SPAPS vs Ory Kratos
This is a boundary guide, not a feature-parity claim. The SPAPS statements were checked against
Sweet Potato 5b09d3df1194577c5313c865fef1db98f694cdea; verify Ory’s current primary documentation
before making an adoption decision.
Ory Kratos is a broad identity system for self-service identity flows, sessions, schemas, and identity management. SPAPS is intentionally smaller: it gives downstream apps a local-to-production path for application identity, user identity, billing state, wallet state, and entitlement checks.
Do not choose SPAPS as a replacement for enterprise identity governance. Choose it when the app needs revenue-aware access decisions and a compact backend surface.
Quick Comparison
| Question | Ory Kratos-shaped answer | SPAPS-shaped answer |
|---|---|---|
| Primary job | Identity and self-service flow platform | App backend control plane for auth, billing, wallet, and entitlements |
| Configuration model | Identity schemas, flows, services, and deployment config | App contract, runtime mode, middleware, routers, services, and package surfaces |
| Evaluation cost | Identity-platform proof | App-level local proof plus API verification |
| Revenue state | Integrated by application architecture | First-class SPAPS docs surface |
| Best reader | Identity platform owner | App integrator, backend maintainer, or demo operator |
Choose SPAPS When
- The application already has or accepts an identity source, but access must reflect billing and grants.
- The team needs to explain application identity separately from user identity.
- Local mode should still exercise the app contract and route boundaries.
- The implementation owner wants FastAPI server references, CLI commands, and package recipes in one docs site.
Choose Ory Kratos When
- Identity schema, account recovery, self-service flows, and identity lifecycle are the product center.
- The organization needs a dedicated identity platform rather than an app-specific backend surface.
- Billing and entitlements are secondary to identity governance.
Proof Path
Start with the local SPAPS proof:
npx spaps local
npx spaps quickstart --json
npx spaps verify --jsonThen inspect request lifecycle, middleware and auth, and security invariants before changing production-shaped auth behavior.