Configuration editor

Ory Kratos Configuration

Database related configuration

Miscellaneous settings used in database related tasks (cleanup, etc.)

Database cleanup settings

Settings that controls how the database cleanup process is configured (delays, batch size, etc.)

Number of records to clean in one iteration

Controls how many records should be purged from one table during database cleanup task

Delays between various database cleanup phases

Configures delays between each step of the cleanup process. It is useful to tune the process so it will be efficient and performant.

Delay between each table cleanups

Controls the delay time between cleaning each table in one cleanup iteration

Remove records older than

Controls how old records do we want to leave

Data Source Name*

DSN is used to specify the database credentials as a connection URI.

Courier configuration

The courier is responsible for sending and delivering messages over email, sms, and other means.

templates

recovery

invalid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

sms

body

plaintext

A template send to the SMS provider.

recovery_code

invalid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

sms

body

plaintext

A template send to the SMS provider.

verification

invalid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

sms

body

plaintext

A template send to the SMS provider.

verification_code

invalid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

sms

body

plaintext

A template send to the SMS provider.

registration_code

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

login_code

valid

email

body

plaintext

The fallback template for email clients that do not support html.

html

The default template used for sending out emails. The template can contain HTML

subject

sms

body

plaintext

A template send to the SMS provider.

Override message templates

You can override certain or all message templates by pointing this key to the path where the templates are located.

message_retries

Defines the maximum number of times the sending of a message is retried after it failed before it is marked as abandoned

worker

Configures the dispatch worker.

pull_count

Defines how many messages are pulled from the queue at once.

pull_wait

Defines how long the worker waits before pulling messages from the queue again.

Delivery Strategy

Defines how emails will be sent, either through SMTP (default) or HTTP.

HTTP Configuration

Configures outgoing emails using HTTP.

request_config

HTTP address of API endpoint

This URL will be used to send the emails to.

method

The HTTP method to use (GET, POST, etc). Defaults to POST.

headers

The HTTP headers that must be applied to request

body

URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads

Auth mechanisms

Define which auth mechanism to use for auth with the HTTP email provider

auth

type*

config

name*

The name of the api key

value*

The value of the api key

in*

How the api key should be transferred

SMTP Configuration

Configures outgoing emails using the SMTP protocol.

SMTP connection string

This URI will be used to connect to the SMTP server. Use the scheme smtps for implicit TLS sessions or smtp for explicit StartTLS/cleartext sessions. Please note that TLS is always enforced with certificate trust verification by default for security reasons on both schemes. With the smtp scheme you can use the query parameter (`?disable_starttls=true`) to allow cleartext sessions or (`?disable_starttls=false`) to enforce StartTLS (default behaviour). Additionally, use the query parameter to allow (`?skip_ssl_verify=true`) or disallow (`?skip_ssl_verify=false`) self-signed TLS certificates (default behaviour) on both implicit and explicit TLS sessions.

SMTP Client certificate path

Path of the client X.509 certificate, in case of certificate based client authentication to the SMTP server.

SMTP Client private key path

Path of the client certificate private key, in case of certificate based client authentication to the SMTP server

SMTP Sender Address

The recipient of an email will see this as the sender address.

SMTP Sender Name

The recipient of an email will see this as the sender name.

SMTP Headers

These headers will be passed in the SMTP conversation -- e.g. when using the AWS SES SMTP interface for cross-account sending.

SMTP HELO/EHLO name

Identifier used in the SMTP HELO/EHLO command. Some SMTP relays require a unique identifier.

SMS sender configuration

Configures outgoing sms messages using HTTP protocol with generic SMS provider

Determines if SMS functionality is enabled

enabled

SMS Sender Address

The recipient of a sms will see this as the sender address.

request_config

HTTP address of API endpoint*

This URL will be used to connect to the SMS provider.

method*

The HTTP method to use (GET, POST, etc).

headers

The HTTP headers that must be applied to request

body

URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads

Auth mechanisms

Define which auth mechanism to use for auth with the SMS provider

auth

type*

config

name*

The name of the api key

value*

The value of the api key

in*

How the api key should be transferred

channels

OAuth2 Provider Configuration

OAuth 2.0 Provider URL.

If set, the login and registration flows will handle the Ory OAuth 2.0 & OpenID `login_challenge` query parameter to serve as an OpenID Connect Provider. This URL should point to Ory Hydra when you are not running on the Ory Network and be left untouched otherwise.

HTTP Request Headers

These headers will be passed in HTTP request to the OAuth2 Provider.

Override the return_to query parameter with the OAuth2 provider request URL when perfoming an OAuth2 login flow.

Persist OAuth2 request between flows

Configure Preview Features

Default Read Consistency Level

The default consistency level to use when reading from the database. Defaults to `strong` to not break existing API contracts. Only set this to `eventual` if you can accept that other read APIs will suddenly return eventually consistent results. It is only effective in Ory Network.

serve

admin

request_log

Disable request logging for /health/alive and /health/ready endpoints

Disable health endpoints request logging

Admin Base URL

The URL where the admin endpoint is exposed at.

Admin Host

The host (interface) kratos' admin endpoint listens on.

Admin Port

The port kratos' admin endpoint listens on.

socket

Sets the permissions of the unix socket

owner

Owner of unix socket. If empty, the owner will be the user running Kratos.

group

Group of unix socket. If empty, the group will be the primary group of the user running Kratos.

mode

Mode of unix socket in numeric form

HTTPS

Configure HTTP over TLS (HTTPS). All options can also be set using environment variables by replacing dots (`.`) with underscores (`_`) and uppercasing the key. For example, `some.prefix.tls.key.path` becomes `export SOME_PREFIX_TLS_KEY_PATH`. If all keys are left undefined, TLS will be disabled.

Private Key (PEM)

Path to PEM-encoded Fle

Base64 Encoded Inline

The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.

TLS Certificate (PEM)

Path to PEM-encoded Fle

Base64 Encoded Inline

The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.

public

request_log

Disable request logging for /health/alive and /health/ready endpoints

Disable health endpoints request logging

cors

Configures Cross Origin Resource Sharing for public endpoints.

Sets whether CORS is enabled.

enabled

allowed_origins

A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.

allowed_origins-1*

allowed_origins-0*

allowed_methods

A list of HTTP methods the user agent is allowed to use with cross-domain requests.

allowed_methods-1*

allowed_methods-2*

allowed_methods-3*

allowed_methods-4*

allowed_methods-5*

allowed_headers

A list of non simple headers the client is allowed to use with cross-domain requests.

allowed_headers-1*

allowed_headers-2*

allowed_headers-3*

allowed_headers-4*

allowed_headers-5*

allowed_headers-6*

exposed_headers

Sets which headers are safe to expose to the API of a CORS API specification.

exposed_headers-1*

Sets whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates.

allow_credentials

TODO

options_passthrough

max_age

Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.

Adds additional log output to debug server side CORS issues.

debug

Base URL

The URL where the endpoint is exposed at. This domain is used to generate redirects, form URLs, and more.

Public Host

The host (interface) kratos' public endpoint listens on.

Public Port

The port kratos' public endpoint listens on.

socket

Sets the permissions of the unix socket

owner

Owner of unix socket. If empty, the owner will be the user running Kratos.

group

Group of unix socket. If empty, the group will be the primary group of the user running Kratos.

mode

Mode of unix socket in numeric form

HTTPS

Private Key (PEM)

Path to PEM-encoded Fle

Base64 Encoded Inline

The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.

TLS Certificate (PEM)

Path to PEM-encoded Fle

Base64 Encoded Inline

The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.

tracing

Configure distributed tracing using OpenTelemetry

provider

Set this to the tracing backend you wish to use. Supports Jaeger, Zipkin, and OTEL.

service_name

Specifies the service name to use on the tracer.

deployment_environment

Specifies the deployment environment to use on the tracer.

providers

jaeger

Configures the jaeger tracing backend.

local_agent_address

IPv6 Address and Port

Unsupported field schema for field root_tracing_providers_jaeger_local_agent_address: Unknown field type undefined.

{
  "title": "IPv6 Address and Port",
  "pattern": "^\\[(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))]:([0-9]*)$"
}

The address of the jaeger-agent where spans should be sent to.

sampling

server_url

The address of jaeger-agent's HTTP sampling server

trace_id_ratio

Trace Id ratio sample

zipkin

Configures the zipkin tracing backend.

server_url

The address of the Zipkin server where spans should be sent to.

sampling

sampling_ratio

Sampling ratio for spans.

otlp

Configures the OTLP tracing backend.

server_url

IPv6 Address and Port

Unsupported field schema for field root_tracing_providers_otlp_server_url: Unknown field type undefined.

{
  "title": "IPv6 Address and Port",
  "pattern": "^\\[(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))]:([0-9]*)$"
}

The endpoint of the OTLP exporter (HTTP) where spans should be sent to.

Will use HTTP if set to true; defaults to HTTPS.

insecure

sampling

sampling_ratio

Sampling ratio for spans.

authorization_header

Log

Configure logging using the following options. Logging will always be sent to stdout and stderr.

level

Debug enables stack traces on errors. Can also be set using environment variable LOG_LEVEL.

If set will leak sensitive values (e.g. emails) in the logs.

Leak Sensitive Log Values

Sensitive log value redaction text

Text to use, when redacting sensitive log value.

format

The log format can either be text or JSON.

identity

The default Identity Schema

This Identity Schema will be used as the default for self-service flows. Its ID needs to exist in the "schemas" list.

All JSON Schemas for Identity Traits

Note that identities that used the "default_schema_url" field in older kratos versions will be corrupted unless you specify their schema url with the id "default" in this list.

All JSON Schemas for Identity Traits-1

The schema's ID.*

JSON Schema URL for identity traits schema*

URL for JSON Schema which describes a identity's traits. Can be a file path, a https URL, or a base64 encoded string.

secrets

Default Encryption Signing Secrets

The first secret in the array is used for signing and encrypting things while all other keys are used to verify and decrypt older things that were signed with that old secret.

Signing Keys for Cookies

The first secret in the array is used for encrypting cookies while all other keys are used to decrypt older cookies that were signed with that old secret.

Secrets to use for encryption by cipher

The first secret in the array is used for encryption data while all other keys are used to decrypt older data that were signed with.

Secrets to use for encryption by cipher-1*

Hashing Algorithm Configuration

Password hashing algorithm

One of the values: argon2, bcrypt. Any other hashes will be migrated to the set algorithm once an identity authenticates using their password.

Configuration for the Argon2id hasher.

memory

iterations

parallelism

Number of parallel workers, defaults to 2*runtime.NumCPU().

salt_length

key_length

expected_duration

The time a hashing operation (~login latency) should take.

expected_deviation

The standard deviation expected for hashing operations. If this value is exceeded you will be warned in the logs to adjust the parameters.

dedicated_memory

The memory dedicated for Kratos. As password hashing is very resource intense, Kratos will monitor the memory consumption and warn about high values.

Configuration for the Bcrypt hasher. Minimum is 4 when --dev flag is used and 12 otherwise.

cost*

Cipher Algorithm Configuration

ciphering algorithm

One of the values: noop, aes, xchacha20-poly1305

HTTP Cookie Configuration

Configure the HTTP Cookies. Applies to both CSRF and session cookies.

HTTP Cookie Domain

Sets the cookie domain for session and CSRF cookies. Useful when dealing with subdomains. Use with care!

HTTP Cookie Path

Sets the session and CSRF cookie path. Use with care!

HTTP Cookie Same Site Configuration

Sets the session and CSRF cookie SameSite.

session

WhoAmI / ToSession Settings

Control how the `/sessions/whoami` endpoint is behaving.

Required Authenticator Assurance Level

Sets what Authenticator Assurance Level (used for 2FA) is required to access this feature. If set to `highest_available` then this endpoint requires the highest AAL the identity has set up. If set to `aal1` then the identity can access this feature without 2FA.

Tokenizer configuration

Configure the tokenizer, responsible for converting a session into a token format such as JWT.

Tokenizer templates

A list of different templates that govern how a session is converted to a token format.

Session Lifespan

Defines how long a session is active. Once that lifespan has been reached, the user needs to sign in again.

cookie

Session Cookie Domain

Sets the session cookie domain. Useful when dealing with subdomains. Use with care! Overrides `cookies.domain`.

Session Cookie Name

Sets the session cookie name. Use with care!

If set to true will persist the cookie in the end-user's browser using the `max-age` parameter which is set to the `session.lifespan` value. Persistent cookies are not deleted when the browser is closed (e.g. on reboot or alt+f4). This option affects the Ory OAuth2 and OpenID Provider's remember feature as well.

Make Session Cookie Persistent

Session Cookie Path

Sets the session cookie path. Use with care! Overrides `cookies.path`.

Session Cookie SameSite Configuration

Sets the session cookie SameSite. Overrides `cookies.same_site`.

Earliest Possible Session Extension

Sets when a session can be extended. Settings this value to `24h` will prevent the session from being extended before until 24 hours before it expires. This setting prevents excessive writes to the database. We highly recommend setting this value.

security

account_enumeration

Mitigate account enumeration by making it harder to figure out if an identifier (email, phone number) exists or not. Enabling this setting degrades user experience. This setting does not mitigate all possible attack vectors yet.

mitigate

The kratos version this config is written for.

SemVer according to https://semver.org/ prefixed with `v` as in our releases.

dev

help

This is a CLI flag and environment variable and can not be set using the config file.

sqa-opt-out

This is a CLI flag and environment variable and can not be set using the config file.

watch-courier

Metrics port

The port the courier's metrics endpoint listens on (0/disabled by default). This is a CLI flag and environment variable and can not be set using the config file.

config

This is a CLI flag and environment variable and can not be set using the config file.

Global outgoing network settings

Configure how outgoing network calls behave.

Global HTTP client configuration

Configure how outgoing HTTP calls behave.

Disallow all outgoing HTTP calls to private IP ranges. This feature can help protect against SSRF attacks.

Disallow private IP ranges

Add exempt URLs to private IP ranges

Allows the given URLs to be called despite them being in the private IP range. URLs need to have an exact and case-sensitive match to be excempt.

Feature flags

If enabled allows Ory Sessions to be cached. Only effective in the Ory Network.

Enable Ory Sessions caching

Set Ory Session Edge Caching maximum age

Set how long Ory Sessions are cached on the edge. If unset, the session expiry will be used. Only effective in the Ory Network.

If enabled allows new flow transitions using `continue_with` items.

Enable new flow transitions using `continue_with` items

If enabled allows faster session extension by skipping the session lookup. Disabling this feature will be deprecated in the future.

Enable faster session extension

Unsupported field schema for field root_organizations: Missing items definition.

{
  "title": "Organizations",
  "description": "Please use selfservice.methods.b2b instead. This key will be removed. Only effective in the Ory Network.",
  "type": "array",
  "default": []
}

Enterprise features

Specifies enterprise features. Only effective in the Ory Network or with a valid license.

Fallback URL template for identity schemas

A fallback URL template used when looking up identity schemas.

Ory Kratos Configuration

selfservice

Allowed Return To URLs

flows

settings

after

password

hooks

totp

hooks

oidc

hooks

webauthn

hooks

passkey

hooks

lookup_secret

hooks

profile

hooks

hooks

before

hooks

logout

after

registration

before

hooks

after

password

hooks

webauthn

hooks

passkey

hooks

oidc

hooks

code

hooks

hooks

login

before

hooks

after

password

hooks

webauthn

hooks

passkey

hooks

oidc

hooks

code

hooks

totp

hooks

lookup_secret

hooks

hooks

Email and Phone Verification and Account Activation Configuration

after

hooks

before

hooks

Account Recovery Configuration

after

hooks

before

hooks

error

methods

Single Sign-On for B2B

config

organizations

profile

link

Link Configuration

code

Code Configuration

code