Every plan includes the whole protocol, passkeys, social sign-in and an audit trail you can prove. Paid plans add users, longer logs and sessions, every social login, SAML, machine identity, SMS codes and seats, at a flat monthly price.
No card required
$0 per month
For a new product finding its users: the whole protocol, at no cost.
Includes:
$15 per month, billed annually ($180 a year)
$20 per month, billed monthly
For a product in production that needs more users, more history and SMS.
Everything in Free, plus:
$150 per month, billed annually ($1,800 a year)
$200 per month, billed monthly
For larger teams that need more seats, longer history and faster help.
Everything in Team, plus:
Prices are in US dollars. Billing is through Stripe, and Link (by Stripe) is the merchant of record: it is the seller on your receipt, adds any sales tax or VAT at checkout, and handles payment support.
Everything each plan includes, side by side.
Scroll the table sideways to see every plan.
| Feature | Free | Team | Business |
|---|---|---|---|
| Platform pricing | |||
| Base pricePer month. Annual billing is paid once a year, up front. | $0 | $15/mo, billed annually or $20/mo, billed monthly | $150/mo, billed annually or $200/mo, billed monthly |
| ApplicationsOAuth and OpenID Connect clients in a workspace. | Unlimited | Unlimited | Unlimited |
| Monthly recurring usersDistinct users who signed in or refreshed a token in a calendar month. | 75,000 included | 100,000 included | 100,000 included |
| Additional usersPast the included monthly recurring users. | Not billed; nobody is blocked | $0.01/mo each | $0.01/mo each |
| Dashboard seatsPeople who can sign in to your workspace's console. | 5 included | 5 included | 15 included |
| Additional seatsPast the included seats. | Not included | Not included | $15/mo each |
| Authentication | |||
| PasswordsWith self-service recovery, so support is not the reset mechanism. | Included | Included | Included |
| PasskeysWebAuthn, including discoverable credentials. | Included | Included | Included |
| Authenticator appsTOTP as a second factor. | Included | Included | Included |
| Email codesA one-time code by email, as a second factor. | Included | Included | Included |
| SMS codesA one-time code by text message, as a second factor. US and Canadian numbers. | Not included | Included | Included |
| Recovery codesSingle-use codes for when a factor is lost. | Included | Included | Included |
| Social sign-inSign in with the providers you connect: Google, GitHub, LinkedIn and Facebook. | 1 | All | All |
| SAMLYour customers sign in through their own SAML identity provider, and your SAML apps sign in through yours. | Not included | Included | Included |
| Machine identityService accounts, client credentials and private_key_jwt. | Not included | Included | Included |
| Sessions | |||
| Session lifetimeHow long a sign-in lasts before your users sign in again. | Pick 1, 3 or 7 days | Any, up to 30 days | Any, up to 30 days |
| Sign out everywhereUsers see where they are signed in and can end any session. | Included | Included | Included |
| Observability | |||
| Application log retentionHow far back your audit trail is visible. Older entries are deleted 7 days later. | 3 days | 14 days | 60 days |
| Hash-chained audit trailSealed and timestamped, so tampering with it shows. | Included | Included | Included |
| Usage meteringMonthly recurring users by month, in the console and the API. | Included | Included | Included |
| Integrations | |||
| WebhooksWith retries and a dead-letter queue. | Included | Included | Included |
| Management APIManage applications, users and keys from your own code. | Included | Included | Included |
| SDKsBrowser and server SDKs, with a backend-for-frontend so tokens never reach the browser. | Included | Included | Included |
| Support | |||
| Email supportQuestions about your workspace, answered by email. | Included | Included | Included |
| Enhanced supportYour requests handled ahead of the queue. | Not included | Not included | Included |
| Service level agreementNot offered on any plan yet. | Not included | Not included | Not included |
A distinct user of your workspace who signed in, or whose application refreshed a token, during a calendar month in UTC. One person counts once a month however often they sign in. Your workspace's own administrators are not counted. It is the number on your console's Usage page.
We tell you, with an entry in your audit trail and a flag in the usage API, and nothing else happens: nobody is blocked from signing in, and nothing is charged. Team and Business include 100,000 users; each one past that is $0.01 for the month, and on annual billing those are added up monthly and invoiced with your renewal.
Stripe processes the payment, and Link (by Stripe) is the merchant of record: it sells you the subscription, issues the receipt, adds any sales tax or VAT at checkout, and answers payment questions. You choose a plan from Billing in your workspace's console, and pay on Stripe's checkout; your card details never reach us.
At any time, from Billing in your console. The plan runs to the end of the period you have paid for, and then your workspace moves to Free and Free's limits apply: its log window, its session lifetimes, and no SMS codes. Nobody loses a seat, but you cannot add members past Free's 5 until you are under it.
Logs older than the new plan's window stop being visible straight away, and are deleted 7 days later. Upgrade again within those 7 days and they come back.
On Team and Business, a workspace can let its users add a phone number as a second factor. Codes go to US and Canadian numbers only, and a number is used for sign-in codes and nothing else: never marketing. Each user agrees to receive them when they add the number.