Workforce identity without the per-seat bill.

Open source SSO, MFA, directory and SCIM, free up to 100 users, with an API for core Okta resources.

The IdRa console's People page, listing people with their status and last sign-in.

GET /api/v1/users?search=profile.email sw "ana"&limit=1Recorded from IdRa, trimmed

[
  {
    "id": "9guA0JYo2KkokOCeGfO8CBp6JpAJaErl",
    "status": "ACTIVE",
    "type": {
      "id": "default"
    },
    "profile": {
      "firstName": "Ana",
      "lastName": "Rivera",
      "email": "ana@example.com",
      "login": "ana@example.com"
    }
  }
]

The IdRa console's Applications page, listing OIDC, SAML, bookmark and gateway apps.

GET /api/v1/apps?q=Payroll&limit=1Recorded from IdRa, trimmed

[
  {
    "id": "e1a681ee-5505-4b60-a95c-a923b140537f",
    "name": "saml_2_0",
    "label": "Payroll",
    "status": "ACTIVE",
    "signOnMode": "SAML_2_0"
  }
]

A group page in the IdRa console, showing the Finance group's members.

GET /api/v1/groups?q=Fin&limit=1Recorded from IdRa, trimmed

[
  {
    "id": "f2d67a84-624e-49ff-93f0-f445a26e5d8a",
    "type": "OKTA_GROUP",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "name": "Finance",
      "description": "Finance team"
    }
  }
]

The IdRa audit log, with a chart of events and a table of actors, events, targets and outcomes.

GET /api/v1/logs?limit=1Recorded from IdRa, trimmed

[
  {
    "eventType": "user.session.start",
    "severity": "INFO",
    "actor": {
      "type": "User",
      "alternateId": "admin@example.com"
    },
    "outcome": {
      "result": "SUCCESS",
      "reason": null
    }
  }
]

One door for your people.

Your logo on the sign-in page. Passkeys, push or an authenticator app behind it. Every app they’re assigned on one page.

How single sign-on works

My Apps, the end-user page with a tile for each assigned app.

Okta’s SDKs work with IdRa.

Change the issuer URL and keep your code. Your scripts keep their calls for users, groups, apps, policies, zones, logs, event hooks and authorization servers, and the Okta Terraform provider works with IdRa too.

See Okta compatibility IdRa vs Okta

migrate.ts

// Change the address. Keep the call.
const client = new okta.Client({
  orgUrl: "https://acme.idra.team",
  token: process.env.IDRA_TOKEN,
  authorizationMode: "SSWS",
});

const users = await client.userApi.listUsers({
  search: 'profile.email sw "ana"',
});

Resources under /api/v1:

Users
Groups
Group rules
Apps
Authorization servers
Policies
Network zones
Event hooks
Logs
User risk

Sign-ins and changes leave a record.

Sign-ins, denials, admin changes and provisioning, in one log. Search it, export it to CSV, poll it from the API, stream it to Splunk, or push it to your systems with signed event hooks.

The IdRa audit log, showing events with actor, event type, target and outcome.

A database per customer, not a column.

Each organization has its own Postgres database, address, signing keys, policies and log. Each request connects to one organization’s database, chosen from its address, and Postgres has no cross-database queries. Host many customers from one deployment, each on a domain they’ve verified.

How multi-tenancy works

acme.idra.team
globex.idra.team
login.example.com

$0 Up to 100 users. Every feature.

A year for 100 people, at list price before add-ons

Okta Essentials$20,400
Okta Starter$7,200
IdRa$0

IdRa is open source under the MIT license. Read the code, run it yourself, or use the hosted service, free up to 100 users, apps and servers per org.

Read the pricing Why open source

Is IdRa right for you?

Choose IdRa if

Your identity bill grows with every hire
You host organizations for your own customers
Your apps speak SAML, OIDC and SCIM

What you get

Every feature on every plan
A database for each organization
An open source codebase under the MIT license

Read the row-by-row comparison