# ory/kratos architecture

> Architecture diagram of the GitHub repository ory/kratos, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-05). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ory/kratos
- Repository: https://github.com/ory/kratos

## Overview

Ory Kratos is an API-first identity and user-management server. Users interact with browser or native self-service flows for login, registration, recovery, verification, and account settings; the service manages identities and sessions and persists their state. The README also documents multi-factor authentication, identity schemas, and administrative lifecycle APIs. The graph combines these documented capabilities with dependencies visible in the sampled source and SOURCE INDEX; several implementation details, including route wiring and unsampled handlers, are not verified here.

Main entry points: [`identity/handler.go`](https://github.com/ory/kratos/blob/master/identity/handler.go) (Identity APIs), [`session/manager_http.go`](https://github.com/ory/kratos/blob/master/session/manager_http.go) (Session HTTP manager), [`selfservice/flow/registration/handler.go`](https://github.com/ory/kratos/blob/master/selfservice/flow/registration/handler.go) (Registration), [`selfservice/flow/settings/handler.go`](https://github.com/ory/kratos/blob/master/selfservice/flow/settings/handler.go) (Profile settings)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_flows["Self-service flows"]
  node_login["Login and MFA<br/>[handler.go]"]
  node_registration["Registration<br/>[handler.go]"]
  node_recovery["Recovery<br/>[handler.go]"]
  node_verification["Verification<br/>[handler.go]"]
  node_settings["Profile settings<br/>[handler.go]"]
end

subgraph group_identity["Identity and sessions"]
  node_identity_api["Identity APIs<br/>[handler.go]"]
  node_identity_manager["Identity management<br/>[manager.go]"]
  node_session_http["Session HTTP manager<br/>[manager_http.go]"]
  node_session_manager["Session management<br/>[manager.go]"]
end

subgraph group_platform["HTTP and schemas"]
  node_schema["Identity schemas<br/>[handler.go]"]
  node_error_manager["Flow error handling<br/>[manager.go]"]
end

subgraph group_persistence["Messaging and persistence"]
  node_courier["Message delivery<br/>[handler.go]"]
  node_identity_store[("Identity persistence")]
  node_session_store[("Session persistence")]
end

node_user(("User or client"))

node_user -->|"starts login"| node_login
node_user -->|"starts signup"| node_registration
node_user -->|"requests recovery"| node_recovery
node_user -->|"requests verification"| node_verification
node_user -->|"manages profile"| node_settings
node_user -->|"manages identity"| node_identity_api
node_login -->|"uses identity"| node_identity_api
node_login -->|"uses sessions"| node_session_http
node_registration -->|"uses identity"| node_identity_api
node_registration -->|"uses sessions"| node_session_http
node_registration -->|"forwards errors"| node_error_manager
node_recovery -->|"uses identity"| node_identity_api
node_recovery -->|"uses sessions"| node_session_http
node_settings -->|"uses identity"| node_identity_api
node_settings -->|"uses sessions"| node_session_http
node_settings -->|"uses login flow"| node_login
node_verification -->|"uses identity"| node_identity_api
node_identity_api -.->|"persists identities"| node_identity_store
node_session_http -->|"reads and writes"| node_session_store
node_session_manager -->|"uses identity"| node_identity_api
node_identity_manager -->|"builds messages"| node_courier
node_user -->|"retrieves schemas"| node_schema
node_user -->|"administers messages"| node_courier

click node_login "https://github.com/ory/kratos/blob/master/selfservice/flow/login/handler.go"
click node_registration "https://github.com/ory/kratos/blob/master/selfservice/flow/registration/handler.go"
click node_recovery "https://github.com/ory/kratos/blob/master/selfservice/flow/recovery/handler.go"
click node_verification "https://github.com/ory/kratos/blob/master/selfservice/flow/verification/handler.go"
click node_settings "https://github.com/ory/kratos/blob/master/selfservice/flow/settings/handler.go"
click node_identity_api "https://github.com/ory/kratos/blob/master/identity/handler.go"
click node_identity_manager "https://github.com/ory/kratos/blob/master/identity/manager.go"
click node_session_http "https://github.com/ory/kratos/blob/master/session/manager_http.go"
click node_session_manager "https://github.com/ory/kratos/blob/master/session/manager.go"
click node_schema "https://github.com/ory/kratos/blob/master/schema/handler.go"
click node_error_manager "https://github.com/ory/kratos/blob/master/selfservice/errorx/manager.go"
click node_courier "https://github.com/ory/kratos/blob/master/courier/handler.go"
click node_identity_store "https://github.com/ory/kratos/blob/master/persistence/sql/identity/persister_identity.go"
click node_session_store "https://github.com/ory/kratos/blob/master/persistence/sql/persister_session.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_login,node_registration,node_recovery,node_verification,node_settings,node_user toneBlue
class node_identity_api,node_identity_manager,node_session_http,node_session_manager toneAmber
class node_schema,node_error_manager toneMint
class node_courier,node_identity_store,node_session_store toneRose
```

## Components

### Self-service flows

- [Login and MFA](https://github.com/ory/kratos/blob/master/selfservice/flow/login/handler.go): `selfservice/flow/login/handler.go`
- [Registration](https://github.com/ory/kratos/blob/master/selfservice/flow/registration/handler.go): `selfservice/flow/registration/handler.go`
- [Recovery](https://github.com/ory/kratos/blob/master/selfservice/flow/recovery/handler.go): `selfservice/flow/recovery/handler.go`
- [Verification](https://github.com/ory/kratos/blob/master/selfservice/flow/verification/handler.go): `selfservice/flow/verification/handler.go`
- [Profile settings](https://github.com/ory/kratos/blob/master/selfservice/flow/settings/handler.go): `selfservice/flow/settings/handler.go`

### Identity and sessions

- [Identity APIs](https://github.com/ory/kratos/blob/master/identity/handler.go): `identity/handler.go`
- [Identity management](https://github.com/ory/kratos/blob/master/identity/manager.go): `identity/manager.go`
- [Session HTTP manager](https://github.com/ory/kratos/blob/master/session/manager_http.go): `session/manager_http.go`
- [Session management](https://github.com/ory/kratos/blob/master/session/manager.go): `session/manager.go`

### HTTP and schemas

- [Identity schemas](https://github.com/ory/kratos/blob/master/schema/handler.go): `schema/handler.go`
- [Flow error handling](https://github.com/ory/kratos/blob/master/selfservice/errorx/manager.go): `selfservice/errorx/manager.go`

### Messaging and persistence

- [Message delivery](https://github.com/ory/kratos/blob/master/courier/handler.go): `courier/handler.go`
- [Identity persistence](https://github.com/ory/kratos/blob/master/persistence/sql/identity/persister_identity.go): `persistence/sql/identity/persister_identity.go`
- [Session persistence](https://github.com/ory/kratos/blob/master/persistence/sql/persister_session.go): `persistence/sql/persister_session.go`

### Other components

- **User or client**

## Connections

- User or client → Login and MFA: starts login (evidence: `README.md`)
- User or client → Registration: starts signup (evidence: `README.md`)
- User or client → Recovery: requests recovery (evidence: `README.md`)
- User or client → Verification: requests verification (evidence: `README.md`)
- User or client → Profile settings: manages profile (evidence: `README.md`)
- User or client → Identity APIs: manages identity (evidence: `README.md`)
- Login and MFA → Identity APIs: uses identity (evidence: `selfservice/flow/login/handler.go`)
- Login and MFA → Session HTTP manager: uses sessions (evidence: `selfservice/flow/login/handler.go`)
- Registration → Identity APIs: uses identity (evidence: `selfservice/flow/registration/handler.go`)
- Registration → Session HTTP manager: uses sessions (evidence: `selfservice/flow/registration/handler.go`)
- Registration → Flow error handling: forwards errors (evidence: `selfservice/flow/registration/handler.go`)
- Recovery → Identity APIs: uses identity (evidence: `selfservice/flow/recovery/handler.go`)
- Recovery → Session HTTP manager: uses sessions (evidence: `selfservice/flow/recovery/handler.go`)
- Profile settings → Identity APIs: uses identity (evidence: `selfservice/flow/settings/handler.go`)
- Profile settings → Session HTTP manager: uses sessions (evidence: `selfservice/flow/settings/handler.go`)
- Profile settings → Login and MFA: uses login flow (evidence: `selfservice/flow/settings/handler.go`)
- Verification → Identity APIs: uses identity (evidence: `selfservice/flow/verification/handler.go`)
- Identity APIs → Identity persistence: persists identities
- Session HTTP manager → Session persistence: reads and writes (evidence: `session/manager_http.go`)
- Session management → Identity APIs: uses identity (evidence: `session/manager.go`)
- Identity management → Message delivery: builds messages (evidence: `identity/manager.go`)
- User or client → Identity schemas: retrieves schemas (evidence: `README.md`)
- User or client → Message delivery: administers messages (evidence: `courier/handler.go`)