How ory/kratos works
Ory Kratos is an API-first identity and user-management server. Users interact with browser or native self-service flows for login, registration, recovery, verification, and account settings; the service manages identities and sessions and persists their state. The README also documents multi-factor authentication, identity schemas, and administrative lifecycle APIs. The graph combines these documented capabilities with dependencies visible in the sampled source and SOURCE INDEX; several implementation details, including route wiring and unsampled handlers, are not verified here.
Main entry points: identity/handler.go Identity APIs · manager_http.go Session HTTP manager · registration/handler.go Registration · settings/handler.go Profile settings
Components 15
Self-service flows
- Login and MFA
selfservice/flow/login/handler.go - Registration
selfservice/flow/registration/handler.go - Recovery
selfservice/flow/recovery/handler.go - Verification
selfservice/flow/verification/handler.go - Profile settings
selfservice/flow/settings/handler.go
Identity and sessions
- Identity APIs
identity/handler.go - Identity management
identity/manager.go - Session HTTP manager
session/manager_http.go - Session management
session/manager.go
HTTP and schemas
- Identity schemas
schema/handler.go - Flow error handling
selfservice/errorx/manager.go
Messaging and persistence
- Message delivery
courier/handler.go - Identity persistence
persistence/sql/identity/persister_identity.go - Session persistence
persistence/sql/persister_session.go
Other components
- User or client
Connections 23
- User or client → Login and MFA: starts login
README.md - User or client → Registration: starts signup
README.md - User or client → Recovery: requests recovery
README.md - User or client → Verification: requests verification
README.md - User or client → Profile settings: manages profile
README.md - User or client → Identity APIs: manages identity
README.md - Login and MFA → Identity APIs: uses identity
selfservice/flow/login/handler.go - Login and MFA → Session HTTP manager: uses sessions
selfservice/flow/login/handler.go - Registration → Identity APIs: uses identity
selfservice/flow/registration/handler.go - Registration → Session HTTP manager: uses sessions
selfservice/flow/registration/handler.go - Registration → Flow error handling: forwards errors
selfservice/flow/registration/handler.go - Recovery → Identity APIs: uses identity
selfservice/flow/recovery/handler.go - Recovery → Session HTTP manager: uses sessions
selfservice/flow/recovery/handler.go - Profile settings → Identity APIs: uses identity
selfservice/flow/settings/handler.go - Profile settings → Session HTTP manager: uses sessions
selfservice/flow/settings/handler.go - Profile settings → Login and MFA: uses login flow
selfservice/flow/settings/handler.go - Verification → Identity APIs: uses identity
selfservice/flow/verification/handler.go - Identity APIs → Identity persistence: persists identities
- Session HTTP manager → Session persistence: reads and writes
session/manager_http.go - Session management → Identity APIs: uses identity
session/manager.go - Identity management → Message delivery: builds messages
identity/manager.go - User or client → Identity schemas: retrieves schemas
README.md - User or client → Message delivery: administers messages
courier/handler.go