hydra

v25.4.0 brings first-class support for agentic authorization with the Device Authorization Grant (RFC 8628) and OAuth 2.1 discovery endpoint, making it easier for agents, IoT devices, and headless clients to obtain and manage access securely. Combined with new consent-chain revocation and migration fixes for CockroachDB v25+, Hydra v25.4 strengthens its role as the web and AI scale-ready OAuth 2.1 and OpenID Connect server for modern applications.

Ory has moved to a new versioning scheme. Read about our new version scheme. Interested in self-hosting Ory with support, SLAs, and advanced features? Check out our offerings.

Highlights

Agentic authentication use cases

This release makes Ory Hydra a stronger foundation for agentic authentication, where autonomous agents or constrained devices need to obtain and manage access without a full browser or direct human interaction. Two key updates enable this:

• Device authorization grant (RFC 8628): Essential for headless or limited-input clients (e.g., smart TVs, IoT devices, AI agents). It allows users to securely authorize agents through a secondary device, solving a common gap in agentic workflows.
• OAuth 2.1 discovery endpoint: Hydra now serves both OpenID Connect and OAuth 2.1 discovery documents, aligning with emerging standards. This simplifies integration for agents that expect OAuth 2.1 metadata and removes friction in federated or automated flows.

Together, these features address longstanding issues for agentic use cases by combining standards compliance with Hydra’s production-grade session and consent handling.

Device authorization grant (RFC 8628)

Adds full device flow support for devices without a browser or with limited input (smart TVs, consoles, agents).

Revoke token chains by consent challenge ID

New capability to revoke the entire token chain (refresh token and all derived access tokens) produced by a specific consent session.

OAuth 2.1 discovery endpoint

Hydra now serves /.well-known/oauth-authorization-server in addition to /.well-known/openid-configuration to aid OAuth 2.1 and certain integrations (per RFC 8414).

Improvements

• Lower latency when revoking linked Kratos sessions by making revocation asynchronous.
• Client updates with JWKS URI: PATCH/PUT no longer blocked when json_web_keys_uri is set (and json_web_keys present).
• JWT query performance: added an index for faster JWT-related lookups.
• CLI: clearer usage/help examples.

Fixes

• CockroachDB v25+ migrations: corrected/updated migration scripts; includes device-flow down/auto-commit fixes.
• Postgres UUIDs: use uuid_generate_v4() instead of MD5-based generation (enable the uuid-ossp extension if not already).
• Case-insensitive user_code scrubbing in device flow.
• Validation: tos_uri validation corrected.
• Docs: fixed JWT access token documentation link.

Security and dependencies

• go-jose v3.0.4 with a backport for CVE-2025-27144.
• Go toolchain upgrades (1.24.x) and crypto stack updates (e.g., ThalesGroup/crypto11, circl) addressing advisories.
• General dependency hygiene and CI hardening.

Upgrade notes

1. Run migrations before rolling out v2.4.0.
   • CockroachDB users on v25+: this release includes specific migration fixes; ensure your migration runner picks up the updated scripts.
   • Postgres users: ensure uuid-ossp is enabled (CREATE EXTENSION IF NOT EXISTS "uuid-ossp";) to support native UUIDs.
2. Device flow UI: add the two required screens/routes in your login/consent app to use RFC 8628.
3. Monitoring: if you scrape Prometheus on public endpoints, expect additional metrics.

Auto-generated release notes

Bug Fixes

• Add repo syn

We’re thrilled to announce the release of Ory Hydra 2.3.0! This version comes packed with graceful token refresh, performance improvements, and fixes that enhance stability, reduce database load, and streamline the developer experience. We strongly recommend upgrading to take advantage of these enhancements and ensure the best possible OAuth2 and OpenID Connect experience with Ory Hydra. Thank you to everyone who contributed!

Ory Hydra now supports graceful refresh token rotation, making OAuth2 and OpenID Connect refresh flows significantly more resilient in scenarios such as Single Page Apps and IoT. Even in highly distributed or concurrent environments, Hydra gracefully handles token refreshes reliably, ensuring tokens are not dropped or double-used.

PRs: #3860, #3895

Previously, the redirect_uri was not required when performing flows with scope=openid. This release enforces the requirement to comply with the OpenID Connect standard.

PR: #3900

Hydra now supports explicit SQL migration commands migrate sql up|down|status that streamline database schema management and help with zero-downtime upgrades.

PR: #3894

• Access token strategy & advanced CLI improvements The CLI introduces new parameters and an option to specify a custom client ID on creation, making it easier to manage and script Hydra deployments. PRs: #3718, #3725, #3874
• Built-in login & consent UI for hydra perform authorization-code A minimal built-in UI for login and consent can be enabled when testing with the CLI, removing the need to spin up a separate service. PR: #3845

Unused indices have been removed, down migration scripts renamed for consistency, and all migrations are more efficient overall.

PRs: #3859, #3911

• Improve persistence logic – Database transactions and concurrency have been improved across the authorization and token handlers. PRs: #3756, #3763, #3886

• Support for more claims in password grant – You can now include additional claims in the password grant flow, providing extra flexibility in advanced scenarios. Only available with an Ory Enterprise License. PR: #3864

• Transaction Wrappers Authorization and token issuance are now wrapped more consistently to prevent partial writes and race conditions. PRs: #3730, #3763

• Improved Docker setup Docker configurations have been refined, removing inconsistencies in the Compose setup and enabling a fully static binary build. PRs: #3826, #3924

• Proper JSON round-tripping Fixed an issue causing custom claims to break if they were nested or unexpectedly typed. JSON round-trips are now correct. PR: #3819

• Speed up public key retrieval Reduced overhead for the JWK public endpoint, solving CPU contention issues in large-scale deployments. PRs: #3787, #3870

• Fix Docker Compose references The CLI now properly references docker compose instead of docker-compose, ensuring compatibility with modern Docker setups. PR: #3815

• Dependency upgrades

Ory Hydra, the OAuth2 and OpenID Connect server designed for web-scale deployments introduces over 6x higher OAuth2 throughput on a single PostgreSQL instance!

Want to check out Ory Hydra yourself? Try common OAuth2 flows in the Ory OAuth2 Get Started guide!

This version significantly enhances performance, processing over 6x more authorization flows than version 2.1, thanks to architectural improvements that minimize database interactions for login and consent processes.

Key improvements include:

• Enhanced integration with Ory Kratos, ensuring seamless synchronization of login and logout states across both services. Users logged out from Ory Hydra will automatically log out from Ory Kratos, enhancing security and user experience.
• The ability to bypass the logout consent screen for specific clients, streamlining the logout process.
• Simplified migration with the new feature to import OAuth2 Client IDs, making the transition to Ory Hydra smoother.
• Support for the OIDC Verifiable Credentials specification, expanding the server's capabilities in identity verification.

Thank all contributors who have made this release available!

Bug Fixes

• Return empty slice if requested_scope or audience is null (#3711) (65165e7)

• Correct id token type in token exchange response (#3625) (d1f9ba8):

  Closes https://github.com/ory/client-go/issues/2

• Dropped persistence/sql test errors (#3670) (22f0119)

• Handle logout double-submit gracefully (#3675) (5133cf9)

• Handle subject mismatch gracefully (#3619) (af0d477):

  We now redirect to the original request URL if the subjects between the remembered Hydra session and what was confirmed by the login screen does not match.

• Handle token hook auth config (#3677) (1a40833):

  • fix: handle token hook auth config
  • fix: bump golangci-lint

• Improved SSRF protection (#3669) (24c3be5)

• Incorrect down migration (#3708) (8812e0e), closes /github.com/ory/hydra/pull/3705#discussion_r1471514014

• Remove required mark (#3693) (3a764a0)

• Timeout in jwt-bearer grants when too many grants are available (#3692) (a748797)

• Verifiable credentials JWT format (#3614) (0176adc)

• Add exceptions for internal IP addresses (#3608) (1f1121c)

• Add kid to verifiable crede

Introduces logout compatibility with Ory Kratos.

Bug Fixes

• Add exceptions for internal IP addresses (#3608) (1f1121c)
• Add kid to verifiable credential header (#3606) (9f1c8d1)
• Deflake ttl test (6741a49)
• Docker build (#3609) (01ff9da)
• Enable CORS with hot-reloaded origins (#3601) (6f592fc)
• Only query access tokens by hashed signature (a21e945)
• Racy random string generation (#3555) (1b26c4c)
• Reject invalid JWKS in client configuration / dependency cleanup and bump (#3603) (1d73d83)
• Restore ability to override auth and token urls for exemplary app (#3590) (dfb129a)
• Return proper error when the grant request cannot be parsed (#3558) (26f2d34)
• Use correct tracer in middleware (#3567) (807cbd2)

Code Generation

• Pin v2.2.0-rc.3 release commit (ad8a4ba)

Features

• Add hydra migrate status subcommand (#3579) (749eb8d)

• Add more resolution to events and collect client metrics (#3568) (466e66b)

• Add state override (b8b9154)

• Add support for OIDC VC (#3575) (219a7c0):

  This adds initial support for issuing verifiable credentials as specified in https://openid.net/specs/openid-connect-userinfo-vc-1_0.html.

  Because the spec is still in draft, public identifiers are suffixed with draft_00.

• Allow additional SQL migrations (#3587) (8900cbb)

• Allow Go migrations (#3602) (8eed306)

• Allow to disable claim mirroring (#3563) (c72a316):

  This PR introduces another config option called oauth2:mirror_top_level_claims which may be used to disable the mirroring of custom claims into the ext claim of the jwt. This new config option is an opt-in. If unused the behavior remains as-is to ensure backwards compatibility.

  Example:

  oauth2:
    allowed_top_level_claims:
      - test_claim
    mirror_top_level_claims: false # -> this will pr