Hi all. QQ. We’re looking to release our app - which is integrated with Kratos & Hyrdra for identity - to a subset of early access users. We have a ‘hidden’ sign up link, but this is unrestricted, i.e. anyone could find the link and sign up Is there any configuration option in Kratos to set an allowlist for email addresses? Then we could look to restrict easily to our early access list

Nope, but you could use Hooks/Ory Actions on the registration flow to validate if they're permitted to signup or not

Thanks Adam. I rather suspected webhooks would be the only option, but good to confirm

Hi @helpful-traffic-4919 can you tell me you are using the browser flow or the native api flow?

We’re using the Ory service, so the actual components involved are abstracted - but I’m presupposing Hydra & Kratos We use a browser flow to establish a session with Hydra as the IDP, then from this session we interact with Kratos to obtain an OAuth2 access token, which the browser supplies in subsequent server requests On the server side, we have an auth layer across our API which gates access by querying Kratos for the JWKS to validate the bearer token

@helpful-traffic-4919 you are using HYDRA as IDP or KRATOS?

Ha, sorry, looks like I got it the wrong way around 😞 Kratos is the IDP then and Hyrdra for OAuth (It’s all abstracted in the Ory service interface is the thing)

Can you just guide me a bit what changes or steps you followed to connect kratos with hydra?

we’re not self hosting to be clear, so depends what you mean by connect but in terms of the UI flow - whilst I didn’t implement this so I can’t give you the specifics - we establish a session with the IDP (kratos here) then under the common auth domain, we use this session to begin an OAuth client side flow to obtain an access token via a standard OAuth interaction with Hydra