Everything is in the price, and there is no minimum.
Enterprise identity is usually sold as several products you buy together on an annual contract: single sign-on, then multi-factor authentication, then lifecycle management, each priced per user. It is a reasonable way to sell to a company that wants only one of them.
It is a poor fit for a twenty-person company, where the number you have to budget is the sum of several line items and which ones you need is not obvious until you are some way in. Testaract has three tiers and everything in a tier is in its price. There is no SKU to add when you decide you want multi-factor authentication, because it is already there — including on the free tier.
We bill monthly for the users you actually have, and you can stop. That is worth little to a five-thousand-person company and a great deal to the one this is built for.
What it does today
All of this is on the free tier. None of it is an add-on.
OpenID Connect
Authorization code flow with PKCE — required of every client, public and confidential alike. Discovery, JWKS, refresh tokens, and RP-initiated logout. Per-application pseudonymous subjects for clients that should not be able to recognise a user anywhere else.
SAML 2.0
For the applications that only speak it, from the same session — so signing in once works across both protocols. Service-provider initiated sign-in, single logout, and group membership as a multi-valued attribute.
Your own signing key
Your own SAML entity ID, your own endpoints and your own certificate — not one shared across customers. Rotation is two steps with a gap, so service providers get a window to pick up the new key before it starts signing.
Passkeys and TOTP
Phishing-resistant second factors with recovery codes. Requiring a second factor is a property of the application, so you can demand it of your admin console without demanding it of everything.
Groups
Membership that reaches your applications in tokens and assertions. An application receives only the groups you assign to it — never your whole org chart, which is nobody else’s business.
An audit trail that cannot be edited
Append-only, enforced by the database rather than by our intentions. Sign-ins, failures, client changes and administrative actions, each with the address that performed them.
What we are careful about
Your data is separated by row-level security in Postgres, not by application code remembering to filter — a missing check returns nothing rather than somebody else’s rows. Sessions and tokens live in the database rather than an eventually consistent cache, because revoking access should mean revoked now rather than revoked shortly.
No access token ever reaches browser storage. The admin console holds yours server-side behind an HttpOnly cookie, so a script on the page cannot walk off with a refresh token.
What it does not do yet
Worth knowing before you start rather than after, and you would find out anyway:
- Provisioning into other applications. A directory can push your people into Testaract — that is what SCIM on Growth means, and it works. Pushing them onward into a connected application is the opposite direction and is not built, which matters mainly for AWS IAM Identity Center: it expects people to arrive by SCIM, so until then each one is created there by hand.
- Adaptive authentication — same: a Business feature that does not exist yet.
- A catalogue of pre-built integrations. Connecting an application means registering it yourself with its redirect URI. That is a few minutes for something that speaks OIDC or SAML, and it is not the one-click experience a larger vendor offers.
- Self-service upgrades. Starter is the only tier you can buy today; the paid ones need billing we have not opened yet.
If you need a thousand pre-built connectors today, buy something that has them. If you need your staff to sign in to a dozen applications with one credential and a second factor, without a procurement cycle, that is what this is.
Try it rather than reading about it
The free tier is the whole product up to 10 people and 3 applications — not a trial that expires.