Plans that Scale with You

Number of unique users who authenticate at least once during a billing cycle.

Allow or block signups based on emails, phone numbers, or custom regex.

Access and manage your tenant programmatically via API keys.

Allow users to sign in with a secure password.

Define custom password complexity rules and enforce reuse policies.

Allow users to authenticate using a unique username.

Allow users to sign in using social providers like Google, Apple, GitHub, and more.

Allow users to authenticate securely using device passkeys and biometrics.

Authenticate users via email magic links or one-time passcodes (OTP).

Customize OTP length, and expiration for both OTPs and Magic Links.

Authenticate users with one-time passcodes sent directly to their phones via SMS.

Configure the length and expiration duration of SMS OTPs.

Enable secure sign-ins on input-constrained devices using the OAuth 2.0 Device Authorization Grant.

Control which authenticators are permitted for each application.

The maximum number of secrets per application.

Verify client identity using Mutual TLS (mTLS) certificates.

Use asymmetric keys in JWK format to authenticate clients.

Define your own custom shared secrets for client authentication.

Create client secrets with configurable expiration.

Create and manage custom API resources.

Enable authentication for APIs.

Verify API identity using Mutual TLS (mTLS) certificates.

Use asymmetric keys in JWK format to authenticate APIs.

Define your own custom shared secrets for API authentication.

Create API secrets with configurable expiration.

Allow APIs to securely validate and inspect access tokens.

Bind access tokens to underlying user sessions for enhanced security.

Initiate authorization flows securely via a server-to-server backchannel.

Trigger secure sign-out via backchannel.

Log users out across multiple applications within the browser.

Ensure request integrity by signing authorization requests as JSON Web Tokens.

Require users to explicitly consent before applications access their data.

Organize users into groups to streamline role-based access control (RBAC).

Restrict access to an application to members of specific groups.

View and manage active user sessions.

Audit applications accessed by a user, including the number of active tokens, and authorization codes.

Revoke user authorized API access and scopes from applications.

Manage and revoke active tokens and authorization codes tied to a user.

Safeguard against automated credential-stuffing by limiting failed attempts per user or IP address or both.

Configure the maximum duration of user sessions.

Configure the maximum duration of refresh tokens.

Block user access by suspending user accounts.

Read and write custom public and private metadata to user profiles.

Issue access tokens for automated backend systems, agents and non-human applications.

Issue access tokens securely bound to client certificates using mutual TLS.

Validate incoming mTLS client certificates against online revocation authorities (OCSP).

Upload and manage trust stores to validate mTLS client certificates.

Issue opaque access tokens that require Token Introspection for validation instead of JWT verification.

The total number of applications that can be registered and managed.

Communicate directly with our support team by opening an email ticket.

Access peer and staff support through our active Discord community.

Track authentication activities, access attempts, and administrative events for security compliance.

Forward authentication events to Google Analytics for monitoring and user insights.