v2.13.0 · canvas design system

Identity and OAuth2, on your terms.

Ionize is a free identity solution built on Ory Kratos and Hydra. Self-hosted, standards-compliant, no per-seat pricing.

Open the playground Read the docs

✓ Apache 2.0✓ OIDC · OAuth2 · PKCE✓ Self-hosted

~60 seconds · zero config

Stand up the whole stack locally with one command.

ionctl auto-installs Podman, builds dev images for every Ionize repo, brings up infra → Ory → apps → seed in order, and hands you working URLs and a test login.

bash

$

npm install -g @nannier/ionctl

$

ionctl dev

✓ kratos      healthy

✓ hydra       healthy

✓ services    → http://localhost:3002 · http://localhost:4002

✓ auth        → http://localhost:3000

✓ dashboard      → http://localhost:3001

demo user → demo@demo.user / admin123!

try it out

Live Ionize, two domains.

Real instances on ionize.io — sign in, walk through the full OAuth2 + PKCE handshake, then come back with an authorization code.

Customer login (CIAM)

Employee login (IAM)

Admin panels

Admin · Customer identity

Dashboard admin for the CIAM domain. Manage identities, sessions, OAuth2 clients, and lockouts.

Open admin

Admin · Employee identity

Dashboard admin for the IAM domain. Same surface, scoped to the employee identity store.

Open admin

Each login button redirects to Ory Hydra, which routes through Auth for authentication before returning here with an authorization code.

Capabilities

Everything Ory gives you,
packaged for humans.

Canvas, auth, and dashboard compose a working stack on top of Ory. Bring your own Postgres, deploy anywhere.

Kratos identity

Sign-up, sign-in, recovery, verification, MFA. Extensible schemas per identity type.

Hydra OAuth2

Authorization code, client credentials, refresh, PKCE. OIDC-compliant id_tokens.

Fine-grained scopes

Declare scopes per client. Consent is recorded and revocable from dashboard.

Brute-force protection

Per-identity and per-IP lockouts. Configurable thresholds. Full audit log.

JSON Schema profiles

Define employee, customer, or service identities. Traits are typed end-to-end.

Observable

OpenTelemetry spans on every admin and runtime call. Ship to any backend.

Dual-domain architecture

Separate identity domains for customers and employees — clean isolation, shared infrastructure.

CIAM

Customer identity

Auth

iOS

Android

Web

Dashboard

Web

Hydra

Kratos

IAM

Employee identity

Auth

iOS

Android

Web

Dashboard

Web

Hydra

Kratos

Shared

PostgreSQL

pgAdmin

OAuth2 flow: App → Hydra /oauth2/auth → Auth /login → Kratos auth → /consent → Hydra issues tokens → App receives code

Dashboard admin panels authenticate via IAM Auth (employee SSO)

SDK

Three lines to your first session.

app/auth.ts

ts

import { IonizeClient } from '@nannier/sdk';

const ionize = new IonizeClient({

  issuer: 'https://oauth.ciam.ionize.io',

  clientId: 'site-ciam-client',

  pkce: true,

});

await ionize.signIn();

const session = await ionize.getSession();

console.log(session.identity.traits.email);