# Ory Talos

> A scalable, security-hardened API key server for issuing, verifying, revoking, and deriving API keys and short-lived tokens for high-throughput systems.

Ory Talos is an open-source API key server built by Ory Corp, designed for low-latency verification, horizontal scaling, and predictable operations in high-throughput environments. Released under the Apache License 2.0, it is part of the broader Ory identity and access management ecosystem alongside Ory Kratos, Hydra, Keto, and Oathkeeper. The repository was created in June 2026 and reached its first release (v26.2.0) shortly after, signaling a newly launched component of the Ory platform.

## What It Is

Ory Talos is a dedicated server for the full lifecycle of API credentials: issuing, verifying, revoking, and deriving API keys and short-lived tokens. It is written in Go and follows Ory's cloud-native architecture philosophy — minimal dependencies, stateless horizontal scaling, and compatibility with container orchestration systems like Kubernetes. The core open-source edition runs as a single binary against an embedded SQLite database, making it accessible for prototyping and low-traffic workloads. For production use, it supports external databases including PostgreSQL, MySQL, and CockroachDB.

## How Token Derivation Works

A key architectural feature of Ory Talos is its token derivation model. Long-lived API keys can be used to mint reduced-scope, short-lived JWT and macaroon tokens that verify offline — without a database lookup on every request. This means agents, CI/CD jobs, and services can authenticate on the hot path without round-tripping to the server, reducing latency and load. The server separates admin and self-service surfaces so that key creation, revocation, derivation, and verification scale and are secured independently from proof-of-possession self-revocation.

## Deployment Model

Ory Talos supports two primary deployment paths:

- **Ory Network (managed SaaS):** The fastest path to production, with global edge API key issuance and verification, no infrastructure management, and integration with the rest of the Ory platform including OAuth2, OIDC, and fine-grained permissions.
- **Self-hosted:** Run Ory Talos on your own infrastructure for full control. The open-source edition is suitable for individuals, researchers, and low-traffic workloads. The **Ory Enterprise License (OEL)** layers on top for business-critical deployments, adding multi-node support, distributed caching, rate-limit enforcement, edge verification nodes, regular CVE patches with SLAs, and premium support.

The server runs as a single binary with three deployment modes: admin, self-service, or all-in-one, and fits modern cloud-native environments including Kubernetes and managed platforms.

## Security Architecture

Ory Talos handles credentials on the hot path and is built with security as a first-class concern. The implementation uses constant-time comparisons, centralized credential routing, and per-tenant network isolation. The GitHub README points to a dedicated security model document and security hardening guide covering cryptography, tenant isolation, and operational hardening. Vulnerability disclosure follows a responsible disclosure process documented in Ory's security.txt.

## Update: v26.2.0 Launch (June 2026)

Ory Talos was created on June 2, 2026, and its first release, v26.2.0, was published on June 4, 2026. The Ory about page notes that "Ory launches Ory Agent Security and Ory Talos, driving a new wave of Agent IAM innovation" as a 2026 milestone. The repository had 85 stars and 3 forks as of mid-June 2026, reflecting its very early public availability. The project is actively maintained, with the last push recorded on June 12, 2026. Ory positions Talos as part of its Agent IAM push, enabling verified agents to authenticate via API keys and derived tokens within the same identity infrastructure used by human users.

## Features
- Issue, verify, and revoke API keys at scale
- Derive short-lived JWT and macaroon tokens from long-lived keys
- Offline token verification without database lookup
- Import externally-issued API keys for unified verification
- Side-car deployment for fast API key verification
- Low-latency verification with caching and eventual revocation
- Structured logging, metrics, and tracing for predictable operations
- Three deployment modes: admin, self-service, or all-in-one
- Supports PostgreSQL, MySQL, CockroachDB, and SQLite
- Horizontal scaling with stateless architecture
- Constant-time comparisons and centralized credential routing
- Per-tenant network isolation
- Kubernetes and container orchestration compatible
- Available as managed SaaS (Ory Network) or self-hosted

## Integrations
Ory Kratos, Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Network, PostgreSQL, MySQL, CockroachDB, SQLite, Kubernetes, Docker, Ory CLI

## Platforms
WINDOWS, MACOS, LINUX, WEB, API, CLI

## Pricing
Open Source, Free tier available

## Version
v26.2.0

## Links
- Website: https://www.ory.com/talos
- Documentation: https://www.ory.com/docs/talos
- Repository: https://github.com/ory/talos
- EveryDev.ai: https://www.everydev.ai/tools/ory-talos