Move your users between identity providers without losing a single login.
Connect iamigrate with Ory Kratos to extend your CIAM stack without replacing what already works.
Identity migrations shouldn't be a one-off script.
Every CIAM migration ends up as a pile of ad-hoc scripts, CSV exports, and hope. iamigrate turns it into a repeatable, testable pipeline.
Export to a canonical format
Pull identities out of your current provider or a flat file (CSV) into CMF, a vendor-neutral format that keeps password hashes, MFA factors, and profile data.
Validate before you import
Dry-run a migration against your target's capabilities with no network calls. Catch unsupported hash algorithms or MFA factors before touching production.
Import with password hashes
Import users with their existing bcrypt or argon2id hashes so nobody has to reset their password after the switch.
Reconcile after import
Diff a CMF file against the live target to confirm every identity landed exactly as expected.
Synthetic test fixtures
Generate thousands of realistic users with hashes, MFA, and a cleartext answer key to rehearse migrations and verify logins on disposable tenants.
Install anywhere
Homebrew, Docker, Linux packages, Scoop, WinGet, Chocolatey, or a prebuilt binary — run it on your laptop or in CI.
Available integration
Bring iamigrate to your Ory Kratos environment.
Connect Ory Kratos with AUMS to give support, ops, and product teams a controlled admin UI for user management, password resets, deletion, audit logs, and account support workflows.
iamigrate adds a dedicated product experience on top of that identity foundation: safer workflows, clearer ownership, and less day-to-day CIAM work pushed onto engineers.
Keep your CIAM
Connect to Ory Kratos without migrating users, rewriting authentication, or changing your login journey.
Give teams a focused UI
Let product, support, operations, and security work from a purpose-built interface instead of a developer-first console.
Stay in control
Preserve your existing policies, audit expectations, and access boundaries while making routine identity work faster.
Connect your Ory Kratos tenant
Use service credentials or provider APIs already supported by your CIAM stack.
Map the workflows your team needs
Expose the right user, client, policy, or provisioning actions through iamigrate.
Roll out with confidence
Give each team the access they need while your CIAM remains the source of truth.
Best for teams that want the flexibility of Ory Kratos with the product experience of iamigrate: iamigrate is an open-source CLI for migrating CIAM identities between providers. Export users into a canonical format, validate them against your target, import them, and verify the result — with no vendor lock-in on the format in between.
Export. Validate. Import. Verify.
Every step is a single command, so the whole migration can be rehearsed on test data and replayed in CI before the real cutover.
# Export every identity from Ory Kratos into CMF
iamigrate export --source kratos --out ./export/
# Dry-run against the target's capabilities
iamigrate validate --in ./export/users.cmf.jsonl.gz --target auth0
# Import into Auth0, keeping password hashes
iamigrate import auth0 --in ./export/users.cmf.jsonl.gz --connection-id con_xxx
# Reconcile the result
iamigrate diff auth0 --in ./export/users.cmf.jsonl.gzReady to get started?
Connect iamigrate with Ory Kratos to extend your CIAM stack without replacing what already works.
Read the docs