Is the Ory team working on mTLS client authentication for Hy Ory Community #general

Is the Ory team working on mTLS client authenticat...

numerous-pillow-75018

10/12/2026, 9:24 PM

Is the Ory team working on mTLS client authentication for Hydra (RFC 8705 Section 2)? If not, would you be open to a PR contribution? I have a tested implementation supporting

tls_client_auth

and

self_signed_tls_client_auth

, with more details in issue #1084. Use case is letting services and AI agents authenticate to Hydra with their existing short-lived workload certificates (e.g. SPIFFE identities) without having to provision and rotate separate client secrets (RFC 8705 already standardizes this). The newer WIMSE AIMS and OAuth SPIFFE client-authentication IETF drafts are additional motivation too. Thanks!

magnificent-energy-493

10/12/2026, 10:20 PM

Hello @numerous-pillow-75018 Thanks for your interest ☺️ I think this is either work in progress or on the roadmap. I will pass it on to the product team and see what the status is. FYI @early-magician-18981

gratitude thank you 1

numerous-pillow-75018

10/15/2026, 3:29 PM

@magnificent-energy-493 just curious when/if I should expect a response? Want to plan accordingly for my work and roadmap. Thanks!

👀 1

magnificent-energy-493

10/15/2026, 4:35 PM

Hey @numerous-pillow-75018 thanks for the reminder. I just checked and this isn't in progress and also not on the immediate roadmap. The team is mainly working on Token Exchange as next big feature at the moment. As for contributing code - in general code isn't the issue anymore, it's reviewing code, making sure it doesn't break existing users in interesting ways, releasing and maintaining it in perpetuity. I think the team would definitely be up to get this implemented, but realistically only as part of a commercial contract, not in Ory Open Source. If you have a budget for a commercial relationship, check out the Ory Enterprise License for Hydra and you can get in contact here.

magnificent-energy-493

10/15/2026, 4:36 PM

For what its worth you can get most of this without mTLS today. The JWT-bearer grant (ory.com/docs/hydra/guides/jwt) accepts a JWT-SVID as the assertion, and the client can be public (token_endpoint_auth_method: none) with only the

urn:ietf:params:oauth:grant-type:jwt-bearer

grant type, so the workload holds no secret and the access token's sub is the SPIFFE ID. On the SPIRE side, set jwt_issuer, request SVIDs with the Hydra token URL as audience, and create entries with -jwtSVIDIncludeJTI (SPIRE 1.15.2+). Key rotation is one missing part: a trust relationship pins one JWK, so you'd need a job that registers SPIRE's new JWT keys in Hydra before they're used.

Open in Slack