Pricing that scales with the bill, not with the audit.
Start free — run it yourself on your own infrastructure, forever. Move to hosted when you want us to carry the pager. Dedicated clusters, compliance packs and air-gapped builds are available where they're needed. Every tier includes every protocol; we don't hide SAML or SCIM behind an enterprise paywall.
Plans
USD, per month, billed annually (add 20% for monthly billing). Monthly Active Users (MAU) counts distinct end-user identities that authenticated at least once in the billing period. Admin and service-account seats are not counted toward MAU.
| Tier | Who it's for | Key limits | SLA | Support | Price |
|---|---|---|---|---|---|
| Developer | Self-host, evaluation, side projects, open-source apps. | Unlimited tenants and users. You run the infra. | — | Community (GitHub issues & discussions). | Free |
| Self-Host Supported | Teams running their own cluster but who want a human to answer when things go wrong. | Unlimited tenants and users. You run the infra. | — | Email, 2 business-day response. Security advisory list. | $249/mo |
| Cloud Starter | Small products and MVPs that just want a working IdP. | 3 tenants (1 production), 1 000 MAU, 30-day audit retention. | 99.5% | Email. | Free ≤ 500 MAU, then $29/mo |
| Cloud Team | Growing products with a real user base and real uptime needs. | 10 tenants, 10 000 MAU included, 90-day audit, 3 admin seats. | 99.9% | Email + chat, 1 business-day. | $149/mo + $0.025/MAU over 10 000 |
| Cloud Business | Mid-market with SSO, SCIM and an auditor asking questions. | 50 tenants, 50 000 MAU, 1-year audit retention, unlimited admin seats, SAML IdP mode, SCIM inbound. | 99.9% | Email + chat, 4-hour response in business hours. | $699/mo + $0.02/MAU over 50 000 |
| Cloud Scale | Multi-product companies with large workforce or CIAM footprints. | Unlimited tenants, 250 000 MAU included, 7-year audit, export to S3 / Snowflake / BigQuery. | 99.95% | Shared Slack, 1-hour business-hours response. | $2 499/mo + $0.012/MAU over 250 000 |
| Cloud Dedicated | Single-tenant cluster — private data plane, custom domain, BYO KMS. | Dedicated cluster, VPC peering, region pick, BYO KMS for JWT signing keys. | 99.95% | 24/5 Slack + pager escalation. | From $4 999/mo |
| Regulated / Air-gap | Banks, government, defence, healthcare — on-prem or offline. | On-prem or air-gapped install, signed release bundles, FIPS 140-3 build, compliance artefact pack. | 99.99% operational | 24/7 pager. Named on-call engineer. | From $9 999/mo |
What every tier includes
Protocols are not a tier lever. If you are paying us a dollar, you get every wire protocol WeldForge speaks.
Every protocol
- OAuth 2.0 + OpenID Connect issuer
- SAML 2.0 Service Provider and Identity Provider
- SCIM 2.0 Users and Groups (inbound and outbound)
- LDAP / Active Directory upstream
- X.509 PKI per tenant — CA, CRL, OCSP
Security fundamentals
- MFA: TOTP, WebAuthn, SMS OTP, backup codes
- Per-tenant JWT signing keys
- Hashed, single-reveal API keys with path + method scopes
- Role-based admin (SUPER_ADMIN / TENANT_ADMIN / READ_ONLY)
- Append-only audit log with HMAC-signed webhooks
Operational
- Prometheus metrics, liveness/readiness probes
- Graceful shutdown, per-tenant rate limits
- Resilience4j circuit breakers on every downstream
- OpenAPI spec (gated)
Multi-tenant by design
- Every query tenant-scoped from the database up
- Per-tenant OIDC issuer URL
- Per-tenant SAML IdP metadata
- Per-tenant PKI and signing keys
Usage-based add-ons
Available on every paid cloud tier. Pay only for what you actually send.
| Add-on | Included | Overage |
|---|---|---|
| SMS OTP deliveries (Twilio pass-through) | Pass-through cost | + 15% routing fee |
| Outbound webhook deliveries | 100 000 / mo | $0.50 per 10 000 |
| PKI certificate issuance | 5 000 / mo / tenant | $0.02 per cert |
| Audit event storage (beyond tier retention) | — | $0.08 / GB·month |
| CRM sync operations (Salesforce / HubSpot / Dynamics / Pipedrive) | 25 000 / mo | $0.40 per 10 000 |
| Dedicated outbound IP for webhook delivery | — | $49 / mo |
| HSM-backed tenant signing keys (AWS CloudHSM) | — | $249 / mo per tenant |
| Data residency pin (EU-only, UK-only, ZA-only, …) | — | $399 / mo per region |
Professional services
Packaged engagements for things that don't belong in a recurring invoice. All figures in USD; rates include implementation and handover but exclude third-party SaaS licences if any are involved.
From another IdP
- Keycloak → WeldForge — from
$3 500 - Auth0 → WeldForge — from
$5 500 - Okta → WeldForge — from
$9 500
Covers data import, SAML SP re-registration, MFA enrolment carry-over, and go-live cutover.
Custom integrations
- Bespoke SAML SP connector —
$2 500 – $4 000 - Bespoke CRM / HRIS connector —
$4 000 – $8 000 - Non-standard LDAP dialect —
$2 500
We build it, we maintain it, you get a production entitlement.
Audit artefact packs
- SOC 2 Type II evidence —
$1 500 / yr - HIPAA BAA + access-review pack —
$1 500 / yr - PCI-DSS SAQ-A-EP —
$1 500 / yr - POPIA Operator agreement —
$750 / yr
Engineering hours
- Solution architect —
$285 / hr - Incident deep-dive —
$500 / hr - Dedicated Technical Account Manager —
$3 500 / mo
How we compare
List prices for a roughly equivalent configuration. Every vendor slices their feature matrix differently, so treat these as a directional read, not a quote.
| Vendor | Free self-host | Hosted base | At 25 000 MAU | SAML IdP in base tier? |
|---|---|---|---|---|
| WeldForge | ✓ unlimited | $29/mo | $524/mo | ✓ (Business) |
| Auth0 | ✗ | $35/mo B2C Essentials $150/mo B2B | $0 free tier reaches 25 000 MAU | Enterprise only |
| Okta Customer Identity | ✗ | $2 / user / mo | — | ✓ |
| FusionAuth | ✓ unlimited | ~$125/mo indicative | ~$225/mo indicative | Paid add-on |
| Clerk | ✗ | $25/mo | $0 50 000 retained users included | Pro tier, $75/mo per connection |
| Keycloak (self-host) | ✓ unlimited | DIY | DIY | ✓ |
FAQ
What is a Monthly Active User?
A distinct end-user identity (human end user, not a service account) that successfully completed at least one authentication in the calendar month. Refreshing an existing access token with a refresh token is not a new MAU. A user that signs in 500 times in a month counts as 1.
What counts against my tenant limit?
A tenant is a logical customer or business unit — one row in the tenants table. The default tenant on a fresh install counts. Deactivated tenants do not.
Do admin seats cost extra?
Not on Business or above — they are unlimited. Starter and Team tiers bundle a finite number of admin seats (see the table). Service-account tokens and scoped API keys are unlimited at every paid tier.
How is audit retention billed?
Within your tier's retention window it is included. Beyond the window, audit events are compressed and stored at $0.08/GB·month or exported to your own S3 / Snowflake / BigQuery at no extra charge.
Can I bring my own KMS for JWT signing?
Yes, on Cloud Dedicated and above. We can also integrate with AWS CloudHSM (add-on, $249/mo per tenant) on any paid tier.
Do you have a non-profit / education discount?
Yes — 50% off any cloud tier for verified non-profits, educational institutions and accredited open-source projects. Email support for the discount code before your first invoice.
Can I self-host and still buy support?
Yes — that is precisely the Self-Host Supported tier ($249/mo). You run the cluster; we answer the phone.
Is there a South African billing entity?
Yes. Invoices can be issued in USD, EUR or ZAR from the appropriate entity depending on your tax residency. VAT handling is per the rules of your billing country.