Ory Kratos

Ory Kratos is a headless identity server that handles login, registration, password recovery, and account management without depending on Auth0. It handles the backend logic: password hashing, session management, MFA, social sign-in, and you build whatever frontend you want on top of its API.

"Headless" means no built-in UI. Kratos exposes APIs and you render the login forms, registration flows, and account settings pages yourself. This gives you complete control over the user experience but means more work upfront.

Kratos handles identity lifecycle: registration, login, logout, account recovery, email verification, settings management, and MFA (TOTP, WebAuthn). It stores identities in Postgres or MySQL. The security model is solid, built by a team that takes auth seriously. Ory Network (the managed cloud) offers a free tier with 25K monthly active users, which is generous. Beyond that, pricing starts at usage-based rates.

The catch: the learning curve is steep. Kratos has its own concepts (self-service flows, identity schemas, Jsonnet mappers) that take real time to understand. The documentation is extensive but dense. If you just need "add Google login to my app," Kratos is like bringing a bulldozer to dig a garden hole. Supertokens or even NextAuth are simpler for straightforward auth needs.