Ory Agent DX: Identity Management for AI Coding Agents

Ory Agent DX is a free plugin toolset that integrates Ory's enterprise identity platform directly into AI coding environments including Claude Code, OpenAI Codex, Gemini CLI, OpenClaw, and OpenCode. It enables developers to scaffold, test, and manage authentication and authorization workflows without leaving their development environment. Key capabilities include single-command plugin installation with no account creation required, AI-assisted scaffolding of login, registration, recovery, verification, social login, and authorization workflows through natural-language prompts, local execution of a complete Ory environment for testing against production-equivalent authentication surfaces, and API-based management of identities, OAuth2 clients, permissions, and configurations from within the coding agent. Ory manages over 2.5 billion identities globally, powers 10% of the top 40 websites, has 45,000+ GitHub stars across its projects, and has logged 700 million total downloads. The Agent DX launch on June 10, 2026 makes this infrastructure available directly inside the coding agent workflow.

BUSINESS PROBLEM

According to Ory's June 2026 launch announcement, AI coding agents are accelerating software development dramatically, but every AI-generated application still requires authentication, authorization, permissions, and governance before it can be deployed. A startup CTO using Claude Code to build an MVP discovers after the agent has written 80% of the application that there is no authentication layer. Retrofitting auth takes 40-80 hours of developer time — weeks of work that could have been built in from the start. At $75/hour, that is $3,000-6,000 in auth retrofit costs per project. The industry pattern is well-documented: security retrofitting costs 10x more than building it in from the start. Ory's research found that 67% of AI-generated applications in their survey lacked any authentication at MVP stage, and engineering teams spent an average of 3.2 weeks adding auth after the fact. Ory Agent DX solves this by making identity a first-class citizen in the AI coding workflow — the agent scaffolds auth alongside business logic.

WHO BENEFITS

For a startup CTO building an MVP with Claude Code. Situation: Coding agent produces functional application code at high speed but generates zero auth infrastructure. Payoff: Ory plugin scaffolds login, registration, and social auth from natural language prompts. The agent builds auth alongside business logic. No post-hoc retrofit needed. For a platform engineer standardizing identity across multiple AI-generated services. Situation: Five teams using coding agents are producing services with inconsistent auth approaches. Payoff: Ory Agent DX provides a standardized identity layer enforced at the agent level. Every service gets the same Ory Keto permissions and Ory Hydra OAuth2 configuration. For a DevOps engineer needing test auth environments. Situation: Testing auth flows requires spinning up dev, staging, and production environments. Each takes 30 minutes to configure. Payoff: The local Ory environment command starts a complete production-equivalent auth stack in under 10 seconds. Test against real OAuth2, OpenID Connect, and login flows locally.

HOW IT WORKS

Step 1. Install the plugin (1 min). Claude Code: /plugin marketplace add ory/claude-plugins then /plugin install ory-agent-plugin@ory. Codex: npm install @ory/codex. Gemini CLI: npm install @ory/gemini-cli. Step 2. Start local Ory (1 min). Run ory start from within the coding agent. A complete local Ory environment (Kratos identity, Hydra OAuth2, Keto permissions) starts in under 10 seconds. No account or API key needed. Step 3. Scaffold auth with natural language (prompt). Tell the agent: Create a login flow with email/password and Google SSO. The agent uses Ory Agent DX to generate the complete auth configuration files. Step 4. Test the flow (2 min). Run ory test login from the agent CLI. The local Ory environment executes the auth flow end-to-end. See the login page, registration, and callback handling locally. Step 5. Manage identities and permissions (ongoing). Use natural language to add roles, update permissions, or create OAuth2 clients. The agent executes these via the Ory APIs. Step 6. Connect to production (when ready). Point the plugin at your Ory Network project or self-hosted Ory instance. The local development configuration is fully compatible with production.

TOOL INTEGRATION

TOOL: Ory Agent DX (Free, Ory 45K+ GitHub stars). Role: Plugin toolset integrating Ory identity platform into AI coding agents. API access: ory.com/agent-plugins. Auth: None for local (Ory API key for production). Cost: Free for local development. Production Ory Network pricing applies for hosted identity. Gotcha: The local Ory environment (ory start) runs Docker containers behind the scenes. Docker Desktop is required on macOS and Windows. The initial ory start downloads container images (~500MB) on first run. TOOL: Ory Kratos (Go, Apache 2.0). Role: Identity and user management service handling login, registration, profiles, and social login. API access: Included in Ory Agent DX. Auth: Ory API key. Cost: Free (self-hosted) or managed tier. Gotcha: Kratos identity schemas are extensible but have a specific JSON Schema format. The AI agent generates standard schemas well but complex custom schemas may need manual adjustment. TOOL: Ory Hydra + Ory Keto (Go, Apache 2.0). Role: OAuth2/OpenID Connect server (Hydra) and permission/relationship service (Keto). API access: Included in Ory Agent DX. Auth: Client credentials. Cost: Free (self-hosted) or managed tier. Gotcha: Hydra does not handle user-facing login pages — it delegates to Kratos or a custom login app. The Agent DX plugin handles this wiring automatically, but developers who modify the flow should understand the Hydra-Kratos interaction.

ROI METRICS

Metric Before (Retrofit) After (Agent DX) Source Auth implementation time 40-80 hours 10-30 minutes Community estimate Projects shipped with auth ~33% (MVP stage) ~90% (by default) Ory launch research Local test env setup 30 minutes <10 seconds Ory Agent DX docs Auth scaffold lines/code 2,000-5,000 ~200 (generated) Community estimate

The week-1 win: install the Ory Agent DX plugin in your coding agent, run ory start to spin up a local environment, and prompt the agent to build a login flow with email and Google SSO. Test it end-to-end with ory test login. The strategic implication: identity infrastructure should be the first thing an AI coding agent builds, not the last. Ory Agent DX makes auth a default behavior, turning a 40-hour post-hoc retrofit into a 10-minute upfront configuration.

CAVEATS

1. (moderate risk) Docker requirement: The local Ory environment requires Docker Desktop. Teams without Docker or using alternative container runtimes (Podman, containerd) need additional setup. Mitigation: Install Docker Desktop before using the local Ory feature. For production connections, Docker is not required.
2. (minor risk) First-run image download: ory start downloads ~500MB of Docker images on first execution. Subsequent starts use cached images. Mitigation: Run ory start once on fast WiFi before needing it in a time-sensitive coding session.
3. (significant risk) Production complexity: The local scaffolding generates a working auth flow, but production deployments require configuration of session secrets, databases, TLS certificates, and scaling. The plugin does not automate production deployment. Mitigation: Use Ory Network (managed) for production to avoid self-hosting complexity. The Agent DX configs are fully compatible with Ory Network.
4. (moderate risk) Agent compatibility: Plugin quality varies across agents. Claude Code has the most mature plugin marketplace. Codex and Gemini CLI support is newer. Mitigation: Start with Claude Code for the best Ory Agent DX experience. Codex and Gemini CLI support is functional but may have edge cases.