Curity
API-driven identity server providing OAuth/OIDC token issuance and fine-grained API security for organizations that need to secure machine-to-machine and mobile/API traffic at scale.
Visit Website ↗ + Add to CompareOverview
Curity was founded in Stockholm in 2015 with a specific focus: rather than building a general-purpose identity provider, the Curity Identity Server is designed around securing APIs — issuing and validating OAuth2/OIDC tokens, enforcing fine-grained scopes, and integrating tightly with API gateways. This makes it a common choice for banks, telecoms, and other organizations with heavy API traffic and regulatory requirements (such as European PSD2/open banking mandates) around token-based access control.
The company has been quietly funded, with a Series A from Fairpoint Capital in 2019 and additional backing from GRO Capital in 2023, and operates with a relatively small team of around 50 employees, reflecting a profitable, deliberately-paced growth model rather than a venture-fueled land grab.
Curity’s differentiation from broader IAM platforms like Okta or Ping Identity is depth over breadth: it is purpose-built for API and token security rather than covering the full range of workforce SSO, HR-driven provisioning, and consumer identity use cases.
Innovation Matrix Assessment
A small, steady engineering team has maintained the identity server with regular OAuth/OIDC standards updates, but the company does not show the rapid feature cadence of venture-scaled competitors.
Specialized OAuth/OIDC token handling reduces the risk of misconfigured API authorization for organizations with heavy machine-to-machine and open-banking traffic.
Modest, infrequent funding rounds and limited public market visibility suggest steady but unspectacular commercial momentum relative to category leaders.
Implements established OAuth2/OIDC standards well rather than introducing a new identity model.
A decade of production deployment in regulated banking and telecom environments, which have stringent audit requirements, is a reasonable real-world efficacy signal even without public breach data.
API and machine-to-machine token security remains persistently important as API traffic grows and regulatory mandates around open banking and data access expand.
Why CISOs Should Care
For organizations with regulatory obligations around API and open-banking access (particularly in the EU), Curity provides a focused, standards-compliant OAuth/OIDC layer that is easier to audit for token-issuance correctness than adapting a general-purpose IAM suite.
What Makes It Different
Curity is purpose-built around API and token security specifically, rather than being a general workforce or customer identity platform that happens to support OAuth as one of many features.
The Matrix Verdict
50/100 — INCREMENTAL INNOVATOR
A durable, profitably-run identity server vendor with real depth in API/token security and a customer base concentrated in regulated industries, but limited market visibility and disruption relative to broader IAM platforms. A steady Incremental Innovator.
Editorial Note: Claims vs. Verified Findings
Founding, funding, and employee-count figures are drawn from Curity's own company page and third-party aggregator profiles (Tracxn, CB Insights); customer names and deployment scale were not independently verified.
Sources
Alternatives to Curity
Teleport
An identity-based infrastructure access platform issuing short-lived cryptographic identities for humans, machines, and AI agents in place of…
SpecterOps
Identity attack-path security specialist behind BloodHound, the widely used open-source tool for mapping Active Directory and Entra ID…
Astrix Security
Non-human identity security platform that discovers and governs API keys, OAuth tokens, service accounts, and AI-agent credentials across…
Socure
AI-driven identity verification and fraud platform used by banks, fintechs, and government agencies to validate identities during digital…
Keyfactor
Machine identity and PKI management platform helping enterprises secure certificates, keys, and post-quantum cryptography readiness at scale.
Silverfort
Agentless unified identity protection platform that extends MFA, ITDR, and access policy to legacy and unmanaged systems traditional…