This comparison focuses on Keycloak and Ory Hydra's OpenID Connect protocol support. Looking for (C)IAM features like MFA, SSO, user management, and compliance? Check out the (C)IAM Identity Providers benchmark.

Keycloak vs Ory Hydra

Compare Keycloak and Ory Hydra side by side across grant types, token endpoint authentication methods, extensions, endpoints, FAPI compliance, and protocol features.

Keycloak🇺🇸

Ory Hydra🇩🇪

Keycloak supports 40 of 44 tracked features, Ory Hydra supports 26.

Feature Comparison

Grant Types

Authorization Code
Refresh Token
Client Credentials
Implicit
Token Exchange
Client Initiated BackChannel Authentication
Device Authorization Grant
JWT Bearer Token
SAML 2.0 Bearer Assertion
Resource Owner Password Credentials

Extensions

PKCE
PAR
RAR
JAR

Endpoints

Authorization Endpoint
Token Endpoint
UserInfo Endpoint
Token Revocation
Token Introspection
Device Authorization Endpoint
OpenID Connect Discovery Endpoint
OAuth 2.0 Authorization Server Metadata Endpoint

Token Endpoint Authentication Methods

none
client_secret_basic
client_secret_post
client_secret_jwt
private_key_jwt
tls_client_auth

Prompts

none
login
consent
select_account
create

Features

RP-initiated Logout
Dynamic Client Registration Protocol
Dynamic Client Registration Management Protocol
Refresh Token Rotation
Refresh Token Rotation Grace Period
OAuth 2.0 Demonstrating Proof of Possession (DPoP)

Financial-grade API (FAPI)

FAPI 1.0 Security Profile - Part 1: Baseline
FAPI 1.0 Security Profile - Part 2: Advanced
FAPI 2.0 Security Profile
FAPI 2.0 Message Signing
JARM

Looking for a different comparison? See the full OpenID Connect Providers benchmark.

Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.