I like that Ory offers a top-notch service with an API-first approach and doesn't impose any restrictions on our existing apps, making migration very easy. It's great that we can stay GDPR compliant without any hassle. I appreciate the self-service flows where all auth flows follow the same model, allowing us to render form fields and errors in our views effortlessly. The multi-factor authentication (MFA) feature is also without hassle, which is very beneficial. Additionally, the fact that it's open-source and self-hosted while maintaining compliance is a huge advantage for us. It was very easy to set up, which really helped us get started quickly. Review collected by and hosted on G2.com.

there's literally anything to dislike about it. it's amazing. Review collected by and hosted on G2.com.

The pricing feels competitive for the feature set, particularly when compared with more rigid, fully managed alternatives. I also appreciate how much room there is for customization—Ory’s API-first, modular approach makes it possible to tailor authentication and authorization flows, identity schemas, and user-facing experiences to specific product requirements. It’s also helpful that Ory supports both managed and self-hosted deployment models, depending on what you need. Review collected by and hosted on G2.com.

Ory lacks native multi-tenancy support, which forces teams to implement their own tenancy logic or rely on workarounds. This adds complexity and ongoing maintenance overhead, especially in B2B scenarios or multi-project setups.

Overall, the platform is powerful, but the initial configuration can be challenging. There’s a steep learning curve before you can use Ory effectively; once the team understands how it works, it becomes much easier to work with day to day. Review collected by and hosted on G2.com.

I really like that Ory is full-featured and affordable, which is great for my team. It's open-sourced, which I always appreciate, and they're very responsive when it comes to support. I'm a big fan of Ory Hydra on the network, as I think it's really well done. The open-source modules are a major plus. The initial setup was simple, and we have had no complaints about that. Ory is fully integrated into our stack and has addressed the complexities of hosting, monitoring, and maintaining authentication as a service. I rate it a solid 10 for recommending to others. Review collected by and hosted on G2.com.

I think the pricing for the orgs feature is a bit high, but it's so trivial to handle on the application side for our purposes that it hardly matters. Review collected by and hosted on G2.com.

What I like best about Ory is its modular, composable architecture — Kratos and Oathkeeper run as independent services with no hard dependencies, so we deploy and scale only what we need, unlike monolithic IAM stacks.

It's cloud-native and Kubernetes-friendly by design, slotting naturally into our infrastructure and scaling horizontally without surprises.

Being open-source with a real self-hosting option (same codebase as Ory Network) gives us full transparency, architectural control, and zero vendor lock-in.

We implemented the UI/UX entirely on our own using Ory's headless APIs, so we have full control over the user experience. We haven't used any third-party integrations — Ory covers our identity and access needs on its own. Performance has been solid and fully meets our requirements. Pricing isn't relevant for us since we're running the open-source self-hosted version. We don't use Ory's support or any AI/intelligence features. Review collected by and hosted on G2.com.

The documentation has gaps and is hard to navigate, especially for the open-source offering — some configuration fields aren't well described, and common scenarios (like wiring Kratos and Oathkeeper together) lack clear end-to-end examples.

Since Ory is composable, you have to glue the services together yourself, which is doable but non-trivial to do robustly in production. Better out-of-the-box orchestration between Ory's own products would make self-hosting noticeably smoother.

We also feel the open-source version lacks several capabilities we'd really like to have: a proper administrative UI, built-in brute force protection, DoS protection, credential stuffing protection, suspicious IP throttling, a fine-grained permission API, permissions tied to machine-to-machine tokens, and multi-tenancy with B2B SSO. The OSS release generally doesn't keep pace with Enterprise/Network, so these gaps occasionally force us to build workarounds. Review collected by and hosted on G2.com.

Ory took us less than two weeks of dev time to set up. We migrated from the self-hosted version to Ory Network and the team was there to support us the whole time. They fixed several bugs we reported as part of helping us along. Using Ory unblocked contracts with some of our startup's first enterprise customers, who had bespoke authentication needs such as SAML. Review collected by and hosted on G2.com.

Honestly I don't have any downsides to list. One potential surprise, although there are good reasons for it once you come to understand the product architecturally, is that there isn't really a concept of "one Ory project per customer". Rather, customers with similar authentication needs may share the same Ory project, and others with different needs may need to go in a different project. There's potential for it to get a little messy. There also isn't support for Terraform (or similar configuration-as-code) and a few UI bugs necessitated hotfixes and use of the console, which my org didn't prefer. Overall, I am nitpicking; the product as a whole is quite sound and unlocked a huge amount of value for us. Review collected by and hosted on G2.com.

Ory makes it easy to set up secure authentication for my SaaS app. The guides are solid, and the supportive Slack community further enhances the overall experience. SDKs are available for many programming languages, which makes it straightforward to integrate with my existing stack. Review collected by and hosted on G2.com.

The standard “Ory Network Production” plan feels fairly priced, but it’s missing some important features like B2B SSO (Growth plan) and SAML (Enterprise plan). The jump from $770/year to almost $10,000/year is huge, and the Enterprise price isn’t even listed, which suggests it’s likely much higher. Review collected by and hosted on G2.com.

What we like best is that Ory gives us a secure, well-designed authentication foundation instead of forcing us to build and maintain a home-made authentication tool.

It fits well with our need for custom authentication flows: SSO, MFA/2FA, magic links, account recovery, and identity schemas.

From a UI/UX point of view, Ory being headless is useful because we can keep control over the member experience and adapt authentication screens to our product. It also gives us flexibility for web and app flows.

Integration-wise, Ory supports the main identity-provider needs we have, including Google, Facebook, Apple, Kratos, Hydra, APIs, SDKs, CLI, and custom identity schemas.

Pricing/ROI is also strong for our use case: self-hosting Ory is cheaper than several hosted alternatives we compared, while still giving us a serious authentication platform. Review collected by and hosted on G2.com.

The main downside is operational and integration complexity. Ory is powerful, but it is not always plug-and-play. Because it is headless, we must build and maintain more UI, glue code, proxy logic, configuration, deployment, and internal documentation ourselves.

Some areas are also less mature compared with bigger commercial products: Terraform support is limited, SLA/scalability guarantees are not always clear for self-hosting, key rotation automation is missing, and some admin/moderation features are less complete.

Onboarding can be hard: engineers need to understand Kratos, Hydra, flows, identity schemas, configuration before they can work efficiently.

AI/intelligence is not a strong selling point in our current usage. We use Ory mostly as a secure authentication platform, not for AI-driven authentication insights. Review collected by and hosted on G2.com.

As someone focused on backend engineering, I appreciate that Ory tackles a genuinely hard problem—identity and access management—in a modular, cloud-native way. I find it especially compelling that I can self-host it, integrate it with Kubernetes, and rely on standards like OAuth2/OIDC, while still keeping meaningful architectural control as a developer. Review collected by and hosted on G2.com.

If I had to highlight one area for improvement, it would be the onboarding complexity. Ory offers a lot of flexibility, which is great for production-grade systems, but at first it can feel more involved than plug-and-play authentication solutions. I think streamlining the first-time developer experience, or providing more opinionated starter templates, would make adoption even smoother. Review collected by and hosted on G2.com.

I appreciate Ory's headless and composable nature, which allows us to run part of the authentication and authorization stack ourselves and mix and match different components. The solution is simple yet scales well, which is important for us as we securely store tokens at scale. The setup also supports the majority of complex OAuth2 flows in a straightforward way. I also like the ability to connect internally to the admin APIs while migrating our complex legacy stack into Ory, ensuring our customers do not notice any changes during the process. Review collected by and hosted on G2.com.

We are running the non-commercial version of Ory and it's not feature complete. We're missing some important features related to recent enhancements of Oauth2 (related to AI agent integrations). Since Ory is composable, you have to glue all Ory services together yourself, which is hard to do robustly. It would be better if Ory allowed for better orchestration between their products and existing platforms, as well as between Ory's products themselves. Also, the initial setup was hard since the documentation was minimal at the time, although it has improved massively, there is still room for improvement. Review collected by and hosted on G2.com.

I like that Ory is fully OAuth2/OIDC compliant, giving us a standardized way for applications to integrate with the CIAM platform. I appreciate having control over the platform through various APIs, which has helped tackle some difficult edge cases important for our business. Additionally, the support we've received from the Ory team in our technical setup has been beneficial. Review collected by and hosted on G2.com.

The hosted UI in the SaaS product offers limited customisability, so we couldn't develop the UI to the full requirements. On the security side, Ory APIs are protected with API keys that can't be scoped, leading to more of the platform's functionality being exposed than preferred. Also, we can't use a client_secret grant to access the API. Additionally, Ory does not provide an infrastructure as code (IaC) provider like Terraform, which meant we had to come up with a similar solution on our own. Review collected by and hosted on G2.com.