Build Identity Your Way With Flexible Pricing and Features

Review our licensing packages on our pricing page. We offer a variety of licensing options designed for your architectural and business requirements. Not sure which license is right for you, or need additional deployments, a higher support level, or custom contract terms? Reach out to our team to learn more.

If you are a current IdentityServer4 user, book a free 30-minute IS4 upgrade assessment with our team.

A Connected Application (Connected App) is any application or service registered with your Duende IdentityServer instance that relies on it for identity, access, or federation. Connected Apps are the unit we use to measure usage for licensing. Each Connected App has its own registration that defines how it interacts with IdentityServer and what it is allowed to do.

Connected Apps fall into these categories:

1. Interactive applications use OpenID Connect (OIDC) to authenticate users and obtain tokens. These include web apps, native mobile or desktop applications, and SPAs, each identified by its own client ID.
2. Machine-to-machine clients request access tokens without user interaction, typically using the client credentials grant. Background services, APIs calling other APIs, and MCP clients are common examples.
3. Third-party API consumers that use a client ID and client secret, typically in SaaS or B2B situations.
4. SAML Service Providers use SAML 2.0 to establish federated trust with IdentityServer acting as the Identity Provider (IdP), enabling single sign-on for apps that rely on SAML-based authentication.

Each separate registration counts as a separate Connected App, including when the same application is registered under more than one protocol.

Each separate registration or configuration in IdentityServer counts as one Connected App. Some common examples:

• One client with multiple redirect URIs, grant types, or scopes: 1 Connected App.
• Two separately registered SAML Service Providers: 2 Connected Apps.
• The same application registered with both OpenID Connect and SAML: 2 Connected Apps.
• A machine-to-machine integration with its own client credentials registration: 1 Connected App, no matter how many machines use it.
• One BFF host serving two frontends that each have their own client registration: 2 Connected Apps.
• Clients registered through Dynamic Client Registration: 1 Connected App per registered client.
• IdentityServer connecting to external identity providers through dynamic providers: not counted as Connected Apps.

Lite licenses and community support use our public GitHub forum, with no response time SLA. Standard and Advanced licenses include a 2 business day response via dedicated email. Custom licenses include a 1 business day response, plus a dedicated Technical Account Manager. Response times are measured against standard US business days.

Escalation calls are focused video pairing sessions where our engineering team works alongside yours to diagnose and resolve complex product issues. Standard licenses include 2 per year, Advanced licenses include 4 per year, and Custom licenses include 8 per year. Lite licenses do not include escalation calls. These are development-focused sessions, not ongoing operational support or on-call coverage. You are responsible for the operation and maintenance of your environments.

Yes. Customers with plans purchased before June 2, 2026 can add any available add-on while keeping their historical plan. This exception applies only to historical plans. Customers purchasing a plan on or after June 2, 2026 can only use add-ons available with their selected plan.

You do not need a license for development, testing, or trial. Download and use our library from NuGet and get started with trial mode. Start learning with the Duende IdentityServer quickstart tutorials.

Upgrading is simple and flexible – you can do so at any time. We'll issue a new license for your updated term and ensure you receive prorated credit for the remaining unused time on your existing license.

Self-hosted means you are running Duende IdentityServer on your own infrastructure - whether that's your own data center or a cloud subscription you own. Standard licenses cover this model but do not permit redistribution to infrastructure owned by your business customers.

Redistribution is a separate license type designed for customers who want to bundle Duende IdentityServer as part of a product that they distribute to customers. Note that a redistribution license is tied to a specific product and cannot be used as a general-purpose identity provider for applications outside of that product.

If you plan to ship Duende IdentityServer as part of a product to your customers, you will need a redistribution license. Self-hosted and redistribution licenses are priced separately. See the self-hosted pricing and redistribution pricing pages.

We renamed the licensing unit from client IDs to Connected Apps. The new name covers an expanded set of protocols supported by IdentityServer, including SAML, which doesn't use the term "client ID". For most customers, the count does not change. Customers who add SAML Service Providers may see their count increase. In technical OpenID Connect and OAuth contexts, a client ID is still a client ID.

Every plan includes a set number of Connected Apps, Duende User Management users, and BFF frontends. If you need more, a flat-rate add-on removes the limit, so your costs stay predictable as you grow:

• Unlimited Connected Apps removes the limit on Connected Apps.
• Unlimited Unique Identities in Duende User Management removes the limit on users stored in Duende User Management.
• Unlimited BFF Frontends removes the limit on the number of BFF frontends.

These add-ons expand the capacity of your plan: how many Connected Apps, users, and BFF frontends you can have. They don’t change what the products do. IdentityServer, User Management, and BFF work exactly as they do in your respective plan, and you only need an add-on if you go beyond what your plan includes. They are available with the Standard, Advanced and Custom plans. See the pricing page for prices.

The unlimited add-ons are available on the Standard, Advanced, and Custom plans, so you can add capacity as you grow. Are you on Lite or the Community Edition? Moving up to Standard unlocks unlimited Connected Apps, Duende User Management users, and BFF frontends, plus extended protocol support and server-side sessions.

Simply, and predictably. Each flat-rate add-on has a published price, so you know your cost up front and it doesn’t change as you add apps, tenants, users, or frontends. Additional production deployments are priced separately, per deployment, so you pay only for the deployments you add. See the pricing page for details.

The Custom plan is for organizations whose needs go beyond our published plans and add-ons. It includes:

• Production deployments beyond what your plan includes, to match the scale of your environment
• Premium support, our most comprehensive support package
• Contract terms built around your organization’s legal, security, and procurement needs

If you only need more Connected Apps, User Management users, or BFF frontends, the unlimited add-ons on the Standard or Advanced plan are usually the simplest route.

• Lite: support through the public GitHub forum; feature requests through the forum.
• Standard: dedicated email support with a 2 business day response time and 2 escalation calls per year; feature requests by email.
• Advanced: dedicated email support with a 2 business day response time and 4 escalation calls per year; feature requests by email.
• Custom: dedicated email support with a 1 business day response time and 8 escalation calls per year. Also includes a dedicated Technical Account Manager, priority security notifications, and support for our open-source packages.