Simple, transparent pricing
No hidden growth penalties. No "contact sales" traps — every price is on this page.
- EU-native from day one.
- 1 dependency (jose). ESM-first. Read the quickstart docs →
Every new account starts with 14 days of Pro — no credit card. After the trial it reverts to Free; anything above the Free limits becomes read-only, never deleted.
Buying for a team? Procurement & compliance
npm install @rakomi/nodePro
25,000 MAU
Start free trialNo credit card required · Cancel anytime
Compare all features
| Feature | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Core & Auth Methods | ||||
| Monthly Active UsersUnique users who log in at least once per calendar month. | 10,000 | 25,000 | 50,000 | Custom |
| SSO connections (SAML + OIDC, one combined quota) | Not included | 1 | 5 | Unlimited |
| 14-day Pro trialEvery new account starts with 14 days of Pro features. No credit card required. | Yes | Yes | Yes | Yes |
| PasskeysPasswordless, phishing-resistant sign-in with device passkeys — on every plan. | Yes | Yes | Yes | Yes |
| DPoP-bound tokens with key rotationRefresh tokens support cryptographic proof-of-possession binding, with automatic rotation and reuse detection — on every plan. | Yes | Yes | Yes | Yes |
| MFA / authenticator app (TOTP)Every user can turn on authenticator-app multi-factor login for their own account — on every plan. | Yes | Yes | Yes | Yes |
| Magic linkPasswordless sign-in via a one-time emailed link — on every plan. | Yes | Yes | Yes | Yes |
| Email one-time codePasswordless sign-in via a one-time emailed code — on every plan. | Yes | Yes | Yes | Yes |
| Social login (8 providers)Sign-in with Google, Microsoft, Apple, GitHub, LinkedIn, Facebook, Slack, and GitLab — on every plan. | Yes | Yes | Yes | Yes |
| Step-up authenticationRe-verify identity with a passkey, password, magic link, or email code before a sensitive action — on every plan. | Yes | Yes | Yes | Yes |
| Account linkingUsers can link multiple sign-in methods to one account — on every plan. | Yes | Yes | Yes | Yes |
| User import with password hashes preservedMigrate existing users in bulk without forcing a password reset — on every plan. | Yes | Yes | Yes | Yes |
| Enterprise SSO & Provisioning | ||||
| SSO connections (SAML + OIDC, one combined quota) | Not included | 1 | 5 | Unlimited |
| SAML 2.0 single sign-onConnect an identity provider over the SAML 2.0 protocol. | No | No | Yes | Yes |
| SCIM 2.0 directory provisioningAutomatically sync users and groups from your identity provider. | No | No | Yes | Yes |
| Tenant-wide MFA enforcementRequire every user in your tenant to enable multi-factor authentication. | No | Yes | Yes | Yes |
| Org-level MFA policy (B2B)Require multi-factor authentication for every member of a B2B organization inside your tenant. | No | No | Yes | Yes |
| Org-level SSO policy (B2B)Require single sign-on for every member of a B2B organization inside your tenant. | No | No | Yes | Yes |
| Bring your own SMS providerUse your own messaging-provider account for SMS one-time codes. | No | No | Yes | Yes |
| Organizations, RBAC & Sessions | ||||
| Organizations (B2B) per tenantIsolated B2B customer organizations inside your tenant. | 5 | 50 | Unlimited | Unlimited |
| Members per organizationMaximum members in one B2B organization. | 20 | 100 | Unlimited | Unlimited |
| Custom rolesBuilt-in roles are always available on every plan; this is the cap on roles you define yourself. | 2 | Unlimited | Unlimited | Unlimited |
| API & Integrations | ||||
| API Keys | 2 | 10 | 50 | Custom |
| Webhooks | 1 | 5 | 50 | Custom |
| OAuth Clients | 1 | 5 | 50 | Custom |
| Synchronous auth hooksHTTPS callouts your code can run during a sign-in or registration flow. | 2 | 10 | Unlimited | Unlimited |
| Marketplace integrationsInstalled integrations from the Rakomi-hosted marketplace. | 2 | 10 | Unlimited | Unlimited |
| MCP server with per-scope consentExpose your tenant to Model Context Protocol clients, with a consent screen scoped to each tool. | No | Yes | Yes | Yes |
| Self-service OAuth client registration (CIMD)Opt in to accept OAuth clients that self-declare their metadata in a signed document, without manual registration. | No | Yes | Yes | Yes |
| Compliance & Trust | ||||
| Event RetentionThe retention window defined for routine sign-in, OAuth and account events. Records we keep to meet an accountability obligation are not governed by this limit — their retention is described in our Privacy Policy. | 30 days | 365 days | 730 days | Custom |
| Audit PackageExportable audit logs, GDPR Art. 30 records, and compliance reports. | No | Yes | Yes | Yes |
| DPA / GDPRData Processing Agreement available on all plans, including Free. | Yes | Yes | Yes | Yes |
| AI-agent identity & audit trailEvery AI-agent action against your API carries an identity and an audit record. | No | Yes | Yes | Yes |
| Hash-chained accountability logA tamper-evident, hash-chained record of AI-agent activity. | No | No | Yes | Yes |
| European Digital Identity Wallet sign-inAccept a presentation from a European Digital Identity Wallet. | No | No | Yes | Yes |
| Verifiable credential issuanceIssue verifiable credentials your users can hold in a digital wallet. | No | No | Yes | Yes |
| Age verification via digital walletVerify a user is above an age threshold without collecting a birth date. | No | No | No | Yes |
| Security event receiver (SSF/CAEP)Receive continuous access evaluation signals from another provider. | No | No | No | Yes |
| Publisher / volume-purchase ecosystemPublish an app for review and distribution to other tenants. | No | No | No | Yes |
| Platform & Localization | ||||
| Custom DomainDNS verification and the OAuth API work on your domain immediately. Hosted sign-in and consent pages render on your domain once this is enabled for your environment — until then, keep interactive sign-in links pointed at the accounts URL your dashboard shows. | No | Yes | Yes | Yes |
| White label brandingSuppress the "Powered by Rakomi" line in your transactional emails. | No | No | Yes | Yes |
| Login-page UI languagesThe hosted sign-in and account pages are localized — on every plan. | 24 | 24 | 24 | 24 |
| Support | ||||
| SLA | Not included | Not included | 99.95% | Custom |
| Support | Community | Priority email | Dedicated | |
Procurement & compliance — one click, not one email
Everything a security review asks for is published, dated, and linkable. No sales call, no NDA gate.
- Certification roadmap — Rakomi is designed for SOC 2 and on the ISO 27001:2022 path — not certified today. The live status and targets are on the Trust page.
- Data Processing Agreement (GDPR Art. 28) — available on every plan, including Free. It is never paywalled.
- Sub-processor register — the full, dated list. Changes are published there.
- Data residency — primary hosting and data storage in the EU. Any third-country transfer (e.g. edge protection, optional identity federation) is limited to the sub-processors listed on the Trust page, each under EU Standard Contractual Clauses.
- Data retention & your rights — access, export, and erasure (GDPR Art. 15/17/20) with the full retention schedule.
- Responsible disclosure — our policy and security.txt (RFC 9116).
Need more MAU?
Add blocks of 5,000 MAU at 10 EUR/mo each (effective: 0.002 EUR/MAU) — up to 30x more affordable than leading alternatives.*
- Pro: up to 10 blocks (75,000 MAU total)
- Business: up to 10 blocks (100,000 MAU total)
- Existing users always log in — only new registrations are paused at the cap
- No auto-upgrades. No bill surprises. You control your cap
* Based on Auth0's published B2C rate of $0.07/MAU and Clerk's $0.02/MAU as of March 2026. Rakomi's effective overage rate: 0.002 EUR/MAU. USD rates converted to EUR at the ECB reference rate as of 2026-07-07 (the same dated rate the migration calculator uses). "Up to 30x" reflects the most favorable comparison after currency conversion; actual savings depend on your usage tier and provider.
Frequently asked questions
How does the 14-day Pro trial work?
Every new account automatically gets 14 days of Pro features — no credit card, no opt-in required. After 14 days, your account gracefully reverts to the Free plan. Any resources above Free limits become read-only (never deleted). Upgrade anytime to restore them. Learn more →
What happens when I exceed my MAU limit?
At 80% usage, you see a dashboard warning. At 100%, new user registrations are paused — but existing users can always log in, refresh tokens, and use your app normally. You can purchase additional MAU blocks instantly from the billing page to resume registrations. We never auto-upgrade your plan or surprise you with a higher bill.
Can I switch plans anytime?
Yes. Upgrades take effect immediately. Downgrades are scheduled for the end of your current billing period. Resources above the new plan's limits become read-only — your data is never deleted. You can also switch between monthly and annual billing at any time; Stripe handles proration automatically.
What's included in the Free plan?
The Free plan includes 10,000 MAU, 1 tenant, 2 API keys, 1 webhook, 1 OAuth client, 30-day event retention, and full DPA/GDPR compliance — including a signed DPA on request. It's free forever, with no credit card required.
Do you offer annual billing discounts?
Yes. Annual billing saves 2 months (~17%). Pro: 290 EUR/yr (effective ~24.17 EUR/mo). Business: 990 EUR/yr (effective ~82.50 EUR/mo). Switch between monthly and annual anytime.
Is my data stored in the EU?
Primary hosting and data storage are in Falkenstein, Germany (Hetzner) — an EU data center. Any third-country transfer (e.g. edge protection, optional identity federation) is limited to the sub-processors listed on our Trust page, each under EU Standard Contractual Clauses.
How do SSO connections count?
A connection is one configured identity provider. SAML and OIDC draw on the same quota — three SAML connections plus two OIDC connections count as five. The allowance per plan is in the comparison table above.
What happens to my data if I cancel?
Monthly plans cancel immediately. Annual plans remain active until the end of the billing period. After cancellation, your data is retained for 30 days, then permanently deleted per our Privacy Policy. You can export your data before cancellation from the dashboard.
How is MAU calculated?
A Monthly Active User is any unique user who performs at least one authenticated action (login, token refresh, or OAuth grant) during a calendar month. The same user across multiple sessions counts once. Test/staging environments on separate tenants have their own MAU counts.
Can I get a DPA?
Yes, on every plan — including Free. Request your signed Data Processing Agreement from the DPA page or email dpo@rakomi.com. We aim to deliver it the same business day.
Do you offer nonprofit or startup discounts?
We're exploring a startup program for pre-revenue companies. In the meantime, the Free plan (10,000 MAU) is generous enough for most early-stage projects. Contact sales@rakomi.com if you'd like to discuss your situation.
All prices shown are in EUR and exclude applicable VAT. VAT will be calculated during checkout based on your location and business status.