Start Free. Pay for What You Use. Deploy it Anywhere.

A unique user who logs in to your applications, or obtains an access token, during a billing cycle. Logging in again in the same cycle doesn't count twice.

• Users who never sign in aren't counted. There's no charge for stored users.
• A new access token obtained with a valid refresh token counts, even without an interactive login.
• A long-lived token spanning several cycles counts the user in each cycle it stays valid.
• A user that logs in to multiple applications within the same WSO2 Identity Platform organization is counted as one MAU.

Learn more about MAU counting

Access tokens used when applications, services, or devices authenticate as themselves rather than on behalf of a person. If your architecture relies on microservices or automated background processes, you'll be using them.

• Usually obtained through the OAuth 2.0 client credentials grant.
• Only issuance is counted. Validating a token costs nothing.
• A long-lived token spanning several cycles counts once, in the cycle it was issued, unless you renew it.

Learn more about M2M token counting

Tokens issued for an AI agent identity. An agent can authenticate with its own credentials, and it can obtain on-behalf-of (OBO) tokens to act for a user who has explicitly authorized it.

• Both kinds count toward your AgentID token total.
• Registering, updating, and deleting agent identities isn't counted. Only tokens are.
• A long-lived agent token counts once in the cycle it was issued. A renewal counts in the cycle it happens.

Learn more about AgentID token counting

No. The per-MAU rate is the same for consumers, business customers, and citizens. B2B setups need extra resources rather than a higher rate:

• Enterprise SSO connections, one for each customer identity provider you federate with over SAML or OIDC. Social logins such as Google, Facebook, and Apple don't count.
• Organizations, one for each customer workspace with its own users, applications, and roles. Nested organizations each count, at every level.

On Growth, both are $35 per month each beyond what your plan includes.

For each purchased organization, an enterprise SSO connection is included for free.

Learn more about organizations and enterprise SSO connections

The plans on this page are built for external identity: your customers, your business customers' users, citizens, and the applications and agents acting on their behalf.

WSO2 Identity Platform handles workforce identity too, but it isn't priced through these plans. A monthly active user model tells you very little about cost when the users sign in every day. Contact us here and we'll work out the right fit.

Nothing stops working. Additional usage is billed per unit on your next invoice. We'll notify and typically reach out to you as your bill nears the $2,000 Growth cap, and usually suggest moving to Enterprise, which costs less at that volume. You can also get in touch any time.

Growth is billed monthly to a credit card. The $25 base is charged at the start of the cycle and any additional usage at the end. You can change or cancel from the Subscription page in your console. Enterprise is an annual contract and can be paid by wire transfer or ACH. Annual Growth contracts aren't available self-service, so contact us here if you'd like one.

Usually when you go to production, rather than when you run out of capacity. Features such as custom domains, custom SMS templates, pre-flow extensions (Actions), webhook endpoints, and outbound SCIM provisioning need a paid subscription regardless of how many users you have. Free also caps sessions at one day and audit log retention at seven days, which most production applications outgrow well before they reach 35,000 users.

Get in touch if any of these apply:

• Your monthly Growth spend is approaching $2,000.
• You need HIPAA, PCI DSS, or NIST attestation.
• You need additional resilience through hot standby or multi-cloud disaster recovery.
• You need a financially backed uptime commitment of 99.99% or above.
• You need additional trust and risk capabilities such as fraud detection, identity verification or data residency.
• You want to run the platform in a private cloud or on your own infrastructure.

Enterprise is priced on committed volume, so at these levels it usually costs less than Growth.

Your account moves to the Free plan automatically.

• Your data and resources are kept. Nothing is deleted.
• Anything above the Free plan's quotas is deactivated rather than removed.
• While you're on the Free plan, a deactivated resource can be reactivated only if you reduce it to within the Free quota. Feature-gated API restrictions stay in place.
• Upgrading to a paid subscription re-enables your resources at any time.

You also become eligible for a new trial 60 days after the downgrade.

Yes, both with an Enterprise subscription. Private cloud is a single-tenant instance that WSO2 runs for you, in the region and on the cloud provider you choose. Self-hosted means you download the components and run them yourself, including on air-gapped networks. Self-hosted uses core-based subscription pricing rather than the per-MAU and per-token model on this page.

Every plan, including Free, gets community support through our Discord channels. Basic support with 12x5 coverage can be added to Growth or Enterprise. Enterprise support can be added to the Enterprise plan and gives 24x7x365 coverage, faster response time objectives, and a technical account manager. Full details are on the SaaS support plans page.

Asgardeo is now part of WSO2 Identity Platform. Your current subscription and contract terms continue unchanged. If you'd like to move to the plans on this page, Contact us and we'll map your existing usage across.