Is Okta free? What it actually costs in 2026
Okta is not free for production. Workforce suites start at $6 per user a month billed annually with a $1,500 annual minimum; Customer Identity starts at a $3,000-a-month base. The free Integrator plan is a non-production sandbox for 10 users.
The 30-day trial and the Integrator Free Plan are the only $0 routes. Integrator orgs allow up to 10 active users, 100 authentications a minute and non-production use, and deactivate after 180 days of inactivity unless an app is submitted to the OIN.
What the free tier actually includes
- Integrator Free Plan: non-production, up to 10 active users, 100 auths a minute
- Workforce: $1,500 annual contract minimum, billed annually
- Customer Identity: Enterprise base at $3,000 a month, billed annually
Where the wall is
Production. The moment real users sign in, the cheapest path is Starter at $6 per user a month with a $1,500-a-year floor — 21 users' worth before the first employee — and Customer Identity opens at $36,000 a year.
After that: Workforce Identity: Starter $6, Core Essentials $14, Essentials $17 per user a month, billed annually, $1,500 minimum; Professional and Enterprise quoted. Customer Identity: Enterprise base $3,000 a month billed annually plus usage add-ons.
Can you self-host Okta? No — cloud only
Okta is cloud only. Keycloak, Authentik and ZITADEL are the self-hosted identity providers compared here — no per-user price.
When paying is still the right call
Stay if identity is genuinely business-critical and you want somebody contractually responsible when SSO breaks at 9am. Stay for the integration catalogue — thousands of pre-built application connections that you would otherwise configure by hand. Stay if you need the compliance envelope: FedRAMP, audit tooling and the paperwork enterprise procurement demands. And stay if you do not have a platform team, because self-hosted identity is the least forgiving thing to run badly.
What you are locked into
High, and it is the integrations rather than the users. User records and group memberships export via SCIM and the API. What does not move is the hundreds of application connections, the provisioning rules, the MFA enrolments people have on their phones, and the conditional-access policies built over years. Re-enrolling every employee in MFA is the step that makes identity migrations painful, and it is unavoidable. Plan for a parallel run, not a cutover.
If you would rather not pay: Keycloak
Keycloak
Apache-2.0 identity, backed by Red Hat, running at enterprise scale.
Free and open source. Red Hat build with commercial support available.
See all 5 Okta alternatives comparedCompare the free options head-to-head
Read from Okta's own pricing and documentation on 2026-09-26 — 37 days ago. Vendors change prices without notice; confirm before you commit.