Stormpath

Stormpath
Name	Stormpath
Type	Private
Industry	Software
Fate	Acquired by Okta
Founded	2011
Founders	Jason van Zyl, Steve Francia, Les Hazlewood
Headquarters	San Mateo, California
Products	Identity management, Authentication APIs, Authorization services

Stormpath

Stormpath was a cloud identity and authentication provider that offered developer-focused application programming interfaces and software development kits for user management, authentication, and authorization. Founded in 2011 in San Mateo, California by experienced engineers from the Apache Software Foundation and open-source projects, the company sought to simplify identity for developers building services on platforms such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Its offerings competed and interoperated in the same ecosystem as Auth0, Cognito (AWS), Okta, Ping Identity, and OneLogin while catering to engineering teams at startups and enterprises including firms that used Salesforce, Heroku, and Docker.

History

Stormpath was founded in 2011 by Jason van Zyl, Steve Francia, and Les Hazlewood, drawing on experience from projects like Maven and Spring Framework. Early funding rounds attracted investors associated with Silicon Valley venture firms and angel backers connected to the Apache Software Foundation community. The company launched public developer APIs and SDKs between 2012 and 2014, positioning itself alongside identity incumbents such as Okta and newer entrants like Auth0. Stormpath grew its customer base among startups using Heroku and enterprises migrating services to Amazon Web Services. Over successive product releases the company expanded features for multi-tenant applications, social login integrations with Facebook, Google, and LinkedIn, and support for enterprise protocols influenced by OAuth 2.0, OpenID Connect, and SAML 2.0. In 2017 Stormpath announced it was being acquired by Okta, which integrated key components and personnel into its identity platform.

Features and Architecture

Stormpath exposed RESTful APIs and a multi-layered architecture designed for scalability across cloud platforms including Amazon Web Services and Google Cloud Platform. Core features included user directories, group and role management, password policies, account verification, and session management influenced by standards such as OAuth 2.0 and OpenID Connect. The architecture incorporated tenants, applications, directories, and account stores that developers could compose to support single-tenant and multi-tenant patterns commonly used in services built on Heroku and Docker Swarm clusters. For federation, Stormpath provided connectors to enterprise identity providers, compatibility with SAML 2.0 identity providers like Okta, Ping Identity, and legacy Active Directory deployments, and social authentication using providers such as Facebook, Twitter, Google, and LinkedIn. The service emphasized token-based authentication, JSON Web Tokens influenced by the IETF standards, and SDK-driven session handling to reduce developer effort integrating authentication into frameworks like Ruby on Rails, Spring Framework, and Express.js.

SDKs and Integrations

Stormpath released SDKs for numerous programming languages and frameworks, enabling developers to integrate identity into applications running on Node.js, Java, Python, Ruby, PHP, and Go. Framework adapters and middleware supported Spring Security, Rails, Express.js, and Sinatra, and examples demonstrated integration with platform services such as Heroku and Amazon EC2. The company published client libraries for systems that interfaced with enterprise tools like Active Directory, LDAP, and cloud directories from Google Workspace. Community contributions and open-source adapters connected Stormpath to ecosystems involving Docker, Kubernetes, and CI/CD tooling used by teams at companies such as GitHub and GitLab.

Security and Compliance

Stormpath engineered its platform with practices and controls expected by enterprises integrating identity into production services. The service employed encryption for credentials and tokens, secure transport via TLS, and rate-limiting strategies to protect APIs from abuse, drawing on industry expectations shaped by organizations such as the IETF and standards like OAuth 2.0. Stormpath supported password hashing best practices and provided features for account locking, multi-factor workflows (via integrations), and audit logging suitable for compliance programs in organizations using Salesforce or deploying to regulated sectors. While not a compliance certification vendor itself, Stormpath’s platform facilitated customer compliance efforts by enabling audit trails and security controls used in SOC 2 and ISO/IEC 27001 programs across client deployments on cloud platforms like Amazon Web Services.

Acquisition by Okta

In March 2017, Okta announced the acquisition of Stormpath. The deal integrated Stormpath’s developer-centric APIs, technical staff, and IP into Okta’s platform, with Okta positioning the move as an expansion of its developer offering alongside its enterprise identity products. Following the acquisition, Okta migrated certain developer-facing capabilities into its own services and directed customers toward Okta’s APIs and identity solutions. The transaction further consolidated competition among identity providers including Auth0, Ping Identity, and OneLogin, shaping market dynamics in identity-as-a-service for developers and enterprises.

Legacy and Impact

Stormpath’s legacy includes accelerating developer adoption of hosted identity services and influencing how identity is presented as an API-first product in cloud-native application stacks. The company helped normalize patterns for token-based authentication, directory composition, and SDK-driven integration used in frameworks like Spring Framework and Express.js, and it contributed code and documentation that influenced open-source projects and developer expectations. Post-acquisition, many concepts from Stormpath were absorbed into Okta’s developer strategy, and the broader industry saw renewed focus on developer experience among players such as Auth0 and AWS Cognito. The startup’s trajectory is frequently cited in discussions of identity consolidation, platform acquisition by larger vendors, and the evolution of identity tooling for cloud-native development.

Category:Identity management companies Category:Software companies established in 2011 Category:2017 mergers and acquisitions