Othala
Guides
The integration commitments that keep an Ory deployment durable across upgrades, how applications are connected over OIDC, how requests are denied, and how the substrate is hardened.
Per-app OIDC
How an application gets connected over OIDC. Applications without OIDC use a reverse-proxy forwardauth call into the portal's session gate, or a service-local password for native clients.
Error handling
Requests are denied at two layers and the application sees only one, which is why the error surfaces look asymmetric. Read this before changing portal/src/middleware.ts or any error page.
Hardening
Why each control sits where it does and, where one is absent, why. Scope and reporting live in SECURITY.md.