Curity

Overview

Curity makes the Curity Identity Server, a commercial OAuth 2.0 and OpenID Connect server for API security, customer identity, and partner (B2B) identity. Founded in 2015 in Stockholm, it is privately held; in May 2023 it announced a significant investment from the Danish private equity fund GRO, amount undisclosed. It is software you run yourself, on-premises or in your own cloud accounts, not a vendor-operated SaaS. In 2026 it added Access Intelligence, a product for scoping what AI agents may do when they call APIs on a user's behalf (see the Agent Identity Standards Map 2026).

What they are good at

Standards depth. The token service covers OAuth 2.0, OpenID Connect, dynamic client registration, CIBA, DPoP, token exchange, and the FAPI 1.0 and 2.0 security profiles, and the product is certified by the OpenID Foundation. It also acts as a SAML 2.0 IdP (Enterprise edition), exposes SCIM 2.0 user management, and can issue verifiable credentials over OpenID4VC. Curity documents patterns most vendors leave to you: the phantom token pattern (opaque tokens outside, JWTs inside), the Token Handler backend-for-frontend for single-page apps, and the Hypermedia Authentication API for native in-app login without a browser redirect. Operations are DevOps-friendly: configuration as code, a RESTCONF admin API, a CLI, Docker images, Helm charts, HSM support, and structured logs and metrics. Pricing is per deployment with unlimited users, which removes the per-MAU cost cliff of most CIAM services.

Where they fall short

You operate it. Upgrades, high availability, scaling, and database management are your team's job, and the flexibility comes from configuration depth that assumes engineers who understand OAuth. There is no vendor-hosted option for teams that want someone else to run login. The ecosystem is smaller than Okta or Auth0: fewer prebuilt integrations, fewer consultants, and less community content. Identity governance and workforce lifecycle are out of scope. Key capabilities (FAPI, CIBA, multi-cloud) are paid options on top of an edition, so check the exact bill of materials.

Pricing

Flat annual subscription with unlimited users across Community (free), Standard, Enterprise, and a separate Token Handler product. Edition contents are public on the pricing page, but prices are quote-only. The free Community edition lacks MFA and production monitoring, so it suits development and small deployments. See the Identity Pricing Transparency Index.

Best for, and who should look elsewhere

Choose Curity for open banking, financial-grade APIs, telecom, government, and any program where the token server is security-critical and you want it on your own infrastructure. Deployment effort sits with your team: a container starts in minutes, but production readiness (high availability, upgrades, FAPI configuration) is an engineering project with an owner. Teams wanting managed consumer login should look at Auth0 or Transmit Security; open-source buyers should look at Keycloak; large enterprises consolidating workforce and customer identity may prefer Ping Identity. The best CIAM for fintech ranking puts it in context.

Bottom line

Curity is one of the most standards-complete self-hosted OAuth and OIDC servers available, best for API-heavy, regulated organizations with engineers who want control rather than a black box.