit model for Ory Network seen Jul 23, 2026 · issue 023

Ory Network moves to fine-grained, bucket-based rate limiting instead of fixed per-endpoint-path limits.

Introduces bucket-grouped project rate limits, replacing fixed per-endpoint-path rate limiting for more granular control.

1 detail in Everything

Ory Hydra, Ory Kratos v26.2.16 released seen Jul 23, 2026 · issue 023

Ory Hydra now accepts OpenID Connect prompt=select_account in OAuth 2.0 authorization requests.

└──▷ TRY IT

Trigger account selection during an OAuth 2.0 authorization flow so users can switch between identities.

$ GET /oauth2/auth?response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&scope=openid&prompt=select_account

Ory Network v26.2.21 released seen Jul 23, 2026 · issue 023

Ory Network now accepts workspace API keys on GET /identity-schemas, enabling programmatic schema listing.

└──▷ TRY IT

List all identity schemas from a CI pipeline or backend service using a workspace API key instead of a user session.

$ curl -H 'Authorization: Bearer <workspace-api-key>' https://<your-project>.projects.oryapis.com/identity-schemas

Supports workspace API keys on GET /identity-schemas, allowing automated/service-account access to list identity schemas without a user session.

1 detail in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper v26.3.2 released seen Jul 23, 2026 · issue 023

Ory Network v26.3.2 enforces DNS-label boundaries on wildcard return URLs and CORS origins.

└──▷ BREAKING ON UPGRADE

!Wildcard * in return URLs and CORS origins is now honored only when the * is within a single DNS label — previously accepted wildcards that spanned multiple DNS labels will no longer match, potentially blocking requests that worked before.

Ory Network, Ory Kratos v26.2.17 released seen Jul 23, 2026 · issue 023

Ory Network SCIM endpoints now support enterprise user attribute provisioning.

Ory Network, Ory Kratos, Ory Polis v26.2.19 released seen Jul 23, 2026 · issue 023

Ory Network adds per-identity data region selection directly from the Console identity details page.

└──▷ HOW TO FIND IT

Reassign a specific identity to a different data region without API calls, directly from the Console.

📍In the Ory Console, navigate to Identity details for the target identity, then use the data region selector (above the organization field) to choose the desired region and save.

Ory Network, Ory Kratos, Ory Polis, Ory Elements v26.2.18 released seen Jul 23, 2026 · issue 023

Ory Network event streams can now be paused and resumed without losing configuration.

└──▷ HOW TO FIND IT

Check or manage the status of an event stream to temporarily halt event delivery without tearing down the stream configuration.

📍Check the status field on an event stream response — it will be either active or paused.

Adds pause and resume support for event streams, with a new status field (active or paused) indicating stream state — a paused stream retains its full configuration.

1 detail in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Polis v26.3.1 released Jul 6, 2026 · release notes

Ory Hydra adds JWT audience omission; Kratos adds device key pinning and SAML auto-refresh; Polis adds HTTPS TLS sidecar. Includes breaking changes.

└──▷ USE IT

Enable built-in HTTPS termination for Ory Polis using a Kubernetes Secret managed by cert-manager.

yaml

tlsSidecar:
  enabled: true
  tls:
    secretName: polis-tls

Adds oauth2.grant.jwt.omit_assertion_audience config key to control whether JWT bearer assertions copy their aud claim into access tokens.
Adds feature_flags.refresh_login_choose_address feature flag and kratos_feature_flags_refresh_login_choose_address project config field to enable address picker on code refresh logins.
New device keys receive a server-derived SHA-256 client_key_id; a client-supplied enrollment ID is ignored. Existing enrolled keys retain their IDs and keep working.
Adds optional App ID pinning for device authentication via selfservice.methods.deviceauthn.config.ios_app_ids and android_app_ids.
Adds Update identity on login support for SAML connections via selfservice.methods.saml.config.providers[].update_identity_on_login.

+1 more show less

Enables terminating HTTPS with a built-in TLS sidecar in the Polis Helm chart via tlsSidecar.enabled: true and tlsSidecar.tls.secretName.

6 details in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Polis v26.2.22 released Jun 29, 2026 · release notes

Ory v26.2.22 adds batch session revocation, multi-tenant idp_hint scoping, SAML override preservation, and faster OAuth logout.

GET /admin/oauth2/auth/requests/logout no longer returns 410 Gone for handled requests, as logout challenges are now self-contained encrypted tokens instead of database rows
Ory Kratos identity schemas can flag multiple traits with passkey.display_name: true or webauthn.identifier: true and the registration flow returns a new displayNameFieldNames array in passkey_create_data

2 details in Everything

└──▷ BREAKING ON UPGRADE

!facet_by on metadata_public, metadata_admin, or traits keys now errors because faceting on metadata is removed from the identity search index
!Substring (infix) search on metadata is removed from the identity search index

Ory Network v26.2.21 released Jun 24, 2026 · release notes

Ory Network v26.2.21 adds workspace API key support for identity schema listing and deletion endpoints.

Adds workspace API key authentication support to GET /identity-schemas endpoint
Adds DELETE /identity-schemas/{schema_id} endpoint to hard-delete owned identity schemas

2 details in Everything

Ory Network, Ory Kratos v26.2.20 released Jun 23, 2026 · release notes

Ory Kratos v26.2.20 adds notify_previous_addresses hook for self-service email change notifications

Adds notify_previous_addresses hook to enable notification of an identity's previous email address upon self-service changes
Introduces a new customizable email template for the previous-address notification with placeholders for user name, new email, and account security link

2 details in Everything

Ory Network, Ory Kratos, Ory Polis v26.2.19 released Jun 17, 2026 · release notes

Ory Kratos v26.2.19 adds org-scoped settings flow, SCIM cursor pagination and group filtering, browser logout hardening, and W3C change-password endpoint

Adds organization query parameter to the self-service settings flow (createBrowserSettingsFlow / createNativeSettingsFlow) to bind an identity to a specific organization's SSO providers.
Supports opt-in SCIM cursor pagination: send an empty cursor, then follow nextCursor; existing offset pagination remains the default.
Adds SCIM group membership filtering via the groups.value filter parameter on GET /Users (e.g., GET /Users?filter=groups.value eq "<group-id>").
Enables browser logout data clearing via the new config key selfservice.flows.logout.clear_browser_data and sends the Clear-Site-Data header when enabled.
Exposes a new public endpoint GET /.well-known/change-password that redirects to the settings UI for password manager deep-linking.

+1 more show less

Adds one-time code inputs in login/registration/verification flows carry autocomplete="one-time-code" for Web OTP API support.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The upstream parameter login_hint is removed from the upstream_parameters of login, registration, and settings OIDC methods; if you previously sent upstream_parameters.login_hint when submitting one of these flows, the value is now ignored and no longer reaches the upstream provider.

Ory Network, Ory Kratos, Ory Polis, Ory Elements v26.2.18 released Jun 12, 2026 · release notes

Ory v26.2.18 adds event stream pause/resume, Talos key hardening, SCIM fixes, configurable retention and login hints.

Adds status field to Event Streams allowing pause and resume via API or Console, enabling temporary suspension without deleting the stream
Hardens Talos by redacting signing-key material in logs/traces and fixing audit event drops when OpenTelemetry tracing is enabled
Talos rotation now retains revoked records until the later of 30 days or their original expiry, and batch imports validate each item independently.
Adds DSYNC_WEBHOOK_LOGS_TTL environment variable to Ory Polis for configurable SCIM webhook log retention duration
Pre-fills email/identifier in Ory Elements login screens when login_hint query parameter or OAuth2 flow hint is provided

5 details in Everything

Ory Network, Ory Kratos v26.2.17 released Jun 11, 2026 · release notes

Ory Kratos v26.2.17 adds SCIM enterprise extensions, configurable passkey options, and OIDC test-login endpoint.

Adds support for the urn:ietf:params:scim:schemas:extension:enterprise:2.0:User schema in SCIM provisioning endpoints
Exposes advanced passkey configuration under selfservice.methods.passkey.config including authenticator_selection, attestation.preference, and timeout settings
Adds /scim/{client}/v2/ResourceTypes discovery to advertise the SCIM enterprise user extension.
Adds a last_characters field to project and workspace API keys in the console
Adds an admin endpoint POST /organizations/onboarding-portal-links/{token}/test-login-flows to dry-run OIDC sign-in from the onboarding portal

+2 more show less

Makes passkey authenticator options (attachment, resident_key, user_verification) configurable via config keys instead of hardcoded defaults
Adds an identity external variable to the SCIM Jsonnet mapper to preserve existing identity traits during provisioning

7 details in Everything

Ory Hydra, Ory Kratos v26.2.16 released Jun 5, 2026 · release notes

Ory Hydra accepts prompt=select_account; Ory Kratos SCIM supports schema-qualified attribute paths and filters with size limits

Hydra now accepts prompt=select_account values in OpenID Connect authorization requests instead of rejecting them.
Kratos SCIM list endpoints now accept filter query parameters qualified with a full schema URN.

2 details in Everything

Ory Network, Ory Kratos v26.2.15 released Jun 3, 2026 · release notes

Ory Network adds per-organization session lifespans; Ory Kratos normalizes invisible characters in email and username identifiers.

Adds session_lifespan field to organizations API to override project-level session duration
Normalizes email and username identifiers by removing invisible characters (zero-width spaces, joiners, BOM) and normalizing case/width before storage

2 details in Everything

Ory Network, Ory Kratos v26.2.14 released May 29, 2026 · release notes

Ory Network adds OAuth2 activity statistics and case-insensitive organization-domain filtering; Kratos improves courier analytics and SCIM group consistency.

Adds event_name and time_window URL parameters to the Events page to pre-apply filters
Adds token activity stats (issued, refresh tokens issued, exchange errors) to the OAuth2 clients page
Adds message delivery stats (delivered, abandoned) and combined activity chart filters to the email delivery and Activity pages
Makes /organizations GET endpoint domain query parameter case-insensitive

4 details in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto v26.2.13 released May 22, 2026 · release notes

Ory v26.2.13 adds custom OAuth token prefixes, Console event stream management, and stricter identity validation.

Adds services.oauth2.config.oauth2.token_prefix config key to set a custom prefix for OAuth 2.0 tokens in Enterprise projects
Enterprise plans can create and manage HTTPS or AWS SNS event streams in the Ory Network Console under Authentication → Event streams.
Adds Refresh Token Rotation Grace Reuse Count setting on the OAuth2 configuration page to control refresh token reuse limits via the Console
Expands Landlock sandboxing in Kratos to cover the migrate sql and courier subcommands, restricting filesystem access beyond just serve

4 details in Everything

Ory Network, Ory Kratos v26.2.12 released May 20, 2026 · release notes

Ory Network enforces workspace move limits; Kratos adds Landlock isolation and normalizes phone traits in webhooks.

└──▷ TRY IT

Migrate existing phone identifiers to the new normalized format using the cleanup command.

$ kratos cleanup normalize-phones

Use strace to diagnose Landlock EPERM errors during startup by tracing openat and execve syscalls.

$ sudo strace -f -p "$(pgrep -f 'kratos serve')" -e trace=openat,execve -e status=failed

Kratos OEL applies a Landlock filesystem sandbox to kratos serve on supported Linux kernels, restricting access to configured runtime paths.
On Linux 5.13+, the Kratos Jsonnet worker applies an empty Landlock layer, denying path-based filesystem access; other platforms are unaffected.
Enforces workspace plan project limits on the move endpoint, returning 402 Payment Required when capacity is exceeded
Rewrites phone trait values to E.164 format in webhook payloads instead of preserving raw user input

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Symlink targets that change at runtime after startup will cause kernel EPERM denials because Landlock rules attach to the inode at activation; kratos serve must be restarted after any certificate or config symlink swap.

Ory Network, Ory Hydra, Ory Kratos, Ory Oathkeeper v26.2.10 released May 11, 2026 · release notes

Ory v26.2.10 adds OIDC provider test flows, Kratos bulk session management, and Oathkeeper trace context logging.

Adds POST /admin/test-login-flows endpoint for pre-production OIDC provider validation
Adds action: "disable"|"delete" field to POST /admin/sessions endpoint for bulk session management in Kratos
Adds rule_id, otel.trace_id, and otel.span_id fields to Oathkeeper log entries

3 details in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis, Ory Elements v26.2.9 released May 11, 2026 · release notes

Ory Network Global Region adds explicit identity-region placement; Account Experience gains a setting to hide the registration link.

For Ory Network Global Region, the admin identity API accepts region for explicit data placement, subject to the project home-region boundaries.
default_region organization setting and Jsonnet region mapper output supported for Enterprise-auth SSO (SCIM, SAML, OIDC).
Self-service responses now include read-only region field in /sessions/whoami and embedded identity objects.
Show registration link on login page switch added to Ory Console UI theming settings to hide Sign up link while keeping registration active.
hide_registration_link optional config field added to ProjectConfiguration for self-hosted @ory/elements-react consumers.

5 details in Everything

Ory Network, Ory Kratos v26.2.6 released Apr 29, 2026 · release notes

Ory Kratos v26.2.6 adds verify_new_address hook and upstream AAL2 mapping via OIDC claims.

Adds aal2_acr_values configuration field to OIDC providers for AAL2 elevation
Adds aal2_amr_values configuration field to OIDC providers for AAL2 elevation
Adds verify_new_address settings hook to defer address updates until verification

3 details in Everything

└──▷ BREAKING ON UPGRADE

!WebAuthn error IDs and text have changed; scripts relying on exact wording may break.

Ory Kratos v26.2.7 released Apr 29, 2026 · release notes

Ory Kratos v26.2.7 adds security.disallow_ref_in_identity_schemas config flag and native app OIDC trait updates

Support for required traits during OIDC registration on native applications.

1 detail in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Elements v26.2.8 released Apr 29, 2026 · release notes

Hide Ory branding via new hide_ory_branding project setting in Account Experience configuration

Adds the hide_ory_branding config key to the Ory Network project settings for Growth and Enterprise plans.
Updates elements-react DefaultCard component to respect the hide_ory_branding flag returned by configuration endpoints.
Removes IP address leakage in SSRF protection error messages across Hydra, Kratos, Keto, and Oathkeeper.

3 details in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Elements v26.2.5 released Apr 21, 2026 · release notes

New CLI command to normalize phone numbers, enum trait UI support, and expand endpoint limits in Ory Kratos/Keto.

└──▷ USE IT

Normalize legacy phone numbers in the database to E.164 format after upgrading Kratos.

shell

kratos migrate normalize-phone-numbers

Adds kratos migrate normalize-phone-numbers CLI subcommand to convert existing identity phone data to E.164 format
Adds options array to InputAttributes for Identity schema enum traits, enabling dropdown UI rendering in Account Experience and Ory Elements
Native OIDC registration redirects now include the flow ID alongside the existing code parameter when required traits are missing.
Adds limit.max_expand_size configuration key to limit tree size in Ory Keto's expand endpoint (default 4,000 nodes)

4 details in Everything

Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Elements v26.2.4 released Apr 15, 2026 · release notes

Break-glass recovery for Org identities, password migration webhooks, transientPayload prop in Elements, and OAuth2 claim preservation.

Add break_glass_for_organization field to identity recovery_addresses for SSO bypass recovery.
Configure Password migration webhook flows in the Ory Console under Developers → Actions.
Include transientPayload prop in Elements React flow components (Login, Registration, etc.).
Add oauth2.preserve_ext_claims config option to retain custom claims in the ext object.
Expose lifecycle callback props (onSuccess, onValidationError, onError) in Ory Elements self-service components.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The Helm repository moves from k8s.ory.sh to k8s.ory.com; update configuration while the old URL temporarily redirects.

Ory Network, Ory Kratos v26.2.2 released Apr 1, 2026 · release notes

Ory Kratos v26.2.2 adds standalone phone verification and automatic OIDC identity updates on login

Adds update_identity_on_login provider configuration key to trigger automatic identity trait and metadata synchronization from upstream OIDC claims during every login event.
Enables standalone phone number verification via SMS for the verification flow, accepting phone numbers in addition to emails when an SMS courier channel is configured.

2 details in Everything

Ory Network, Ory Hydra, Ory Kratos v26.2.1 released Mar 25, 2026 · release notes

Ory Hydra accepts custom domain issuer as audience in JWT Bearer Grant; Kratos adds specific error for disabled identities.

Adds Managed CAPTCHA and Bring Your Own CAPTCHA modes to protect self-service flows against credential stuffing and brute force attacks on Enterprise plans
Updates Ory Kratos to return a specific UI message (ID 4010011) indicating identity disabled state instead of generic unauthorized error
Ory Hydra now accepts the issuer-derived token URL as a valid audience in JWT Bearer Grant assertions when using a custom domain (CNAME)

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Disabled-identity recovery/login errors now include UI message 4010011. API/SPA clients that explicitly check the old generic unauthorized error must update; standard invalid-credential handling is unaffected.

Ory Network, Ory Kratos, Ory Oathkeeper, Ory Elements v26.2.0 released Mar 20, 2026 · release notes

Ory Kratos adds account_linking_mode for automatic Google/Apple account linking; Oathkeeper improves header stripping.

Adds opt-in account_linking_mode: automatic for Apple and Google consumer accounts when both emails are verified; Google Workspace accounts are excluded.
Ensures Ory Oathkeeper removes all X-Forwarded* and Forwarded headers when serve.proxy.trust_forwarded_headers is disabled
Adds autofocus behavior to the first input field of authentication forms in Ory Elements

3 details in Everything

Ory Network, Ory Kratos v26.1.17 released Mar 16, 2026 · release notes

Ory Kratos v26.1.17 adds UAE PASS social sign-in and API-supported OIDC link/unlink.

Adds UAE PASS social sign-in for web and mobile authentication.
Adds support for managing OIDC connections (link/unlink) in native/API settings flows

2 details in Everything

Ory Network, Ory Kratos, Ory Oathkeeper v26.1.16 released Mar 11, 2026 · release notes

Ory Oathkeeper v26.1.16 propagates upstream HTTP 429 rate-limit headers (Retry-After, X-Rate-Limit-, RateLimit-) to clients.

└──▷ BREAKING ON UPGRADE

!Announces a rollout on or after March 20, 2026: disabled-identity login/registration errors move from 401 responses to flow UI messages. Clients explicitly parsing 401 must update; standard UI rendering needs no change.

Ory Network, Ory Hydra, Ory Kratos, Ory Keto v26.1.11 released + Terraform Provider Feb 24, 2026 · release notes

New Terraform provider for Ory Network and SAML cert expiry in config; pagination token breaking changes in Hydra/Kratos/Keto.

saml_certificate_expiry added to Terraform provider config for proactive certificate rotation monitoring
Official Terraform provider for Ory Network (Beta) enables IaC management of identities, OAuth2 clients, social providers, project config, organizations, permissions, email templates, and webhooks

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Upgrading Ory Hydra directly to any version above 26.1.7 breaks active pagination sessions for listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers endpoints because tokens expire after 1 hour
!Upgrading Ory Kratos directly to any version above 26.1.7 breaks active pagination sessions for the listCourierMessages endpoint because tokens expire after 1 hour
!Upgrading Ory Keto directly to any version above 26.1.7 breaks active pagination sessions for the GET /relation-tuples endpoint because tokens expire after 1 hour

Ory Hydra, Ory Polis v26.1.7 released Feb 10, 2026 · release notes

Ory Hydra adds PostgreSQL serialization retries; Ory Polis adds OIDC tokens in SAML assertions and removes Turso support.

Adds automatic retry logic for serialization failures in PostgreSQL transactions for Ory Enterprise License users
Enables including OIDC tokens in SAML assertions via the new includeOidcTokensInAssertion config attribute in Identity Federation apps
Removes support for Turso, requiring migration away from that SQLite backend

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Ory Polis no longer supports Turso after replacing sqlite3 with better-sqlite3.

Ory Network, Ory Kratos, Ory Elements v26.1.6 released Feb 9, 2026 · release notes

Adds JSON/CSV export for Events view; improves validation messages and CAPTCHA rendering

Add export functionality to Events view
Proper validation message for invalid email addresses and phone numbers
Conditional CAPTCHA Rendering

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The message ID for invalid email addresses has changed from 4000001 to 4000040. Clients must update localization files.
!The message ID for invalid phone numbers has changed from 4000001 to 4000041. Clients must update localization files.

Ory v25.4.3 through v26.1.3 released Jan 27, 2026 · release notes

Ory adds multi-region identity search, configurable SAML TTL, Hydra skipped consent handling, Kratos webhook headers, and admin endpoint prefix fix.

└──▷ USE IT

For Hydra Enterprise, discard skipped-consent payloads to reduce SQL storage; this disables OAuth2 client front- and back-channel logout.

yaml

feature_flags:
    discard_skipped_consents: true

Hydra Enterprise can enable feature_flags.discard_skipped_consents to store only temporary identifiers for skipped consents; OAuth2 front- and back-channel logout then stop working.
SAML Response expiry is configurable via ttlInMinutes attribute in Identity Federation apps (default 10 minutes)
A documented allow list of user request headers is available as ctx.request_headers in HTTP delivery-channel webhooks for SMS/email one-time codes.
Login and Registration events now include SelfServiceMethodUsed and SelfServiceFlowName attributes (SelfServiceStrategyUsed deprecated)

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Advanced Identity Search API collection name changed from identities-<PROJECT-ID> to identities
!Full-text identity search results limited to first 1000; pagination support dropped (use ListIdentities API for full list)

Ory Hydra/Ory Keto/Ory Network v25.4.3 released Dec 5, 2025 · release notes

Ory Hydra adds strategies.jwt.stateless.enabled flag to issue stateless JWTs, reducing DB load.

└──▷ USE IT

Validate if your Keto deployment uses the deprecated legacy WebSocket namespace watching that needs migration.

shell

keto namespace validate-legacy -c /path/to/keto.yml

Adds strategies.jwt.stateless.enabled and strategies.jwt.stateless.claim_name to disable database persistence for JWT access tokens in Ory Hydra
Removes support for watching WebSocket URLs (ws://) for legacy namespace configuration in Ory Keto

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Ory Keto no longer supports watching WebSocket URLs (ws://) for legacy namespace configuration; the namespaces configuration field is affected when using deprecated legacy namespaces. Migrate to the Ory Permission Language.

Ory Kratos/Ory Network v25.4.1 released Nov 19, 2025 · release notes

Ory Kratos v25.4.1 adds session object to settings hook payloads and auto-sends one-time codes for passwordless login.

session object included in all settings flow hook payloads, enabling conditional logic without extra API calls
One-time code automatically sent upon identifier submission when it is the only available authentication method

2 details in Everything

Ory Network v25.4.0 Nov 13, 2025 · release notes

Ory Network v25.4.0 adds optional recovery ID, session in webhook hooks, Google SAML/SCIM onboarding, and perf boosts.

The session object is now included in the webhook body context when using the After Hook feature
Added support for connecting Google Workspace to automatically provision users via SCIM through the onboarding portal
Feature toggling for onboarding portal links allows enabling or disabling specific onboarding features such as SSO and Directory Sync (SCIM)

3 details in Everything

Ory v25.4.0 released! Nov 10, 2025 · release notes

Ory v25.4 adds Hydra device flow/OAuth 2.1 discovery, Kratos SMS passwordless/SAML import/Keto encrypted pagination and new migration CLI

Hydra: Adds Device Authorization Grant (RFC 8628) support for headless clients
Hydra: Serves OAuth 2.1 discovery at /.well-known/oauth-authorization-server
Hydra: Adds consent-chain revocation by consent challenge ID to revoke entire token chains
Kratos: Adds passwordless login and registration via SMS
Kratos: Allows delivery of recovery codes by SMS

+8 more show less

Kratos: Adds support for importing SAML credentials (Enterprise/Network only)
Kratos: Adds Line v2.1 OIDC provider support
Kratos: Emits LoginStarted and RegistrationStarted events
Kratos: Introduces new courier events CourierMessageAbandoned and CourierMessageDispatched
Kratos: Replaces old migration CLI with new kratos migrate sql up|down|status commands
Kratos: Adds support for Android WebAuthn origins for passkeys
Keto: Adds encrypted page tokens for pagination to prevent plaintext state exposure
Oathkeeper: Consolidates Oathkeeper into the Ory monorepo and adopts vendored ory/x

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Sessions API: The x-total-count header has been removed from GET /admin/sessions
!Account linking: Failed OIDC account linking flows now return HTTP 400 instead of 200 OK
!Verification flow: The show_verification_ui element is only included if the hook is explicitly configured
!OIDC registration: Failing fields are now placed in the default node group instead of oidc; legacy behavior can be restored with feature_flags.legacy_oidc_registration_node_group=true

Extended and Customizable Language Support in Ory Elements Oct 28, 2025 · release notes

Ory Elements adds support for 82 languages and allows defining custom translations for the Account Experience.

Adds support for 82 languages in Ory Elements, including Afrikaans (af), Akan (ak), Amharic (am) through Zulu (zu).
Enables developers to define custom translations for the Account Experience to override provided ones.

2 details in Everything

Ory Enterprise License Improvements Oct 24, 2025 · release notes

Ory Enterprise adds SQL connection pool metrics/tracing and updates the base image to distroless/static-debian12:nonroot

Adds distributed tracing and OpenTelemetry-compliant metrics collection for the high-performance SQL connection pool in Ory Enterprise components (Hydra, Kratos, Keto, Oathkeeper).
Updates the default container base image from gcr.io/distroless/static-debian12:debug-nonroot to gcr.io/distroless/static-debian12:nonroot, reducing image size and attack surface.

2 details in Everything

Identity Count in Ory Console Oct 23, 2025 · release notes

Ory Console now displays the total number of identities per project on the Identities Dashboard.

Adds a total identity count view to the Identities Dashboard in Ory Console.

1 detail in Everything

Ory Kratos and FedCM Improvements Oct 23, 2025 · release notes

Ory Kratos triggers login hooks for FedCM sign-in and updates Google OAuth2 parameter handling

└──▷ BREAKING ON UPGRADE

!The configuration option selfservice.methods.link.config.base_url has been removed.

Increased Refresh Token Grace Period Oct 22, 2025 · release notes

Ory Hydra Enterprise extends refresh token rotation grace period to 180 days for migration scenarios

Increases the maximum rotation_grace_period in Ory Hydra Enterprise from 30 days to 180 days when a reuse count is configured.

1 detail in Everything

Ory Elements Enhancements Oct 21, 2025 · release notes

Ory Elements settings URL fix and scoped theme styles with migration notes

Settings URL in User Menu now uses the project configuration value for consistent navigation.
Scoped Default Theme Styles restrict CSS to .ory-elements class preventing style leakage.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The default theme styles now apply only within elements wrapped in the .ory-elements class.

Ory Hydra JWK In-Memory Cache Oct 20, 2025 · release notes

Ory Hydra Enterprise adds db.jwk_cache config keys for in-memory JWK caching to reduce DB load.

Adds db.jwk_cache.enabled, db.jwk_cache.size, and db.jwk_cache.ttl configuration options to enable and tune in-memory JSON Web Key (JWK) caching
Reduces database queries for JWKs by serving them from an in-memory cache when db.jwk_cache.enabled is true

2 details in Everything

Courier Messages Endpoint and Pagination Behavior Oct 19, 2025 · release notes

Ory Kratos Courier Messages endpoint drops X-Total-Count header and adds secrets.pagination config for pagination tokens.

Removes the X-Total-Count HTTP response header from the /admin/courier/messages endpoint.
Adds secrets.pagination configuration key to define encryption keys for encoding and decoding pagination tokens.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The X-Total-Count HTTP response header is no longer present in responses from the /admin/courier/messages endpoint; clients relying on it must detect the last page by checking if returned items are fewer than the requested page size.

Account Experience 2.0 General Availability Oct 18, 2025 · release notes

Account Experience 2.0 GA introduces new default UI, legacy opt-in, updated config defaults, and claim enhancements.

Adds Account Experience 2.0 as the default UI for new Ory projects
Requires explicit Use legacy Hosted UI toggle to retain previous interface
Changes kratos_feature_flags_legacy_oidc_registration_node_group and kratos_feature_flags_password_profile_registration_node_group defaults to false for new projects
Sets default post-login redirect to /session

4 details in Everything

└──▷ BREAKING ON UPGRADE

!New projects now use Account Experience 2.0 by default instead of the legacy UI.
!kratos_feature_flags_legacy_oidc_registration_node_group and kratos_feature_flags_password_profile_registration_node_group now default to false for new projects.
!Default post-login redirect URL changes from previous value to /session.

SCIM and custom domain support in the onboarding portal Aug 29, 2025 · release notes

Ory adds SCIM server management and custom domain access to the onboarding portal.

Introduces a new scim flow in the onboarding portal for creating, editing, and deleting SCIM servers alongside existing SSO functionality.
Makes the onboarding portal accessible through custom domains configured for the project.

2 details in Everything

Prevent setting new password to the current password Aug 25, 2025 · release notes

Ory Kratos now rejects password change requests where the new password matches the current one

Prevents users from setting a new password identical to their current password; the admin API remains unchanged for imports.
Returns the error message 'The new password must be different from the old password' when reuse is attempted

2 details in Everything

Account recovery via SMS Aug 1, 2025 · release notes

Ory enables account recovery via SMS with custom templates and configurable HTTP gateway integration

Enables sms as a destination for account recovery codes in addition to email, allowing users to select their preferred method during the flow.
Supports custom SMS templates similar to existing email templates for branded or localized text messages.
Requires configuring an HTTP gateway to handle outbound SMS delivery; new fields in the OpenAPI schema expose system-level configuration options.

3 details in Everything

Support for external identifiers Jul 28, 2025 · release notes

Ory Kratos adds external_id support for identities, API queries, and JWT sub claims

Adds external_id field to identities and API assignment/query capabilities.
Enables external_id as the sub claim in JWTs via the subject_source setting.

2 details in Everything

Maximum Code Submission Limit Jun 18, 2025 · release notes

Adds configurable maximum code submissions per flow to limit brute-force attempts

Full user profile in id_token for SAML attribute mapping Jun 17, 2025 · release notes

Full user profile now included in id_token for SAML attribute mapping

Custom SAML attributes now flow through the id_token and are available for mapping in Jsonnet.

1 detail in Everything

Improved required verification flow on login and registration Jun 17, 2025 · release notes

New behavior for continue_with payload and verification redirect on login/registration

require_verified_address hook now triggers a pre-filled verification flow redirect for new Ory Network projects to enforce address verification before authentication.
show_verification_ui is removed from the default continue_with array in registration flows unless the show_verification_ui post-registration hook is defined or kratos_feature_flags_legacy_continue_with_verification_ui flag is enabled.

2 details in Everything

Graceful refresh count limit Jun 16, 2025 · release notes

Adds refresh_grace_limit config key to Ory Hydra for limiting graceful token rotation

Support for LINE as OIDC provider Jun 13, 2025 · release notes

Ory Network adds LINE as a supported OpenID Connect (OIDC) identity provider.

New events for Ory Network May 9, 2025 · release notes

Ory Network adds LoginInitiated, RegistrationInitiated, RecoveryInitiatedByAdmin events and full SCIM event stream for user/group lifecycle.

Adds LoginInitiated event emitted when a login flow is started
Adds RegistrationInitiated event emitted when a registration flow is started
Adds RecoveryInitiatedByAdmin event emitted when an account recovery flow is initiated by an administrator
Adds SCIM-based events for all data-writing endpoints: IdentityCreated, IdentityUpdated, IdentityDeleted, SCIMGroupCreated, SCIMGroupUpdated, SCIMGroupDeleted, SCIMProvisioningError
Emits IdentityUpdated events for affected users when group members are modified or groups are deleted

+1 more show less

Includes ScimClient attribute in all SCIM-triggered events holding the initiating client ID

6 details in Everything

Customize password migration hook body May 9, 2025 · release notes

Ory adds JSONNet body customization to password migration webhooks

Enables body field in webhook configuration to define request payload using JSONNet
Adds new context fields identifier and password to password migration hook events

2 details in Everything

SAML support in Ory Tunnel May 8, 2025 · release notes

Ory Tunnel adds SAML support for local development testing

Updates to registration flows, account experience, and login security May 8, 2025 · release notes

Ory enhances account security and multi-tenant onboarding with new enumeration controls and org-aware registration flows in its preview Account Experience.

SCIM Provisioning Support Apr 17, 2025 · release notes

Ory Network adds beta SCIM provisioning support for Enterprise subscriptions to automate identity management

Revoke token chains by consent request ID Feb 25, 2025 · release notes

Ory Network and Ory Hydra OEL can revoke token chains through DELETE /admin/oauth2/auth/sessions using consent_request_id.

Adds consent_request_id query parameter to the DELETE /admin/oauth2/auth/sessions endpoint to revoke all tokens bound to a specific OAuth2 consent session.

1 detail in Everything

CAPTCHA Support GA Feb 25, 2025 · release notes

Ory Network GA adds CAPTCHA support via Cloudflare Turnstile in self-service flows.

FedCM Support Feb 24, 2025 · release notes

Ory Network adds FedCM support for Google and NetID SSO with new Browser API endpoint

Adds a new Ory Network endpoint that returns FedCM parameters including SSO provider config URLs, a nonce encoding the provider ID, and a CSRF token for use with navigator.credentials.get
Enables Google and NetID SSO via Federated Credential Management (FedCM) standard in Ory Network

2 details in Everything

More Live Events details Dec 3, 2024 · release notes

Live error events now include error state and failure reason context

Support for Microsoft's oid parameter Dec 3, 2024 · release notes

Adds oid support for Microsoft Entra ID user identification in Ory Kratos

Enables using the oid field from OIDC id_token or the id field from the https://graph.microsoft.com/v1.0/me endpoint as a stable subject identifier for Microsoft users.

1 detail in Everything

Graceful Token Rotation in Ory OAuth2 / Ory Hydra Nov 21, 2024 · release notes

Adds configurable grace period for refresh token rotation in Ory OAuth2 and Hydra

Support for form_post in OIDC Discovery Nov 8, 2024 · release notes

Ory adds form_post response mode to the .well-known/openid-configuration discovery endpoint

OIDC discovery at .well-known/openid-configuration now advertises existing form_post support.

1 detail in Everything

Improved Recovery for B2B SSO Organizations Nov 8, 2024 · release notes

Enables account recovery for users who joined a B2B SSO org after creating their initial personal password account

Enables account recovery flow for users with personal passwords who later join a B2B SSO organization, even if their email domain is managed by the SSO org

1 detail in Everything

Improved Resource Owner Password Credentials Grant Nov 8, 2024 · release notes

ROPC grant now includes Ory Identity ID in sub claim and executes token hooks on refresh.

Adds Ory Identity ID to the sub claim for ROPC flows
Stores username in the ext.username claim when available
Executes token hooks during both initial and refresh token issuance for ROPC

3 details in Everything

Hybrid Flow Configuration for OAuth2 Clients Nov 8, 2024 · release notes

Ory Console now supports selecting hybrid OAuth2 flows in client configuration.

TTL for Workspace API Keys Oct 29, 2024 · release notes

Workspace API Keys now support Time-to-Live (TTL) settings for automatic expiration

Configure SMS 2FA and Login with SMS via Ory Console Oct 18, 2024 · release notes

The Ory Console now exposes configuration options for SMS-based authentication flows.

Client-Side PKCE Support for OIDC Flows in Ory Identities Oct 11, 2024 · release notes

Ory Identities now supports PKCE for OIDC social sign-in flows automatically.

Passwordless SMS login and registration Oct 11, 2024 · release notes

New SMS-based authentication capability for Ory Kratos users.

Japan data region Oct 11, 2024 · release notes

Ory Network adds a new Japan data region for local data storage and regional compliance.

Support for multiple providers of the same type within organizations Sep 24, 2024 · release notes

Ory Network allows configuring multiple providers of the same type within organizations

Support Salesforce OIDC Sep 24, 2024 · release notes

Adds Salesforce as a supported OIDC provider in Ory Kratos social sign-in.

Bulk permission check API Sep 23, 2024 · release notes

Ory Keto adds a new gRPC endpoint for bulk permission checks.

Adds a gRPC endpoint to verify multiple permissions in one request; the source links BatchCheckRequest documentation.

1 detail in Everything

Headers in webhooks now based on an allow list Sep 9, 2024 · release notes

Webhook ctx.request_headers now filtered to a specific allow list of headers

Webhooks now filter ctx.request_headers to include only a defined allow list of headers

1 detail in Everything

Configurable token prefix for OAuth2 tokens in Ory Hydra OEL Sep 9, 2024 · release notes

Adds oauth2.token_prefix config key in Ory Hydra OEL to customize token prefixes for OAuth2 tokens.

CAPTCHAs in Self-Service Flows Sep 9, 2024 · release notes

Ory Network adds preview CAPTCHA protection for browser login and registration self-service flows

Improved account linking interface Sep 9, 2024 · release notes

Improved account linking interface logic in Ory Identities.

The account linking UI now filters identity provider options based on login hints configuration.

1 detail in Everything

Delete projects via the API Sep 9, 2024 · release notes

Ory adds API and CLI capability to delete projects along with associated resources

Adds ability to delete Ory Network projects via API using a workspace API key
Deletes associated custom hostnames and other project resources automatically when deleting a project

2 details in Everything

Enhanced Session Extension Performance Jul 17, 2024 · release notes

Ory Kratos adds session extension performance improvements and a new response behavior via feature flag

Introduces row-level locking for session extension to reduce transaction contention.
Adds a feature flag that enables the /admin/session/.../extend endpoint to return 204 No Content instead of 200 and the session body.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The /admin/session/.../extend endpoint will now return 204 No Content for new Ory Network projects.

Password Migration Hook Jul 17, 2024 · release notes

Ory introduces Password Migration Hook to migrate users from legacy identity solutions without requiring hashed passwords.

Adds a password migration webhook that verifies credentials during login and updates the password in Ory Identities.

1 detail in Everything

US Continental Region for Ory Network Jul 15, 2024 · release notes

Ory Network adds US Continental Region as a new personal data storage location

Enables geographic data residency within the contiguous United States to enhance performance and reduce latency

1 detail in Everything

Ability to delete individual OIDC credentials Jul 15, 2024 · release notes

Ory Kratos adds ability to delete individual OIDC credentials for precise user management

Choose role when inviting a user to workspace Jul 15, 2024 · release notes

Adds role selection (developer or owner) when inviting users to an Ory workspace.

Enables selecting the developer or owner role during workspace user invitation
Allows multiple owners per workspace

2 details in Everything

Workspace API keys Jul 9, 2024 · release notes

Ory Network adds Workspace API keys for privileged operations across projects in a workspace.

Self-service Region Selection and Multi-Region Deployments Jun 21, 2024 · release notes

Self-service deployment region selection and multi-region configuration for Ory Network.

Adds self-service option to choose deployment region (US East, US West, EU Central) for all paid plans
Enables Enterprise users to configure multi-region deployments via self-service

2 details in Everything

Recovery Codes for API-based Flows Jun 19, 2024 · release notes

Adds admin API endpoint to create recovery codes for API-based clients

Ory Kratos 1.2.0 Jun 19, 2024 · release notes

Ory Kratos 1.2 adds Twitter login, two-step registration, webhooks with session data, and transient payloads.

Adds Sign in with Twitter social provider support
Adds selfservice.flows.registration.enable_legacy_flow config key to disable new two-step registration default
Allows including User Credentials Meta-Information on the list endpoint via API
Respects the return_to parameter in OIDC API flows
Makes verification and verification_ui hooks available in the login flow

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Two-step registration is now the default; users relying on legacy behavior must explicitly set selfservice.flows.registration.enable_legacy_flow to true

Two-step registration Apr 5, 2024 · release notes

Two-step registration allows separating identity trait entry from credential choice in Ory Kratos.

Adds preview two-step registration, separating identity traits from the choice of credentials.
Enables configuration of two-step registration via the Ory CLI

2 details in Everything

Ory now fully supports Passkeys! Apr 4, 2024 · release notes

Ory Network adds preview passkey support with resident keys and credential discovery, configurable through the Ory CLI.

New after login hook: Verification Mar 26, 2024 · release notes

Ory Kratos adds verification hook for post-login flow to enforce address verification.

Adds a verification login after-hook that displays a verification screen when a user address is not yet verified.

1 detail in Everything

TypeScript SDK based on fetch API released Mar 25, 2024 · release notes

Ory releases @ory/client-fetch, a new TypeScript SDK built on the fetch API.

Adds @ory/client-fetch, a new npm package providing a TypeScript SDK powered by the native fetch API instead of axios.
Introduces a parallel client library option to the existing @ory/client SDK, allowing users to switch their dependency to a fetch-based implementation.

2 details in Everything

LinkedIn v2 Provider Mar 22, 2024 · release notes

Adds new linkedin_v2 single sign-on provider for LinkedIn authentication

Adds linkedin_v2 identity configuration key to enable the new LinkedIn SSO provider via Ory Console or config file

1 detail in Everything

Choose edge session TTL Mar 21, 2024 · release notes

Introduces configurable TTL for Ory Edge Sessions to control caching behavior.

Adds the capability to configure the Time-to-Live (TTL) for Ory Edge Sessions.

1 detail in Everything

Login with X (formerly known as Twitter) Mar 20, 2024 · release notes

Adds X (Twitter) social sign-in support to Ory Kratos

Enables social sign-in for X (Twitter), allowing users to log in using their X accounts

1 detail in Everything

Request URL in email and SMS templates for theming Mar 19, 2024 · release notes

Adds request_url parameter to email and SMS templates for theming

Add transient payloads to all self-service flows Mar 19, 2024 · release notes

Adds transient_payload property to all Ory self-service flows for non-persisted arbitrary JSON data.

Enables using transient payloads for theming email templates and within actions/webhooks

1 detail in Everything

Disable logout confirmation for specific OAuth2 clients Mar 15, 2024 · release notes

Ory Hydra adds logout confirmation bypass for specific OAuth2 clients

Ory Kratos v1.1.0 Mar 14, 2024 · release notes

Ory Kratos v1.1.0 adds SMS 2FA, Magic Code login, Session-to-JWT conversion, fuzzy identity search, and native mobile social login

Adds phone verification and two-factor authentication (2FA) via SMS gateways like Twilio
Adds passwordless Magic Code login method that sends a one-time code to email
Adds Session-to-JWT conversion capability for Ory Session Cookies or Tokens
Adds native support for Sign in with Google and Sign in with Apple on Android/iOS
Adds account linking screens for users registering with password and later using social login

+5 more show less

Enables CORS configuration hot-reloading without restart
Adds preview fuzzy search for credential identifiers in the Ory Network Identity List API.
Adds batch identity listing capability
Allows importing HMAC-hashed passwords
Extends webhooks to update identity admin metadata and cover all login/registration methods including Passkeys and TOTP

10 details in Everything

Export credentials through listIdentities Mar 14, 2024 · release notes

The release notes introduce include_credential for listIdentities to include credential data in identity listings.

Ory Hydra v2.2.0 Mar 14, 2024 · release notes

Ory Hydra v2.2.0 adds OIDC Verifiable Credentials support and client ID import for migration.

Supports the OIDC Verifiable Credentials specification for identity verification
Adds the ability to bypass the logout consent screen for specific clients
Enables simplified migration via a new feature to import OAuth2 Client IDs

3 details in Everything

Improved OAuth2 performance and export of JWKs via CLI Jan 19, 2024 · release notes

Ory CLI gains a new JWK export command and OAuth2 flows see performance improvements.

OAuth2 request processing has been optimized for improved response times.

1 detail in Everything

Customizing form labels on logins Jan 19, 2024 · release notes

Ory allows customizing the identifier input label on login screens to match identity schema titles

Login screen now uses the default identity schema identifier title as the input label instead of the static ID text when a single identifier is present

1 detail in Everything

Track events in Ory Network live with advanced filtering Jan 18, 2024 · release notes

Ory Network adds an Events Page with filtering options and live streaming for tracking project activities.

Adds an Events page in the Ory Network Console to track live project activities
Enables filtering of events by type, including Identity, Permission, OAuth2, and Project categories
Previously announced live event streaming can send events to user infrastructure; it is available for Ory Network Enterprise.

3 details in Everything

Stream live event data in Ory Network Jan 12, 2024 · release notes

Enterprise customers can pipe real-time identity events directly to external infrastructure for analytics and audits.

Additional id token audiences are now allowed Jan 9, 2024 · release notes

Ory allows specifying additional ID token audiences in OIDC flows for native apps.

Adds support for configuring a list of additional id token audiences in OIDC flows.

1 detail in Everything

Refined search and filtering for identities endpoint Jan 9, 2024 · release notes

Adds ids query parameter to GET /admin/identities endpoint for targeted identity retrieval.

Allows filtering GET /admin/identities results by individual IDs via the ids query parameter

1 detail in Everything

Native recovery support Jan 9, 2024 · release notes

Ory Kratos adds native API client support for account recovery flows.

Enables initiating the recovery flow directly from native API clients like mobile apps instead of relying on browser-based redirection.

1 detail in Everything

Improved OAuth2 registration flow Nov 8, 2023 · release notes

OAuth2 prompt=registration flag now correctly triggers registration for persistent sessions

Advanced Customer Activity Analytics Nov 8, 2023 · release notes

Ory Console adds Activity Analytics view with time series and drill-down for paid plans.

Adds Activity screen in Ory Console showing time series for Logins, Signups, and Recoveries with selectable time resolution
Enables Session drill down by country and native app vs. browser traffic breakdown in the Activity view

2 details in Everything

Import HMAC hashed credentials Oct 20, 2023 · release notes

Ory Kratos allows importing credentials hashed with HMAC.

Session Location in Activity Page Oct 19, 2023 · release notes

Ory Network activity page now shows geographic distribution and platform differentiation for user sessions.

Adds geographic distribution metrics to the Ory Network activity page
Adds web vs mobile user differentiation on the Ory Network activity page

2 details in Everything

Consistency Controls in Identity List API Oct 19, 2023 · release notes

Adds consistency query parameter to Ory Identity List API for strong vs eventual consistency control.

Full Custom Domain support for OAuth2 Endpoints Oct 6, 2023 · release notes

OAuth2 auth, token, JWKS, and userinfo endpoints now support full custom domains

New and elegant default email templates Oct 6, 2023 · release notes

Ory updates default email templates for user-facing notifications like confirmation and login codes.

Replaces the default email templates used by Ory Network and Ory Kratos with new user-friendly designs for confirmation, one-time codes, and recovery.

1 detail in Everything

Enterprise Single-Sign-On Support for B2B Oct 6, 2023 · release notes

Ory Network adds Enterprise SSO support for B2B via new Organization domains and connections

Adds support for creating Organizations in the Ory Console to group users by domain for B2B SSO
Adds domain assignment capability to Organizations so Account Experience can detect and route SSO logins automatically
Adds ability to configure SSO Provider credentials (Okta, Active Directory, Google Workspace, or OIDC) per Organization

3 details in Everything

Directly route users to Registration in OAuth2 flows Oct 6, 2023 · release notes

Ory OAuth2 now supports prompt=registration to bypass login and direct users to signup.

Adds prompt=registration parameter to the OAuth2 Authorization Code Flow authorization request

1 detail in Everything

New and improved Ory Network status page Oct 2, 2023 · release notes

Ory Network introduces a new status page with EU/US region indicators and latency data

Launches a new Ory Network status page with improved uptime display and subscription options for email, SMS, or RSS notifications.
Adds separate status indicators for EU and US regions to allow regional monitoring of service health.
Exposes average latency values for different APIs on the new status dashboard.
Migrates past incident history to the new status page while keeping the legacy page accessible at status-legacy.ory.sh until the end of 2023.

4 details in Everything

Native Social Sign-In with Google Sep 28, 2023 · release notes

Adds native social sign-in with Google for iOS, Android, and native apps via client-side id_token exchange

Adds support for native social sign-in using the Google SDK for iOS, Android, and native apps
Enables client-side id_token exchange with Ory without requiring a browser

2 details in Everything

Native Social Sign-In with Apple Sep 28, 2023 · release notes

Ory supports native Apple Sign-In via ID Token input in login and registration flows

Social Login: Enforce Re-Authentication with auth_type Sep 26, 2023 · release notes

Ory Kratos adds auth_type parameter for social login to enforce re-authentication

Adds auth_type parameter support in OIDC providers for social login.
Enables triggering re-authentication by setting auth_type=re-authenticate.

2 details in Everything

Low-code JWT API Gateway integration Sep 26, 2023 · release notes

Ory adds tokenized query parameter to /session/whoami for JWT conversion.

Enables use of pre-configured JWT templates with distinct signing keys and claims for session-to-JWT conversion.

1 detail in Everything

Support for Dutch 🇳🇱 and Swedish 🇸🇪 in Ory Account Experience Sep 26, 2023 · release notes

Ory Account Experience now supports Dutch and Swedish languages, auto-detected via Accept-Language header without config changes.

Adds Dutch (🇳🇱) and Swedish (🇸🇪) language options to Ory Account Experience

1 detail in Everything

More control and extensibility for settings and login flows Sep 26, 2023 · release notes

Fine-grained hook configs for settings/login flows and a new session-revocation capability in the settings flow.

Adds fine-grained hook configurations to enhance post-settings flows for authentication methods totp, webauthn, lookup_secret and post-login flows for totp, lookup_secret, and code
Allows revoking all active sessions (except the current one) when changing an auth method in the settings flow

2 details in Everything

Improved subscription management and project list Sep 20, 2023 · release notes

Ory introduces new subscription management screens and an enhanced projects list in the Console UI.

└──▷ HOW TO FIND IT

Access the new billing settings directly to manage your Ory subscription.

📍https://console.ory.sh/projects/current/settings/billing

Navigate to the new projects list view to organize your workspace.

📍https://console.ory.sh/projects

Introduces a new subscription management interface for easier billing oversight
Adds a redesigned projects list to simplify project organization and management

2 details in Everything

Customer Activity Analytics in Console Sep 18, 2023 · release notes

New Activity section in Ory Console tracks daily sign-ups and logins.

Add favicon configuration to Ory Account Experience Sep 7, 2023 · release notes

Adds favicon configuration in Ory Network Console account experience theming

Allows configuring the favicon used in the Ory Account Experience via the console UI

1 detail in Everything

Support for Spanish and German in Ory Account Experience Sep 7, 2023 · release notes

Spanish and German localization added to Ory Account Experience for accessible user flows.

Enables Spanish language support in Ory Account Experience for user-facing flows.
Enables German language support in Ory Account Experience for user-facing flows.

2 details in Everything

Ory Network: US Region and Global Serving Sep 7, 2023 · release notes

Ory Network adds US-east/west data centers and US only or Global operational modes for new releases.

Adds a US-only operational mode for Scale and Enterprise customers, configured through an Ory account representative.
Adds Global operational mode (enterprise-only) that routes traffic to the closest data center while optimizing data locality

2 details in Everything

Ory Console v2 now available to all users Aug 31, 2023 · release notes

Ory Console v2 is now generally available for all users, enabling new capabilities like Ory Actions management and enhanced metrics.

└──▷ HOW TO FIND IT

Access the new console to view metrics and manage Ory Actions.

📍https://console.ory.sh

Adds the new Ory Console v2 interface to all users on the Ory Network for managing identities, interfaces, flows, and statistics
Enables full managed access to Ory Actions through the new Ory Console UI

2 details in Everything

Expanded message customization and i18n support Aug 31, 2023 · release notes

Ory Kratos adds new i18n message codes and context for expanded UI translation

New message codes (1010014, 1010015, 1040005-1040006, 1070012-1070013, 4000028-4000036, 4010007-4010008, 4040002-4040003) are available for translations in Ory Kratos
Existing message codes (1050014, 1050018, 1070002, 4000001, 4000003-4000004, 4000017-4000026, 4010001, 4040001, 4050001, 4060005, 4070005, 5000001) gain additional context for translations

2 details in Everything

Bugfixes improving recovery, OAuth2, and OIDC flows Aug 31, 2023 · release notes

Ory adds post-recovery hook interruption, OAuth2 verification confirmation, and OIDC provider-verified address marking.

Enables post-recovery hooks to interrupt the recovery flow in Ory Network
Confirms OAuth2 flows when verification is required after registration
Allows OIDC provider-verified addresses to be marked verified during registration.

3 details in Everything

Logout flow supports return_to query parameter Aug 23, 2023 · release notes

Ory Kratos logout flow now supports the return_to query parameter for post-logout redirection

Set custom hostname as redirect for OIDC Aug 23, 2023 · release notes

Enables setting a custom hostname for OIDC social sign-in redirect URLs

Adds ability to set custom hostname as redirect URL for Social Sign-in Providers in Ory Kratos

1 detail in Everything

OAuth2 webhooks in Ory Network Aug 23, 2023 · release notes

Adds OAuth2 webhook support via oauth2.token_hook configuration in Ory Network.

Support for multiple WebAuthN origins Aug 23, 2023 · release notes

Ory supports multiple WebAuthN origins via config key or Console UI for broader cross-domain auth.

Adds selfservice.methods.webauthn.config.rp.origins config key to define multiple WebAuthN origins
Enables specifying WebAuthN origins directly in the Ory Console under Authentication > Passwordless login

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecates the WebAuthN relying-party icon configuration selfservice.methods.webauthn.config.rp.icon for security reasons.

Toggle Account Experience Welcome page Jul 18, 2023 · release notes

Adds a toggle to disable the Account Experience Welcome page in Ory Network console

Ory Identities improvements and bugfixes Jul 13, 2023 · release notes

Ory Identities now normalizes email case, fixes pagination and adds browser+JSON OIDC flow support.

Identity list pagination now includes the last page and sessions are being sorted by creation date
Uppercase email addresses are normalized properly
OIDC login requests are now accepted when using browser+JSON login flows

3 details in Everything

Enable CORS per OAuth2 client Jul 12, 2023 · release notes

Ory OAuth2 now supports per-client CORS configuration via CLI for targeted cross-origin access control.

└──▷ USE IT

Configure a specific OAuth2 client to allow CORS requests from https://example.com.

shell

ory create oauth2-client --allowed-cors-origin https://example.com

ory create oauth2-client --allowed-cors-origin <url> sets the allowed CORS origins for a new OAuth2 client.

1 detail in Everything

Ory OAuth2: Profile scope and override return_to Jul 12, 2023 · release notes

Adds profile OIDC scope support and oauth2_provider_override_return_to config setting to Ory OAuth2

Adds profile scope mapping of identity data to username, website, name and updated_at claims when using Ory Account Experience; custom consent endpoints are unaffected.
Adds oauth2_provider_override_return_to configuration key to force redirection back to the OAuth2 provider instead of respecting the return_to query parameter

2 details in Everything

Introducing the All-New Ory Console: Elevating Your Identity Management Experience Jun 22, 2023 · release notes

New Ory Console delivers visual overhaul, stats/metrics dashboard, and streamlined config for auth, social connections, and theming.

Adds stats and metrics UI feature in the new Ory Console to provide visibility into customer events and user interactions.
Introduces a visual revamp of the Ory Console with an enhanced navigation system for administrative tasks.
Simplifies configuration of authentication settings, social sign-in connections, and Account Experience theming directly via the new console interface.

3 details in Everything

Support for password import with sha-crypt and md5-crypt Jun 15, 2023 · release notes

Ory Kratos supports importing identities with sha-crypt and md5-crypt hashes for legacy migrations.

Adds sha-crypt hash format support for password import during identity migration
Adds md5-crypt hash format support for password import during identity migration

2 details in Everything

Identity Export with all Credential Types May 31, 2023 · release notes

Ory Kratos Admin API adds include_credential parameter to export all credential types.

Social sign-in for native and mobile apps May 8, 2023 · release notes

Ory adds OpenID Connect social sign-in support for native mobile applications

Ory OAuth2: Backchannel logout, session termination and session extension Apr 25, 2023 · release notes

Ory OAuth2/Hydra adds API endpoints to extend session lifetimes and revoke individual sessions for backchannel logout.

Adds the revokeOAuth2LoginSessions API method to allow terminating a single session by its ID (sid claim in the id_token) for OpenID Connect backchannel logout
Enables extending session lifetimes at login time via new APIs when accepting login challenges

2 details in Everything

Smooth Social Sign-In with upstream parameters Apr 11, 2023 · release notes

Ory Kratos now supports passing upstream parameters like login_hint and hd to Google during social sign-in.

Adds support for login_hint and hd upstream provider parameters in Ory Kratos social sign-in flows
Enables passing custom parameters via the submit form body to customize Google sign-in experience

2 details in Everything

Bulk import for Identities Apr 11, 2023 · release notes

New batch API for creating up to 1000 identities in a single transaction

Ory OAuth2: OIDC Logout Mar 17, 2023 · release notes

Ory OAuth2 introduces a new OIDC logout endpoint (/oauth2/sessions/logout) for session termination.

Adds /oauth2/sessions/logout for end-user-initiated OAuth2 logout; sessions at the identity provider, including Ory Identities, remain active.
Removes the need to call Ory OAuth2 administrative APIs for logging out users

2 details in Everything

Skip showing OAuth2 consent screen for 1P apps Mar 7, 2023 · release notes

Adds toggle in Ory Console to skip OAuth2 consent screen for trusted 1P apps

Custom UI Views for Multiple Domains with Ory Network Mar 7, 2023 · release notes

Ory Network Scale plan now supports custom UI base URLs for each registered domain.

Enhanced registration flows to collect more customer information Mar 1, 2023 · release notes

New transient_payload mechanism enables arbitrary data injection into Ory Kratos registration flows for downstream webhook processing.

Allows passing custom key-value pairs via transient_payload in registration requests.

1 detail in Everything

An API to fetch Identities by Email or Username Feb 24, 2023 · release notes

Ory Identities can retrieve user profiles by a credential identifier such as email or username, rather than requiring the identity UUID.

Adds credentials_identifier filtering to the Identities Admin API for fetching profiles by email or username.

1 detail in Everything

Real-time user activity updates, NetID & API Keys Feb 16, 2023 · release notes

Real-time Ory Actions webhooks and NetID social login in this release.

Ory Actions webhooks can update identity traits, metadata and addresses during registration and settings flows using response parsing.
Adds support for NetID as a social (OIDC) login method in Ory Network

2 details in Everything

Improved Email Verification flow Feb 15, 2023 · release notes

Ory adds confirmation screen for email verification with redirect support for magic links and one-time codes.

Adds a Confirmation screen after successful email verification to route users via Global default redirect URL, Post-Verification Redirect URL, or return_to URL
Supports the new confirmation flow in both magic links and one-time code verification methods

2 details in Everything

Offline scope support for Google social login Feb 15, 2023 · release notes

Ory Kratos now supports the offline scope for Google social login providers

Adds support for the offline OAuth scope in the Sign in with Google provider to enable token refresh without browser presence

1 detail in Everything

Edge Sessions Feb 9, 2023 · release notes

Edge Sessions introduces opt-in Edge Session Caching in Ory Console for ~30-40ms latency.

Ory Actions: Customize Identities Feb 7, 2023 · release notes

Ory Actions introduces dynamic identity management to update identities in real-time based on user activities.

Enables dynamic management of Ory Identities with the ability to update them in real-time based on user activities such as login, registration, or profile changes
Allows enriching Ory Identities with information from external sources like Hubspot, Stripe, and Wordpress, or internal services via Ory Actions

2 details in Everything

Email Monitoring Dec 21, 2022 · release notes

Ory Network adds an email monitoring dashboard to track delivery for password recovery and verification emails.

Ory Network Enhanced B2B Enterprise Capabilities Dec 19, 2022 · release notes

Ory Network adds multi-brand support for Scale plans to manage multiple custom domains.

Ory Kratos v0.11.0 Dec 2, 2022 · release notes

Ory Kratos v0.11.0 adds verification codes, OAuth2 provider support, session management APIs, and blocking webhooks.

oauth2_provider.url configuration enables acting as the login app for Ory Hydra Consent & Login Flow
New APIs available to manage Ory Sessions
Ory Sessions now contain device information in API responses
Added social sign-in data mapper claims and customizable admin/public metadata options
Add webhooks that can block the request for additional validation

+4 more show less

Add asynchronous webhooks which do not block the request
CLI helper added to clean up stale data
Import of MD5-hashed passwords is now supported
Verification and recovery codes are now the default strategy, replacing magic links

9 details in Everything

Ory Hydra v2.0.0 Oct 27, 2022 · release notes

Ory Hydra 2.0 adds native Ory Kratos integration and ES256 JWT signing support.

Adds native integration with Ory Kratos as a login provider for OAuth2 Consent Flow
Adds support for ES256 key type to sign ID Tokens and OAuth 2.0 Access Tokens in JWT format
Updates key naming mechanism to conform with industry best practices
Refactors internal database structure to reduce storage and optimize query performance

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Primary keys are now UUIDs; it is no longer possible to choose the OAuth 2.0 Client ID.
!The database schema changed significantly, requiring a full backup and potentially locking tables during upgrade.

Ory Keto v0.10.0 Sep 27, 2022 · release notes

Ory Keto v0.10.0 introduces the Ory Permission Language (userset-rewrites) for defining global permission rules using TypeScript.

Ory Permission Language adds userset-rewrites to define global permission rules like "every user who is an owner also has read access"
Supports TypeScript subset syntax, enabling use of existing syntax highlighting, formatting tools, linters, and unit test frameworks.

2 details in Everything

Ory

Summary

How Ory helps

Languages

Features

What Ory offers you

release

example

release

example

release

release

example

release

release

release

release

release

example

release

release

example

release

release

release

release

example

release

release

release

release

Command line

Score card

Trajectory

Release-note detail over time

Coverage

Identity & access 3

Releases

Add the badge to your README