Identity And Access Management — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) Workforce Core
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAzure AD Free $0 up to 500k objects; Okta SSO $2/user/mo min $2000/yr, MFA add $4/user/mo total; Entra ID P1 $6/user/mo, P2 $9/user/mo; JumpCloud Free 10 users+10 devices then $9/user/mo
Customer Identity & Access (CIAM) Platform
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free 7.5k MAU, 2 social IdPs; Essentials $35/mo for 500 MAU + $0.07/MAU over; B2B $150/mo; Clerk Free 10k MAU then $25/mo + $0.02/MAU; Supabase Auth Free unlimited on free project, Pro $25/mo
SSO Platform / Enterprise Federation (SAML/OIDC)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWorkOS SSO Free dev 1M API calls/mo then $99/mo per product, bundle SSO+DirSync+Audit Logs $149/mo; Okta SSO $2/user/mo min 100 users $200/mo; Azure AD P1 $6/user/mo includes SAML; BoxyHQ OSS Free self-host
MFA Provider / TOTP/Push Auth
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsDuo Free 10 users unlimited apps; Essentials $3/user/mo, Advantage $6/user/mo, Premier $9/user/mo; Authy Free 100 auths/mo then $0.05/auth; Okta MFA $3/user/mo add-on to SSO
Passwordless Authentication (WebAuthn/FIDO2)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSimpleWebAuthn OSS Free $0 self-host; Hanko Cloud Free 500 MAU then $39/mo; Corbado Free 1k MAU then $99/mo 5k MAU; Descope Free 7.5k MAU then $49/mo base + $0.05/MAU over
Secrets Management for IAM (Service Accounts & Keys)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsVault OSS Free; HCP Vault Dedicated $0.03/hr ~$22/mo + storage $0.15/GB; Doppler Free 5 users then $12/user/mo; Infisical Free self-host, Cloud Free 1 project then $15/mo; AWS Secrets $0.40/secret/mo + $0.05/10k API calls
API Authorization / OAuth 2.1 Authorization Server
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsOry Hydra OSS Free; Ory Network Free 10k tokens/day then $0.15/1k tokens over; Keycloak OSS Free; FusionAuth Community Free, Cloud $37/mo; Auth0 authz included in MAU pricing $35/mo base
Session Management & Token Revocation / CAEP
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsRedis OSS Free self-host; Upstash Free 10k cmds/day then $10/mo 100k/day, $25/mo 500k/day; Keycloak Free sessions; Okta CAEP Continuous Access add-on $2/user/mo; Transmit $10k/yr base
Audit Logs WORM for IAM Events
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsWorkOS Audit Logs Free 10k events/mo then $0.01/event or $99/mo bundled; CloudTrail Free first copy, then $2.00/100k mgmt events; Axiom Free 500GB ingest 30d then $25/mo per 100GB; Panther $150/mo base + $10/GB
Zero Trust Network Access (ZTNA) for Admin
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudflare Access Free 50 users then Teams Standard $7/user/mo; Tailscale Free 3 users 100 devices then Personal Pro $6/user/mo, Teams $10/user/mo; Zscaler ZPA $20/user/mo min 100 users $24k/yr; ZPA+ZIA bundle $45/user/mo
Directory Sync & SCIM Provisioning
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsBoxyHQ SCIM OSS Free; WorkOS DirSync Free dev 100 directories then $99/mo per product, trio bundle $149/mo; JumpCloud includes SCIM $9/user/mo; Okta Lifecycle $4/user/mo min $400/mo
Fine-Grained Authorization / Policy Engine (OPA/Zanzibar)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOPA OSS Free; OpenFGA OSS Free self-host; AuthZed Cloud Free 10k tuples then $60/mo starter, $250/mo scale; Permit.io Free 1k checks/day then $299/mo Pro 50k checks/mo + $0.001/check over; Oso Free 1k/day then $150/mo
Device Trust / Endpoint Verification
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudflare Gateway Free 50 users then $7/user/mo includes posture; Tailscale posture Free then Teams $10/user/mo; Duo Device Health requires Advantage $6/user/mo; CrowdStrike Falcon Go $59.99/device/mo
User Lifecycle Management / Automated Provisioning
Enterprise single sign-on and user provisioning. Usually required to sell to larger organizations.Pricing & free-tier limitsOkta Lifecycle $4/user/mo, Workflows add-on $3/user/mo; JumpCloud $9/user/mo includes lifecycle; SailPoint IdentityNow $12k/yr base + $6/user/mo; Keycloak OSS Free provisioning via SPIs
Certificate Authority for mTLS Client Auth / User Certs
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsSmallstep OSS Free; Hosted $40/mo per 10 active certs; Let's Encrypt Free 100 certs/domain/wk; Cloudflare mTLS $10/mo + $10k/yr enterprise for client cert API; AWS Private CA $400/mo per CA root + $0.75/cert issued (short-lived $0.05)
Hardware Security Module (HSM) for IAM Signing Keys
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsSoftHSM OSS Free dev; YubiHSM 2 $650 one-time (no fee); AWS CloudHSM $1.88/hr ~$1,370/mo per HSM; Azure Managed HSM $2.50/hr ~$1,825/mo; Google Cloud HSM $1.37/hr + $1/key version $0.03/10k ops
Fraud Detection & Bot Prevention for Login
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsTurnstile Free unlimited solves; Bot Mgmt in Pro $20/mo basic, Enterprise $200/mo min; hCaptcha Free 10k solves/mo then $99/mo; Friendly Captcha Free 1k/mo then $35/mo; Arkose custom $25k/yr min; DataDome $30k/yr base
Privileged Access Management (PAM) Vault
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsTeleport Community Free 10 nodes; Enterprise $20k/yr base for 50 users + $250/user/yr over; StrongDM Free 10 users then $70/user/mo; Boundary OSS Free, HCP Boundary $0.10/hr per worker + $15/mo; CyberArk PAM $100k/yr min self-host + $150/user/mo; BeyondTrust $50k/yr + $120/user/mo
Entitlement Management / RBAC Platform
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsCasbin OSS Free; Cerbos OSS Free; Cerbos Cloud Free 10k decisions/day then $200/mo Starter 1M/mo, $600/mo Pro; WorkOS Roles Free bundled $0; PlainID $60k/yr min; Saviynt entitlements $5/user/mo
How this small scale identity and access management checklist works.
Each requirement below is something a small scale identity and access management build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.