One price per tier.
Everything in a tier is in its price. No add-on SKU for multi-factor authentication, none for SAML, none for directory sync — and no annual commitment to get any of it.
Starter
Free
Everything you need to put SSO in front of a few applications.
- 10 users
- 3 applications
- OpenID Connect, SAML, passkeys, TOTP
- 30 days of audit history
Growth
$4 / user / month
For teams past the free caps, with directory sync.
- Unlimited users
- Unlimited applications
- OpenID Connect, SAML, passkeys, TOTP
- SCIM directory sync
- 90 days of audit history
Then choose Growth from Billing in your console. No card until you do.
Business
$8 / user / month
For organisations that have to show their work to an auditor.
- Unlimited users
- Unlimited applications
- OpenID Connect, SAML, passkeys, TOTP
- SCIM directory sync
- Adaptive authentication coming soon
- 365 days of audit history
Then choose Business from Billing in your console. No card until you do.
What is in every tier
| Starter | Growth | Business | |
|---|---|---|---|
| Users | 10 | Unlimited | Unlimited |
| Connected applications | 3 | Unlimited | Unlimited |
| OpenID Connect & SAML 2.0 | Yes | Yes | Yes |
| Passkeys, TOTP, recovery codes | Yes | Yes | Yes |
| Per-tenant SAML signing key | Yes | Yes | Yes |
| Groups in tokens and assertions | Yes | Yes | Yes |
| SCIM directory sync | — | Yes | Yes |
| Adaptive authentication | — | — | Coming soon |
| Audit history | 30 days | 90 days | 365 days |
Prices are per active user per month, billed monthly. An invited user who has not accepted is not an active user and is not billed. Anything marked coming soon is not built yet and is listed so you can see which tier it will belong to — do not buy a tier for it.
Questions people actually ask
Is there an annual minimum?
No. Monthly, and you can stop.
Is multi-factor authentication extra?
No. Passkeys, TOTP and recovery codes are in every tier including the free one, because an identity provider without them is not finished.
What happens if I outgrow Starter?
Inviting an 11th user or connecting a 4th application is refused with a message saying so, rather than quietly working and appearing on a bill.