Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Why in documentation does it say that the lifespan of the code is a default of 1 hour but then when you check the config it is set to 15m ?

Which documentation are you referring to? And are you self-hosting or on Ory Network?

here is what I was looking at <https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation>

&gt; when you check the config it is set to 15m ?
Which config is this?

ory get identity-config 44829b55-3732-41d3-aeea-1d11cb522934 --format yaml &gt; identity-config.yaml

selfservice:
  methods:
    code:
      config:
        *lifespan: 15m0s*
      enabled: true

Ah, the Ory Network default is 15m.

I guess it should be 1h. But you can always set that value manually.

no worries, I just wanted to check. could you clarify another question for me.... does Ory have no account lock/disabling. e.g. user attempts to login with incorrect password 5 times the account will be locked ?

No, not out of the box, but you can build that yourself with login webhooks, afaik.

Great, thanks for answering my queries Jonas :)