careful-honey-27437
05/23/2025, 7:10 AMbrief-egg-61061
05/23/2025, 7:10 AMcareful-honey-27437
05/23/2025, 7:10 AMbrief-egg-61061
05/23/2025, 7:10 AMbrief-egg-61061
05/23/2025, 7:10 AMjs import { Configuration, FrontendApi } from "@ory/client-fetch" const ory = new FrontendApi( new Configuration({ basePath: process.env.ORY_SDK_URL || "<http://localhost:4000>", credentials: "include", }), )
2. Update your code to use the new API methods For example, to check a session: js const session = await ory.toSession()
Or, if you need to pass cookies (e.g., in an Express middleware): js ory.toSession({ cookie: req.headers.cookie })
3. Remove all references to V0alpha2Api The new SDK structure does not use this class. Use FrontendApi, IdentityApi, or OAuth2Api as appropriate for your use case. For more details and migration examples, see the [SDK V1 upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#frontend-apis) and the [Ory integration examples](https://www.ory.sh/docs/getting-started/integrate-auth/expressjs#require-login-to-access-the-home-page). Summary: - Do not use V0alpha2Api with @ory/client-fetch. - Use FrontendApi and the new import style. - Update your code to match the new SDK structure. If you need to see a full example, here is a minimal Express middleware using the new SDK: js import { Configuration, FrontendApi } from "@ory/client-fetch" const ory = new FrontendApi( new Configuration({ basePath: process.env.ORY_SDK_URL || "<http://localhost:4000>", credentials: "include", }), ) const requireAuth = async (req, res, next) => { try { const session = await ory.toSession({ cookie: req.header("cookie") }) req.session = session next() } catch (error) { res.redirect("/login") } }
[SDK V1 upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#frontend-apis)brief-egg-61061
05/23/2025, 7:10 AMdocker-compose.template.dbg
and Dockerfile-debug
files. - Set the required environment variables: SERVICE_NAME
, SERVICE_ROOT
, and REMOTE_DEBUGGING_PORT
. - Generate a debug-enabled compose file and start the service: bash SERVICE_NAME=kratos SERVICE_ROOT=../kratos REMOTE_DEBUGGING_PORT=9999 envsubst < ../kratos/.docker/docker-compose.template.dbg > docker-compose.kratos.tmp docker-compose -f docker-compose.yaml -f docker-compose.kratos.tmp up --build -d kratos
- This setup mounts your code, builds Kratos inside the container, and starts it with Delve. Each time you change a .go
file, Kratos is recompiled and Delve is restarted. Connect your debugger to localhost
and the port you set for REMOTE_DEBUGGING_PORT
in your IDE's remote debugging configuration [Debugging Ory Kratos in Docker with Delve - docker-compose](https://www.ory.sh/docs/kratos/debug/debug-docker-delve-ory-kratos#as-part-of-a-docker-compose-setup). ### 2. As a standalone Docker container - Use the Dockerfile-debug
file for building the image (ensure your build context is the Kratos root directory). - Expose the Delve port (default 40000) as 8000, and expose the service port you need. - Configure bind mounts and set Docker run options: --security-opt="apparmor=unconfined" --cap-add=SYS_PTRACE
[Debugging Ory Kratos in Docker with Delve - standalone](https://www.ory.sh/docs/kratos/debug/debug-docker-delve-ory-kratos#as-a-standalone-docker-container). If you need to set log levels for debugging, you can use the LOG_LEVEL
environment variable with values like debug
, info
, warn
, error
, fatal
, or panic
[Hydra FAQ - log level](https://www.ory.sh/docs/hydra/faq#can-i-set-the-log-level-to-warn-error-debug-). If you need more specific debugging help, please clarify your use case or the component you want to debug.brief-egg-61061
05/23/2025, 7:11 AMbrief-egg-61061
05/23/2025, 7:11 AMjs import { Configuration, V0alpha2Api } from "@ory/client-fetch"
with: js import { Configuration, FrontendApi } from "@ory/client-fetch"
Then, use the new API classes. For example, to interact with frontend/session APIs: js const ory = new FrontendApi( new Configuration({ basePath: "https://{your-project}.<http://projects.oryapis.com/|projects.oryapis.com/>", // other config options }) )
All previous usages of v0alpha2 should be updated to the new structure. For example, session checking now looks like: js const session = await ory.frontend.toSession({ cookie: "ory_session_...=..." })
For more details and migration examples, see the [SDK V1 upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#frontend-apis). Summary: - V0alpha2Api is no longer exported; use FrontendApi, IdentityApi, or OAuth2Api. - Update your imports and code to use the new API structure. - See the official [upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#frontend-apis) for more migration help. If you need to support CommonJS, you can import the default and destructure, but you still need to use the new API classes, not V0alpha2Api. The knowledge sources do not mention any continued support for V0alpha2Api in the latest SDKs, so migration is required.careful-honey-27437
05/23/2025, 7:12 AMcareful-honey-27437
05/23/2025, 7:12 AM[Ory Keto] Deleted: ${tuple.namespace} ${tuple.object} ${tuple.relation} ${tuple.subject_id}
)
} catch (err) {
console.error(“[Ory Keto] Error deleting tuple:“, err.response?.data || err)
}
}
nextPageToken = response.data.next_page_token
} while (nextPageToken)
}brief-egg-61061
05/23/2025, 7:12 AMbrief-egg-61061
05/23/2025, 7:12 AMV0alpha2Api
is deprecated and replaced by FrontendApi
(and others, depending on your use case). Below is an updated example for session checking in an Express.js app: js import { Configuration, FrontendApi } from "@ory/client-fetch" const basePath = process.env.ORY_SDK_URL || "<http://localhost:4000>" const ory = new FrontendApi( new Configuration({ basePath, credentials: "include", // Ensures cookies are sent }) ) const requireAuth = async (req, res, next) => { try { // Forward the cookie to Ory for session validation const session = await ory.toSession({ cookie: req.header("cookie") }) req.session = session next() } catch (error) { res.redirect(basePath + "/ui/login") } } // Example usage in Express import express from "express" const app = express() app.get("/", requireAuth, (req, res) => { res.json(req.session) }) const port = process.env.PORT || 3000 app.listen(port, () => console.log(`Server is running on port ${port}`))
Key changes: - Use FrontendApi
instead of V0alpha2Api
. - Use the toSession
method with an options object for cookies. - Set credentials: "include"
in the configuration to ensure cookies are handled properly. This approach is based on the latest Ory SDK usage for Node.js/Express as shown in the official documentation [Integrate authentication into Node.js / Express.js](https://www.ory.sh/docs/getting-started/integrate-auth/expressjs#require-login-to-access-the-home-page) and the [SDK V1 upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#frontend-apis).careful-honey-27437
05/23/2025, 7:12 AM[Ory Keto] Deleted: ${tuple.namespace} ${tuple.object} ${tuple.relation} ${tuple.subject_id}
)
} catch (err) {
console.error(“[Ory Keto] Error deleting tuple:“, err.response?.data || err)
}
}
nextPageToken = response.data.next_page_token
} while (nextPageToken)
}brief-egg-61061
05/23/2025, 7:13 AMbrief-egg-61061
05/23/2025, 7:13 AMV0alpha2Api
is deprecated. For Kratos (identity management), use IdentityApi
. - For Keto (permissions), use RelationshipApi
for relationships. - The method names and parameter structures have changed. - You should import the specific APIs you need from @ory/client-fetch
(for Kratos) and @ory/keto-client
(for Keto), as per the latest SDKs. Below is the updated code: js import { Client } from 'pg' import { Configuration, IdentityApi } from "@ory/client-fetch" import { Configuration as KetoConfiguration, RelationshipApi } from "@ory/keto-client" // Kratos Admin API (used to search identities) const kratos = new IdentityApi( new Configuration({ basePath: "<http://localhost:4434>", // Kratos Admin URL }) ) // Keto Relationship API const keto = new RelationshipApi( new KetoConfiguration({ basePath: "<http://localhost:4466>", // Keto API URL }) ) async function getIdentityIdByEmail(email) { try { const result = await kratos.listIdentities() const identity = result.data.find((id) => id.traits?.email === email) if (!identity) throw new Error("[Ory Kratos] Identity not found") return identity.id } catch (error) { console.error("[Ory Kratos] Error fetching identity:", error.response?.data || error) throw error } } async function deleteKetoRelationshipsForSubject(subject) { let nextPageToken = "" do { const response = await keto.getRelationships({ subject_id: subject, page_token: nextPageToken || undefined, }) const tuples = response.data.relation_tuples || [] for (const tuple of tuples) { try { await keto.deleteRelationships({ namespace: tuple.namespace, object: tuple.object, relation: tuple.relation, subject_id: tuple.subject_id, }) console.log(`[Ory Keto] Deleted: ${tuple.namespace} ${tuple.object} ${tuple.relation} ${tuple.subject_id}`) } catch (err) { console.error("[Ory Keto] Error deleting tuple:", err.response?.data || err) } } nextPageToken = response.data.next_page_token } while (nextPageToken) }
Notes: - The Kratos identity management API is now accessed via IdentityApi
and the Keto relationship API via RelationshipApi
([SDK V1 upgrade guide](https://www.ory.sh/docs/guides/upgrade/sdk-v1#identity-management), [Keto SDK overview](https://www.ory.sh/docs/keto/sdk/overview)). - The method for listing relationships in Keto is now getRelationships
, and deleting is deleteRelationships
([Keto REST API reference](https://www.ory.sh/docs/keto/reference/rest-api)). - The import paths and configuration objects are updated to match the latest SDKs. If you need to install the new SDKs: sh npm install @ory/client-fetch @ory/keto-client
This code is now up-to-date with the latest Ory SDKs for Node.js ES6, as per the official documentation and upgrade guides.careful-honey-27437
05/23/2025, 7:36 AMbrief-egg-61061
05/23/2025, 7:36 AMbrief-egg-61061
05/23/2025, 7:36 AM[Ory Kratos] Error fetching identity: ResponseError: Response returned an error code ... status: 429, statusText: ‘Too Many Requests’
means that your code is hitting the rate limit for the Ory Kratos Admin API endpoint you are calling. Specifically, a 429 Too Many Requests
response indicates that you have exceeded the allowed number of requests for that endpoint within a given time window. According to the Ory documentation, the /admin/identities
endpoint (used by listIdentities
) is subject to strict rate limits, especially on non-production plans. For example, on the Developer plan, the limit is 1 request per second (burst) and 10 requests per minute (sustained) for GET /admin/identities
([Ory Network rate limits](https://www.ory.sh/docs/guides/rate-limits#rate-limit-tables-by-subscription-plan)). What you can do: - Reduce the frequency of your requests to this endpoint. - Implement caching in your application to avoid repeated calls for the same data. - Consider upgrading your Ory plan if you need higher rate limits. - If you need to fetch properties for many users in real time, Ory recommends maintaining a local cache or replicating the necessary properties in your own database, as the Admin API is not designed for high-frequency, real-time lookups ([Ability to query for identity properties without admin rate throttling](https://github.com/ory/network/issues/396)). Summary: You are receiving a 429 error because you are exceeding the allowed rate for the listIdentities
endpoint. To resolve this, you must reduce your request rate, implement caching, or consider a higher subscription plan if your use case requires more frequent access. For more details, see the official documentation on [Ory Network rate limits](https://www.ory.sh/docs/guides/rate-limits#rate-limit-tables-by-subscription-plan) and related discussions on API usage patterns and workarounds ([Ability to query for identity properties without admin rate throttling](https://github.com/ory/network/issues/396)).careful-honey-27437
05/23/2025, 7:59 AMbrief-egg-61061
05/23/2025, 7:59 AMbrief-egg-61061
05/23/2025, 7:59 AM/admin/identities
endpoint requires authentication using an Ory Network API Key (also referred to as oryAccessToken
) [Ory API Reference – listIdentities](https://www.ory.sh/docs/reference/api). To resolve this, you need to provide a valid API key in your request. The API key should be included in the Authorization
header as a Bearer token. Example: js const kratos = new IdentityApi( new Configuration({ basePath: process.env.ORY_API_URL, accessToken: process.env.ORY_API_KEY, // Your Ory Network API Key }) )
Make sure that ORY_API_KEY
is set in your environment and contains a valid Ory Network API Key. Without this, the Admin API will return a 401 Unauthorized error [Ory API Reference – listIdentities](https://www.ory.sh/docs/reference/api). If you are using Ory Network, you can find or create your API key in the Ory Console under your project settings. If you are self-hosting Ory Kratos, ensure you are using the correct admin credentials or tokens as required by your deployment. Summary: A 401 error means your request is not authenticated. You must provide a valid Ory Network API Key as a Bearer token in the Authorization
header to access the Kratos Admin API [Ory API Reference – listIdentities](https://www.ory.sh/docs/reference/api).careful-honey-27437
05/23/2025, 6:01 PM[Ory Keto] Deleted: ${tuple.namespace} ${tuple.object} ${tuple.relation} ${tuple.subject_id}
)
} catch (err) {
console.error(“[Ory Keto] Error deleting tuple:“, err.response?.data || err)
}
}
nextPageToken = response.data.next_page_token
} while (nextPageToken)
}careful-honey-27437
05/23/2025, 6:02 PM[Ory Keto] Deleted: ${tuple.namespace} ${tuple.object} ${tuple.relation} ${tuple.subject_id}
)
} catch (err) {
console.error(“[Ory Keto] Error deleting tuple:“, err.response?.data || err)
}
}
nextPageToken = response.data.next_page_token
} while (nextPageToken)
}brief-egg-61061
05/23/2025, 6:02 PMbrief-egg-61061
05/23/2025, 6:02 PMgetRelationships
and deleteRelationships
endpoints **do not require authentication**—that is, you do not need to provide an API key or access token to use these endpoints. This is explicitly stated in the API reference for both methods: - [getRelationships: "This operation does not require authentication."](https://www.ory.sh/docs/keto/reference/rest-api) - [deleteRelationships: "This operation does not require authentication."](https://www.ory.sh/docs/keto/reference/rest-api) If you are receiving a 401 Unauthorized
response, it is likely that: 1. You are using Ory Network (the managed cloud offering): In Ory Network, some endpoints may require authentication, or your project configuration may enforce stricter access controls. However, the documentation does not specify that these endpoints require authentication, so a 401
is unexpected in the default setup. 2. There is a misconfiguration in your base URL: If your ORY_API_URL
is pointing to the wrong endpoint (for example, the public API instead of the admin API), you may receive a 401
or other errors. 3. You are sending an Authorization
header when it is not needed: While this should not cause a 401
by itself, it is possible that an invalid or malformed token could trigger an authentication error in some deployments. What you should check: - Ensure that your ORY_API_URL
is set to the correct Keto API base path (typically the admin endpoint). - Try removing the accessToken
from your configuration, as it is not required for these endpoints. - If you are using Ory Network, verify your project settings and endpoint URLs. Summary: According to the Ory Keto documentation, the getRelationships
and deleteRelationships
endpoints do not require authentication. If you are getting a 401
error, double-check your API URL and try removing the API key from your configuration. If the issue persists and you are using Ory Network, review your project’s access settings or consult Ory support, as the knowledge sources do not provide further details on this scenario [Ory Keto API Reference](https://www.ory.sh/docs/keto/reference/rest-api).careful-honey-27437
05/23/2025, 6:04 PMbrief-egg-61061
05/23/2025, 6:04 PMbrief-egg-61061
05/23/2025, 6:04 PMhttps://{project_slug}.<http://projects.oryapis.com/|projects.oryapis.com/>
You should replace {project_slug}
with your actual Ory Network project slug. This is the same base URL used for all Ory Network APIs, including Keto. If you have configured a custom domain for your project, you can use that domain instead: <https://ory.your-custom-domain.com/>
This URL serves as the SDK and API endpoint for your Ory Keto (Permissions) API requests on Ory Network [Ory API Reference](https://www.ory.sh/docs/reference/api) [Ory Keto SDK Overview](https://www.ory.sh/docs/keto/sdk/overview).careful-honey-27437
05/23/2025, 6:06 PMbrief-egg-61061
05/23/2025, 6:06 PMbrief-egg-61061
05/23/2025, 6:06 PMgetRelationships
, createRelationship
, patchRelationships
, and deleteRelationships
) requires authentication with an API key. The API reference explicitly states that to perform these operations, you must be authenticated by means of an oryAccessToken
(which is an Ory Network API key) [Ory API Reference – relationship methods](https://www.ory.sh/docs/reference/api). For example, the documentation for deleteRelationships
and patchRelationships
both specify: > To perform this operation, you must be authenticated by means of one of the following methods: oryAccessToken This means you need to include your Ory Network API key in the Authorization
header as a Bearer token when making requests to these endpoints. If you are using Ory Keto in self-hosted mode, the endpoints may not require authentication, but for Ory Network, an API key is required for these privileged operations [Ory API Reference – relationship methods](https://www.ory.sh/docs/reference/api).