Olympus is a free identity solution built on Ory Kratos and Hydra. Self-hosted, standards-compliant, no per-seat pricing.
octl auto-installs Podman, builds dev images for every Olympus repo, brings up infra → Ory → apps → seed in order, and hands you working URLs and a test login.
$ npm install -g @olympusoss/octl $ octl → checking Podman, podman-compose, kubectl… → starting Podman machine → building dev images (platform · hera · athena · site) → bringing up stack infra → migrations → Ory → apps → seed ✓ kratos healthy ✓ hydra healthy ✓ hera → http://localhost:3000 ✓ athena → http://localhost:3001 ✓ site → http://localhost:2000 test user → admin@olympus.local / olympus
Canvas, hera, and athena compose a working stack on top of Ory. Bring your own Postgres, deploy anywhere.
Sign-up, sign-in, recovery, verification, MFA. Extensible schemas per identity type.
Authorization code, client credentials, refresh, PKCE. OIDC-compliant id_tokens.
Declare scopes per client. Consent is recorded and revocable from athena.
Per-identity and per-IP lockouts. Configurable thresholds. Full audit log.
Define employee, customer, or service identities. Traits are typed end-to-end.
OpenTelemetry spans on every admin and runtime call. Ship to any backend.
Separate identity domains for customers and employees — clean isolation, shared infrastructure.
Customer identity
Employee identity
OAuth2 flow: App → Hydra /oauth2/auth → Hera /login → Kratos auth → /consent → Hydra issues tokens → App receives code
Athena admin panels authenticate via IAM Hera (employee SSO)
Real instances on nannier.com — sign in, walk through the full OAuth2 + PKCE handshake, then come back with an authorization code.
Sign in or register on the customer-facing identity domain. Built for end-users of apps you ship.
Sign in to the workforce identity domain. SSO, MFA, and provisioning for internal apps.
import { OlympusClient } from '@olympusoss/sdk';
const olympus = new OlympusClient({
issuer: 'https://auth.olympus.dev',
clientId: 'site-ciam-client',
pkce: true,
});
await olympus.signIn();
const session = await olympus.getSession();
console.log(session.identity.traits.email);