Softwr

Cybersecurity · head to head

Ory Kratos vs Pulumi

Ory Kratos logo

Ory Kratos

Cybersecurity

Headless identity and user management API

From
Free
Rated
-
Full reviewWebsite
Pulumi logo

Pulumi

Cloud

Modern infrastructure as code using programming languages

From
Free
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: Ory Kratos headless means you build every screen, which is significant work compared with a hosted login page; Pulumi the free Individual plan allows one user and one concurrent stack update
  • They diverge on capability: Ory Kratos covers Headless API, Pulumi covers Multi-language support.
  • Prices and features above were last checked on 30 August 2026.

Where they differ

Only the attributes on which Ory Kratos and Pulumi actually diverge.

Attributes where Ory Kratos and Pulumi differ
AttributeOry KratosPulumi
Pricing modelOpen-source self-hosted, with a paid managed networksubscription
PlatformsLinux, Docker, Kubernetes, Self-hostedLinux, Windows, Mac, Api
CategoryCybersecurityCloud
FoundedUnknown2017

Identical on both: starting price (Free), free tier (Yes), user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Ory Kratos

  • Headless API
  • Self-service flows
  • Multi-factor authentication
  • Pluggable identity schemas

Only in Pulumi

  • Multi-language support
  • Multi-cloud
  • State management
  • Secrets management
  • RBAC
  • Stacks
  • Automation API
  • Policy as Code

What people use each for

The jobs each tool is most often brought in to do.

Ory Kratos

  • Products needing complete control over the look and flow of authenticationnot Pulumi
  • Applications that must not hand user identity data to a third partynot Pulumi
  • Teams building identity as infrastructure across several servicesnot Pulumi

Pulumi

  • Infrastructure as codenot Ory Kratos
  • Cloud resource provisioningnot Ory Kratos
  • DevOps automationnot Ory Kratos
  • Multi-cloud managementnot Ory Kratos

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Ory Kratos

  • Headless means you build every screen, which is significant work compared with a hosted login page
  • More moving parts than a monolithic IAM: Kratos handles identity, and OAuth2 needs Ory Hydra alongside
  • Documentation assumes real familiarity with identity concepts and is not a gentle introduction
  • Self-hosting identity carries the security and availability burden that hosted providers absorb

Pulumi

  • The free Individual plan allows one user and one concurrent stack update
  • The Team plan is $40 per month base including 40 credits, and caps the organisation at 10 users
  • SAML/SSO, RBAC, audit logs and drift detection require the Enterprise plan at $400 per month base
  • The per-resource rate rises from $0.1825 per resource per month on Team to $0.365 on Enterprise, so upgrading raises the unit price as well as the base fee
  • Managed secrets are billed separately at $0.50 per secret per month on Team and $0.75 on Enterprise
  • Self-hosting, SCIM user sync, audit log export and 24x7 support are only in Business Critical, which is custom priced with no published rate
  • Team includes up to 500 resources and Enterprise up to 2,000, with everything beyond billed on demand as credits

Pricing, plan by plan

Ory Kratos

Free
  • Self-hostedFree
    • Full identity server
    • All flows
    • Community support

Pulumi

Free
  • IndividualFree
    • 1 user
    • Unlimited projects/stacks
    • 500 workflow minutes monthly
  • Team$40/month
    • Up to 10 users
    • Secure collaboration
    • CI/CD integration
  • Enterprise$400/month
    • Unlimited users
    • SAML/SSO
    • RBAC
  • Business Critical$null/custom
    • Self-hosting
    • Advanced compliance
    • SCIM integration

Which should you pick?

Choose Ory Kratos if

  • You need headless api.
  • You want to start without paying.
  • You work on Linux, Docker, Kubernetes, Self-hosted.
  • You also want self-service flows.
Ory Kratos review

Choose Pulumi if

  • You need multi-language support.
  • You want to start without paying.
  • You work on Linux, Windows, Mac, Api.
  • You also want multi-cloud.
Pulumi review

Questions people ask

Is Ory Kratos or Pulumi better?
Neither clearly leads. Ory Kratos starts at Free and Pulumi at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Ory Kratos or Pulumi?
Ory Kratos starts at Free and Pulumi at Free.
Does Ory Kratos or Pulumi run on more platforms?
Ory Kratos runs on Linux, Docker, Kubernetes, Self-hosted. Pulumi runs on Linux, Windows, Mac, Api.
Can I use Ory Kratos for free?
Both have a free tier, so you can try either at no cost before committing.
What is Ory Kratos best used for?
Ory Kratos is most often used for products needing complete control over the look and flow of authentication, applications that must not hand user identity data to a third party, teams building identity as infrastructure across several services. Of those, products needing complete control over the look and flow of authentication and applications that must not hand user identity data to a third party are not what Pulumi is typically brought in for.
What can Ory Kratos do that Pulumi cannot?
Ory Kratos covers Headless API, Self-service flows, Multi-factor authentication, Pluggable identity schemas. Pulumi covers Multi-language support, Multi-cloud, State management, Secrets management.

Answered from the vendors’ own pages

Ory Kratos: Is Ory Kratos free?

Yes, open source and free to self-host. Ory Network is a paid managed service.

Pulumi: How much does Pulumi cost?

Pulumi offers a free Individual tier forever, Team plan at $40/month with 40 credits, and Enterprise at $400/month with 400 credits. Credit usage varies by resource type and workflow needs.

Source
Ory Kratos: What does headless mean here?

Kratos provides identity flows as APIs and no user interface. You build the login, registration and recovery screens yourself.

Pulumi: What is included in the Pulumi free tier?

The free Individual tier includes 1 user, unlimited projects/stacks, 500 workflow minutes monthly, and 5 million Neo tokens free.

Source
Ory Kratos: Does Kratos do OAuth2?

No. Kratos handles user identity; OAuth2 and OpenID Connect provider functionality is Ory Hydra, a separate component.

Pulumi: How are Pulumi credits charged?

1 Pulumi Credit equals $1 USD. Credits are drawn from a shared pool. IaC resources cost $0.1825/month per resource on Team and $0.365 on Enterprise; ESC secrets cost $0.50-$0.75/month; workflow minutes cost $0.01 each.

Source
Pulumi: Does Pulumi offer volume discounts?

Yes, the Enterprise tier ($400/month) includes volume discounts and is designed for approximately 2,000 IaC resources.

Source
Share

Related pages

More on Ory Kratos

More on Pulumi

Keep looking

Other head to heads