Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

if yes, how can kratos performance be scaled?

Seriously? A DB call for each `whoami` on the hot path? There is no way this approach can guarantee a p99 < 5ms, say for 10k req/s. This seems like a dead end. What about caching plus some clever invalidation?

(For example, using kratos hooks to invalidate cached sessions?)

always depends on the cache staleness guarantees you are fine with
a single cache won't do much, so you're talking about a distributed system here
good look implementing a single webhook that invalidates all caches in the distributed system
in ory network we have implemented this: <https://www.ory.sh/docs/concepts/cache>
but it comes with its own challenges

tl;dr kratos can either be correct or suuuuuper fast, per default it is correct

for database scalability, we have had great success with cockroachdb
we also have a (licensable) proprietary sql layer that takes advantage of some crdb specific features to make the most of it