# Udibo vs Ory Ory is a set of open-source servers you can run yourself, Kratos for identities, Hydra for OAuth 2.0 and OpenID Connect, Keto for permissions, and Oathkeeper as an access proxy, plus Ory Network, the managed version of the same engines billed on average daily active users. Udibo gives you hosted sign-in behind a standard OAuth 2.0 boundary, with organizations, roles, and per-resource permissions included on every plan. The difference that decides most evaluations: Ory hands you the building blocks, free to run yourself or from $70 a month hosted, and Udibo hands you one product with a free plan that can serve production traffic. **Checked September 8, 2026** against [Ory's pricing page](https://www.ory.com/pricing) and Ory's documentation. Udibo's prices are on its [pricing page](https://www.udibo.com/pricing). **Additional details reviewed October 2, 2026:** Udibo usage assumptions and API access, plus Ory Network's annual Production and Growth prices, monthly usage credits, and average-daily-active-user rates. Other vendor claims use the September 8 review. ## The short version | If you need | Start with | | -------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | Open-source identity, OAuth 2.0, and permission servers you run yourself | Ory (Kratos, Hydra, Keto) | | A free plan that can serve production traffic | Udibo; Ory's Developer plan has no production environment | | Organizations, custom roles, and a hosted permission check without a $9,350 plan | Udibo | | SAML or SCIM at launch | Ory: SAML and SCIM on Enterprise | | Sign-in rendered inside your own UI, or data kept in a region you choose | Ory | | A $5 entry billed monthly, instead of $70 a month | Udibo | ## Why teams pick Udibo over Ory - **One product instead of four projects.** Ory's open-source stack is Kratos for identities, Hydra for OAuth 2.0 and OpenID Connect, Keto for permissions, and Oathkeeper for the proxy, each its own deployment and configuration; Hydra holds no users and redirects to a login and consent endpoint that is "an application written by you" ([Hydra login flow](https://www.ory.com/docs/hydra/concepts/login)). Udibo's hosted service does sign-in, organizations, roles, and permission checks behind one issuer. - **A free plan that can ship.** Ory Network's Developer plan is free with 2 development environments, 0 production environments, and 1 member; the first plan with a production environment is $70 a month. Udibo's Free plan carries 500 retained users, 25,000 hosted permission checks, and 1,000 emails, with no card. - **Organizations without a $9,350 plan.** Ory Network's B2B Organizations start on Growth at $9,350 a year, billed annually, with a maximum of 3 organizations; unlimited organizations are Enterprise, by quote. Udibo places no cap on organizations or members on any plan, and a person can hold a different role in each. - **Roles you define, checked by a hosted API.** Register the permissions your application interprets, attach them to roles across a tenant, inside an organization, or on one resource, and read the result from the token or ask `POST /api/check`. Ory Permissions answers whether "a given subject has a specified relationship with an object" over a relationship model you design and populate; it is flexible, and the model is yours to build. - **Growth costs less above the allowance.** Udibo's rate is $3 per 1,000 retained users, $10 per 1,000,000 hosted permission checks, and nothing per machine-to-machine token. Ory Network Production charges $0.14 per average daily active user per month after a $21 monthly credit, $0.000090 per permission check ($90 per million), and $0.007 per machine-to-machine token. - **Monthly billing at the entry.** Udibo's Standard plan is $5 a month plus usage with no annual commitment. Ory's Production plan bills monthly at $70 or annually at $770; Growth is annual only. - **A record you can take with you.** At least 90 days of audit history on every plan, exportable as CSV or NDJSON. Ory Network's pricing page publishes analytics history by plan, 24 hours on Developer, 7 days on Production, 30 days on Growth, 90 days on Enterprise, and does not publish audit-log retention. ## Why Ory may still be the right choice - **You want to run it yourself, today, at no license cost.** Kratos, Hydra, Keto, and Oathkeeper are Apache 2.0 with no per-user price. Udibo Identity is a hosted service with no self-hosted edition. Its open-source part, and the option you run yourself, is the MIT-licensed `@udibo/oauth2` package: like Hydra, an OAuth 2.0 and OpenID Connect server you host that leaves the user directory to you, with clients, a resource server, Hono middleware, React bindings, and optional login flows over your own database. It is a pre-1.0 API. - **SAML and SCIM.** One-click SAML SSO, SCIM, and directory sync are Enterprise. Udibo does not offer SAML or SCIM today. Both list passkeys on every plan. - **Your UI and your data placement.** Ory's bring-your-own-UI runs on every plan, and Production and above choose a PII storage region. Udibo hosts the sign-in pages under your name, logo, and colors; the account screens inside your product are yours to build. - **Deep permission graphs.** If your access model is a graph of relationships, folders inside folders or groups inside groups, Ory Permissions is built to answer that shape. Udibo's assignments are roles held across a tenant, inside an organization, or on one resource of a type you register, and organizations are flat. - **A published SLA on Enterprise.** Ory Network lists a 99.99% uptime SLA on Enterprise. Udibo publishes no SLA. ## Pricing side by side Ory's annual prices, usage credits, and average-daily-active-user rates were rechecked October 2, 2026, as were Udibo's pricing assumptions. Other vendor figures and features retain the September 8 check. The units differ. Udibo prices retained users: "A person who returns more than 24 hours after creating their account counts once in that UTC calendar month." Ory Network bills average daily active users, "the average number of unique users who use the Ory Identities APIs on a daily basis", after a monthly credit. Self-hosted Ory has no per-user price. | You need | Udibo | Ory Network | | -------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Free plan | 500 retained users, 25,000 hosted permission checks, 1,000 emails | Developer: 2 development environments, 0 production environments, 1 member | | First paid plan | $5 a month plus usage: 5,000 users, 250,000 checks, 10,000 emails included | Production, $70 a month or $770 a year, with a $21 monthly usage credit; 1 production environment; community support | | Multi-factor authentication | Included on Free, with passkeys and hardware keys | Included on every plan, with passkeys and hardware keys | | Custom roles and permissions | Included on Free, across a tenant, an organization, or one resource | Fine-grained permission API on every plan, metered per check; roles are relationships you model | | Organizations and members | No cap | B2B Organizations on Growth ($9,350 a year), maximum 3; unlimited on Enterprise | | Remove vendor branding | Included on Free | Themeable self-service pages on every plan; not listed as a plan lever | | Custom session lifetime | Included on Free | Included on every plan | | Enterprise SSO connections | No per-connection fee for OpenID Connect providers; SAML not yet available | Social connections unlimited and custom social connections included on every plan; B2B SSO (OIDC only) on Growth; SAML SSO and SCIM on Enterprise | | Audit or application log history | At least 90 days on every plan | Analytics history 24 hours on Developer, 7 days on Production, 30 days on Growth, 90 days on Enterprise; audit-log retention not published | | Sign-in email | 1,000 on Free and 10,000 on Standard, then $1 per 1,000; your own sender is counted but not billed | Custom email templates and your own email gateway on every plan; no email meter published | | Users beyond the allowance | $3 per 1,000 retained users | $0.14 per average daily active user per month on Production, $0.12 on Growth, after a $21 or $255 monthly credit | | Hosted permission checks | $10 per 1,000,000 past the allowance | $0.000090 per check on Production ($90 per million), $0.000085 on Growth | | Machine-to-machine tokens | No per-token charge; technical and abuse limits apply | $0.007 per token on Production, $0.006 on Growth, for tokens issued through the client credentials flow | Three worked examples, with the same assumptions on both sides. Ory Network figures use the Production plan billed monthly and assume 1 in 10 users is active on a given day, above the "~7.6%" DAU-to-MAU ratio Ory reports for its customers ([Ory, March 2024](https://www.ory.com/blog/ory-price-2024-dau-mau)); the range runs from one sign-in a month per user to daily use. | Scenario | Udibo | Ory | | ------------------------------------------------------------------------------------ | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Consumer app: 10,000 retained users, 5,000 sign-in emails, MFA on, your own branding | $20 (Standard base plus 5,000 users above allowance) | $189 on Ory Network Production ($96 at one sign-in a month each, $1,449 at daily use); self-hosted Kratos is $0 in software plus hosting and operations | | B2B app: 200 users, 5 organizations of 30 members, custom roles, MFA | $0 on Free, or $5 on Standard | $70 on Production with organizations and roles modeled by you in Ory Permissions; Ory's own B2B Organizations need Growth ($9,350 a year) and stop at 3, so 5 is Enterprise, by quote; self-hosted Kratos and Keto, $0 in software | | Consumer app at 100,000 retained users | About $290 | About $1,449 on Production (about $14,050 at daily use); Enterprise volume pricing by quote | Sources: [Ory pricing](https://www.ory.com/pricing), Ory's [aDAU announcement](https://www.ory.com/blog/ory-price-2024-dau-mau), and Udibo's [pricing page](https://www.udibo.com/pricing). Both change; check the vendor's current page before you decide. ## Cost at scale Users only. Udibo's figures are its published rates. Ory Network's are its Production plan billed monthly, computed from the published $70 base, $21 credit, and $0.14 per average daily active user at two activity levels; self-hosted Ory has no per-user figure to compute. | Retained users | Udibo | Ory Network, 1 in 10 active daily | Ory Network, every user active daily | | -------------- | ------------- | --------------------------------- | ------------------------------------ | | 1,000 | $5 (Standard) | $70 | $189 | | 10,000 | $20 | $189 | $1,449 | | 100,000 | About $290 | About $1,449 | About $14,050 | | 1,000,000 | About $2,990 | About $14,050 | About $140,050 | There is no crossover in Ory Network's favor on this table: even at one sign-in a month per user, the least a retained user can do, $0.14 per average daily active user works out to about $0.0047 per user-month against Udibo's $0.003. Growth's $0.12 rate does not beat Production until roughly 24,000 average daily active users, because its base is about $709 a month higher, and Enterprise volume pricing is by quote. The comparison changes when you self-host: Kratos, Hydra, and Keto cost $0 in software at any user count, and what you pay instead is a database and compute, an upgrade on each release, an administration surface (self-hosted Kratos is "completely headless", managed "through the API and CLI"; the Console is part of Ory Network), and the engineer's hours, plus an Ory Enterprise License, by quote, if you want supported builds. Price those hours before deciding. ## What the integration looks like With Udibo, register an application and its callback, send people to the hosted sign-in page, and finish the authorization-code flow on your server. Your backend holds the session and the browser gets a cookie, never a token. The [first-login guide](https://www.udibo.com/docs/identity/get-started) walks each checkpoint, and the [organizations](https://www.udibo.com/docs/identity/organizations) and [permissions](https://www.udibo.com/docs/identity/permissions) guides cover a person with a different role in each of two organizations. With Ory Network, create a project, then drive Kratos's self-service flows from the hosted Account Experience or your own UI, register OAuth 2.0 clients with Hydra, and write relationships and checks against Ory Permissions; the Console and the `ory` CLI manage the project. Self-hosted, each server is its own deployment and configuration, and Hydra redirects to a login and consent app you write, or to Kratos ([Hydra login flow](https://www.ory.com/docs/hydra/concepts/login)). Beside Hydra, `@udibo/oauth2` is the direct comparison: both are OAuth 2.0 and OpenID Connect servers you run, and both leave the user store to you; Hydra delegates the login screen to an app you write, and `@udibo/oauth2` ships optional login flows over your own database. Neither approach removes your responsibility to protect application data on the server. A valid session says who someone is; your backend still decides what they may read. ## Where Udibo needs a closer look Udibo does not currently offer SAML, SCIM, or custom domains for its hosted pages, and Udibo Identity has no self-hosted edition. Sign-in happens on Udibo-hosted pages rather than inside your own UI. A relationship graph in Ory Permissions does not copy across as roles; model a representative access decision in Udibo's three widths before assuming parity, and note that organizations are flat. User import is run by Udibo today: you prepare the file and Udibo runs it, with no endpoint and no dashboard screen. Customers administer tenants through the dashboard today; there is no self-serve management API credential for a script or backend. See the [API guide](https://www.udibo.com/docs/identity/apis#the-management-api). If your product needs a particular account-management screen, test that whole journey before committing; a successful login alone does not establish parity. ## Moving an existing Ory application List the components you actually use: an OAuth 2.0 issuer, identity records, login UI, permission relationships, and a policy proxy each move differently. Trace one request from sign-in to protected data, record every service that establishes identity or decides access, and preserve the same denial behavior in the replacement. Identities export from Kratos with their hashed credentials ([export guide](https://www.ory.com/docs/kratos/manage-identities/export-user-accounts-identities)). Kratos hashes with bcrypt at cost 12 by default ([config schema](https://github.com/ory/kratos/blob/master/embedx/config.schema.json)), which Udibo's importer accepts and upgrades on first sign-in; argon2, Kratos's other option, is not accepted and needs a reset path. Social identities link by the provider's stable subject. Keto relationships translate to roles on a tenant, an organization, or one resource; write the mapping explicitly rather than flattening a graph into a broad role. Hydra clients become Udibo applications with new credentials, so the issuer change is a client-side change. MFA enrollment and sessions do not move. See [migration planning](https://www.udibo.com/docs/identity/migrate) and [user import](https://www.udibo.com/docs/identity/user-import). **Try next:** complete [one Udibo login](https://www.udibo.com/docs/identity/get-started), then give a person two organizations and a different role in each. Before you have an account, the [agent integration brief](https://www.udibo.com/docs/identity/agents) lets your coding assistant prepare the integration. ## Frequently asked questions **Is Udibo cheaper than Ory?** Against self-hosted Ory, not at the license line: Kratos, Hydra, and Keto are free, and the honest comparison is Udibo's bill against your hosting and the engineer who runs and upgrades several services. Against Ory Network, the first plan that can serve production is $70 a month and organizations start at $9,350 a year; Udibo's Free plan serves production traffic, Standard is $5 a month plus usage, and at its published rates the per-user cost stays lower at every size in the table above. **Can I self-host Udibo like Ory?** No. Udibo Identity is a hosted service with no self-hosted edition. Its open-source part, and the piece you run yourself, is the MIT-licensed `@udibo/oauth2` package: an OAuth 2.0 and OpenID Connect server and client toolkit for an application you operate, comparable in role to Hydra and not to Kratos or the Ory Console. **Can I move from Ory to Udibo?** Profiles and social identities can be imported and linked by the provider's stable subject, and bcrypt password hashes exported from Kratos are accepted and upgraded on first sign-in; argon2 hashes are not. Keto relationships need an explicit mapping onto roles on a tenant, an organization, or one resource. MFA enrollments and sessions do not move. See [migration planning](https://www.udibo.com/docs/identity/migrate). **Does Udibo have a permission service like Ory Permissions?** Yes, with a different shape. Udibo's hosted check answers whether a subject holds a permission across a tenant, inside an organization, or on one resource of a type you register, at $10 per million past the allowance; Ory Permissions answers whether a subject has a relationship with an object over a graph you model, at $90 per million on Production. If your model is roles, Udibo's shape fits; if it is a graph, Ory's does. _Last verified 2026-10-02._