Code samples and configuration recipes for connecting Ory Network to third-party products.
Looking for setup instructions? See the integration's page on ory.com/docs/integrations — that is the canonical reference. This repository is the companion code-samples surface.
Every integration in this repository is listed in registry.yaml — a single file with name, category, type, maintainership, and description for all entries. That file is generated by scripts/build-registry.js from the per-integration registry.entry.yaml files.
A high-level summary, generated from the registry:
| Type | Count | What it means |
|---|---|---|
config |
105 | Configuration in the Ory Console only — no webhook code |
webhook |
36 | Ory Action calls a deployed handler during a flow (registration, login, etc.) |
session-validation |
4 | Validates Ory sessions / JWTs at the edge or gateway tier |
sdk-client |
2 | Vendor SDK in your app, fed Ory identity attributes (feature flags, etc.) |
http-event |
0 | Consumer of Ory Network Live Events (Enterprise feature). Templates exist; no integrations yet. |
| Maintainer | Count |
|---|---|
| Ory Engineering | 61 |
| Community contributors | 86 |
Counts: 147 integrations across 28 categories.
Each entry also carries a multi-value protocol: field (oidc, oauth2, saml2, scim2, smtp, rest-api, http-webhook, jwt, otlp, webauthn, openid-2.0, custom) so the registry is filterable both by Ory-side mechanism (oryMechanism) and by vendor-side wire protocol (protocol).
Each subdirectory under a category folder is one integration.
| Category | What it covers |
|---|---|
agent-identity/ |
Agent identity / KYA platforms |
api-gateways/ |
API gateway JWT verification (Apigee, AWS API Gateway, Kong, Traefik, ...) |
cdp-analytics/ |
Customer-data + analytics platforms (Segment, Mixpanel, Amplitude, ...) |
cloud-infrastructure/ |
Cloud provider integrations (AWS, GCP, ...) |
compliance-audit/ |
Compliance and audit (Drata, Vanta, ...) |
consent-privacy/ |
Consent and privacy management (OneTrust, Didomi, Osano) |
containerization/ |
Container runtime references (Docker, Kubernetes) |
crm/ |
Customer relationship management (HubSpot, Pipedrive, Salesforce, ...) |
data-persistence/ |
Database backends |
directory-sync/ |
SCIM and directory sync (Okta SCIM, Google Workspace, JumpCloud, OneLogin) |
edge-token-validation/ |
Edge / CDN token validation (Akamai EdgeWorkers, Cloudflare Workers, Fastly Compute) |
email-providers/ |
Transactional email (SendGrid, Mailgun, ...) |
enterprise-sso/ |
Enterprise SSO providers (Okta, Auth0, ...) |
feature-flags/ |
Feature flag platforms |
fraud-bot-protection/ |
Fraud and bot protection (Castle, ...) |
generic-protocols/ |
Standard protocols (OIDC generic, SAML generic, ...) |
government-identity/ |
Government identity verification |
iac-devops/ |
Infrastructure-as-code + DevOps |
identity-verification/ |
Identity verification providers (Persona, Jumio, Onfido, LexisNexis, Prove) |
mfa/ |
Multi-factor authentication (hardware keys, push) |
monitoring-observability/ |
Logging, metrics, tracing |
payment-billing/ |
Payment + billing platforms |
siem-security-analytics/ |
SIEM + security analytics |
sms-providers/ |
SMS gateways (Twilio, Vonage, ...) |
social-sign-in/ |
Social sign-in OIDC providers (Google, Microsoft, GitHub, ...) |
support-helpdesk/ |
Support and helpdesk platforms |
user-enrichment/ |
User data enrichment |
webhook-infrastructure/ |
Webhook delivery infrastructure |
Every integration is one of:
A small handler that Ory Actions calls during a flow (registration, login, identity update). Folder shape:
<category>/<integration>/
├── README.md
├── registry.entry.yaml
├── ory-actions.yaml
├── jsonnet/
└── webhook/
├── server.js
├── package.json
└── .env.example
- Template:
_examples/_template-webhook/ - Reference example:
crm/hubspot/— Express handler that syncs Ory identities to HubSpot contacts.
Configuration in the Ory Console only. No webhook code. Most OIDC providers, SAML/SCIM integrations, and API gateway recipes are config-only.
<category>/<integration>/
├── README.md
├── registry.entry.yaml
└── ory-console-steps.md
- Template:
_examples/_template-config/ - Reference example:
enterprise-sso/okta/— OIDC provider configuration with detailed Console steps.
Consumer of Ory Network Live Event Streams (an Enterprise feature). Subscribes to fire-and-forget events like IdentityCreated or LoginSucceeded.
<category>/<integration>/
├── README.md
├── registry.entry.yaml
├── ory-event-stream.yaml
└── webhook/
├── server.js
├── idempotency.js
├── package.json
└── .env.example
- Template:
_examples/_template-http-event/ - Reference example: none yet — only the template ships today.
Live events are at-least-once with no ordering guarantees, so the template includes a sha256-of-body deduplication helper. For production, swap the in-memory store for Redis or DynamoDB.
- Open an issue using the New integration template.
- Copy the matching template into the right category:
cp -R _examples/_template-webhook crm/<your-integration>
- Fill out the README, code, and
registry.entry.yaml. - Regenerate the registry:
cd scripts && npm install && cd .. node scripts/build-registry.js
- Open a PR with DCO sign-off (
git commit -s).
See CONTRIBUTING.md for the full contribution flow.
Apache-2.0. See LICENSE.