Move your users between identity providers without losing a single login.
iamigrate is an open-source CLI for migrating CIAM identities between providers. Export users into a canonical format, validate them against your target, import them, and verify the result — with no vendor lock-in on the format in between.
Identity migrations shouldn't be a one-off script.
Every CIAM migration ends up as a pile of ad-hoc scripts, CSV exports, and hope. iamigrate turns it into a repeatable, testable pipeline.
Export to a canonical format
Pull identities out of your current provider or a flat file (CSV) into CMF, a vendor-neutral format that keeps password hashes, MFA factors, and profile data.
Validate before you import
Dry-run a migration against your target's capabilities with no network calls. Catch unsupported hash algorithms or MFA factors before touching production.
Import with password hashes
Import users with their existing bcrypt or argon2id hashes so nobody has to reset their password after the switch.
Reconcile after import
Diff a CMF file against the live target to confirm every identity landed exactly as expected.
Synthetic test fixtures
Generate thousands of realistic users with hashes, MFA, and a cleartext answer key to rehearse migrations and verify logins on disposable tenants.
Install anywhere
Homebrew, Docker, Linux packages, Scoop, WinGet, Chocolatey, or a prebuilt binary — run it on your laptop or in CI.
Export. Validate. Import. Verify.
Every step is a single command, so the whole migration can be rehearsed on test data and replayed in CI before the real cutover.
# Export every identity from Ory Kratos into CMF
iamigrate export --source kratos --out ./export/
# Dry-run against the target's capabilities
iamigrate validate --in ./export/users.cmf.jsonl.gz --target auth0
# Import into Auth0, keeping password hashes
iamigrate import auth0 --in ./export/users.cmf.jsonl.gz --connection-id con_xxx
# Reconcile the result
iamigrate diff auth0 --in ./export/users.cmf.jsonl.gzWorks with your existing identity stack.
iamigrate connects to your current CIAM provider. No migration, no disruption — just a better product experience on top of the infrastructure you already run.
More integrations on the way. Request yours →
Ready to get started?
iamigrate is an open-source CLI for migrating CIAM identities between providers. Export users into a canonical format, validate them against your target, import them, and verify the result — with no vendor lock-in on the format in between.
Read the docs