Plans and billing
How plans, the free trial, quotas and usage-based billing work, how to pay for and manage your subscription, what happens when it lapses, and how the Dedicated plan differs.
Billing belongs to the account, not to a person: the subscription is the account’s, and so is everything it pays for. Payments are processed by Stripe, so card details never reach Authio, and the account owner is the only member who buys, changes or cancels a plan.
Every member can see the plan, its limits and its usage under Subscription. Invoices, the payment method and the balance are shown to the owner only.
Plans
The plans on the pricing page are read from Stripe, so their names, prices and contents are always the ones on sale. They come in two kinds:
| Kind | How it is priced | Where your realms run |
|---|---|---|
| Shared platform plans | By usage: you pay for the billable authentication events of each period | On the shared Authio platform, managed from this console |
| Dedicated | A flat price per term, whatever the traffic | In an environment provisioned for your account alone |
Each plan also declares the quotas and capabilities described in Quotas and capabilities.
The free trial
Signing up for the shared platform founds your account on a 14-day trial of the Basic plan, with no card asked for. Founders give the name of their company or team, which is what the account is called, and a CPF or CNPJ when they sign up; people who join through an invitation give neither. The trial is a real plan with its quotas and capabilities, and because nothing is charged it is not metered and has no billing portal.
While the trial runs, the dashboard tracks one goal — an application of yours, not the console, receiving a real token — and the Subscription screen counts the days left. A notification reminds the owner as the end approaches. If no plan has been chosen when the trial ends, sign-in to the console and to your realms is paused and the owner receives an email with a link to choose a plan. Nothing you configured is deleted.
Choose a plan
Open the subscription
As the owner, open Subscription and choose Choose a plan, or View Plans when the account has no plan at all.
Pick a plan and pay
Pick the plan and complete the payment in the Stripe checkout embedded in the console. The card details go straight to Stripe.
Let the payment confirm
The plan applies as soon as Stripe confirms the payment. The trial ends at that moment.
Quotas and capabilities
Each plan declares quotas, ceilings on how many of something the account may hold, and capabilities, features it turns on. The Subscription screen lists both under Plan Features and measures each quota under Plan usage.
| Feature | Kind | What it covers |
|---|---|---|
| Realms | Quota | Active realms |
| Clients | Quota | Active clients, across all realms |
| Users | Quota | Active users, across all realms |
| Machine consumers | Quota | Active consumers |
| Secrets | Quota | API secrets that are active and not expired |
| Team seats | Quota | Members plus open invitations |
| Custom sign-in appearance | Capability | Changing the layout, colors, logo, background and CSS of a client’s hosted sign-in screens |
| AI advisor | Capability | The AI advisor in the console |
| AI runs per month | Quota | Runs of the AI advisor, reset every month |
| MCP integration | Capability | Resource servers, and tokens issued for them |
| Resource servers | Quota | Active MCP resource servers |
| Connected accounts | Capability | Letting users connect their accounts at external services |
| Active connected accounts | Quota | Connected accounts in use |
| Connection token exchanges per month | Quota | Exchanges that delivered a connected account’s token, reset every month |
| Dedicated environment | Capability | An environment of your own, on the Dedicated plan |
- Only active records count. Deactivating a realm, client, user, consumer or secret frees its slot, and reactivating it checks the quota again.
- A quota the plan does not declare has no ceiling. A capability the plan does not declare is not included.
- Monthly quotas reset on the first day of each month, in UTC.
- There is no limit on monthly active users: the user quota counts the users you keep, and sign-in volume is billed as usage.
- When a creation is refused because a quota is full, the owner receives a notification suggesting an upgrade or freeing a slot.
A request the plan does not allow is refused with one of these error codes:
| Error code | When |
|---|---|
RealmLimitExceeded, ClientLimitExceeded, UserLimitExceeded, ConsumerLimitExceeded, SecretLimitExceeded | Creating one more than the quota allows |
ResourceServerLimitExceeded, ConnectionLimitExceeded, ConnectionExchangeLimitExceeded, AiRunLimitExceeded | Going past an integration or AI quota |
SeatLimitExceeded | Inviting someone with no seat free |
NoActiveSubscription | Creating realms, clients, users, consumers or secrets without a trial or an active subscription, including while a payment is overdue |
AuthLayoutNotIncluded | Changing a client’s sign-in appearance on a plan without that capability |
McpIntegrationNotIncluded, ConnectedAccountsNotIncluded | Using MCP integration or connected accounts on a plan without them |
Every code is listed in Error codes.
Usage-based billing
On a usage-based plan, Authio counts billable authentication events and reports each one to Stripe, which adds them to your invoice at the plan’s price per event.
| Event | Counted |
|---|---|
| A successful sign-in that opens a session | Yes, once |
A token issued with the password grant | Yes |
A token issued with the client_credentials grant | Yes |
| Refreshing tokens within a session | No |
| A failed attempt | No |
Nothing is counted during the free trial or for sign-ins to the console itself. Authio also keeps its own record of every event by realm, so Usage by Realm on the Subscription screen shows which realms the events and the estimated cost of the current period come from. The period follows your subscription’s monthly cycle.
Welcome credit
New accounts start on the free trial and receive no credit on their first purchase. Accounts that received a promotional credit before keep it: Stripe applies it to the usage charges on their invoices until it runs out, and the dashboard and the Subscription screen show how much was granted, how much is left and, when it has one, the date it applies until.
Managing the subscription
Once a paid plan is active, the owner’s Manage Subscription button on the Subscription screen opens the Stripe billing portal, where the owner updates the card, downloads invoices and manages or cancels the subscription. The portal returns to the Subscription screen when you are done, and what you change there reaches the console as soon as Stripe reports it.
The Subscription screen also raises the one condition that needs attention first: a failed payment, an unsettled balance, an expired or expiring card, or access about to end.
Plans can cap the number of team seats. Members and open invitations both hold a seat, and on a plan with a seat quota the number of seats in use is also reported to Stripe. See Team and access.
When a subscription lapses
Authio checks the account’s subscription on every sign-in and token request to your realms, so a change in its status takes effect without delay:
| Subscription status | Sign-in and tokens for your users | MCP integration and connected accounts | Creating realms, clients, users and secrets |
|---|---|---|---|
| Trial or active | Allowed | Allowed when the plan includes them | Allowed within the quotas |
Payment overdue (past_due) | Allowed during a grace period | Allowed during the same grace period | Refused |
Unpaid (unpaid) | Allowed during the grace period | Stopped | Refused |
| Canceled, paused, incomplete or none | Paused | Stopped | Refused |
While sign-in is paused, the hosted login and the token endpoint answer with AccountNotEntitled: the subscription behind the application is not active. When the subscription is canceled or paused and nothing else covers the account, every member’s console access is removed and their sessions end.
Nothing is deleted: realms, clients, users, keys and the audit trail stay as they were, and signing keys and secrets keep working when the account comes back. Connected accounts are the exception — they are kept, unusable, for a retention period and removed after it.
Reactivate the account
Ask for a link
Open Reactivate and enter your account email; signing in to a lapsed account also leads there. If the address belongs to an account with no active plan, a link to choose one is sent to it, valid for 24 hours. The answer on screen is the same for any address.
Choose a plan and pay
The link opens the plans on sale and the embedded checkout.
Sign in again
Once Stripe confirms the payment, the owner signs in and finds the account as it was. The payment reactivates the owner only; members who were deactivated when access ended are not reactivated automatically.
The Dedicated plan
The Dedicated plan buys an environment of Authio for your account alone — its own API, console, database and cache — instead of space on the shared platform. It is sold differently:
- No trial. You pay when you sign up, before your first sign-in.
- Flat price. A fixed price per term, whatever the traffic. There is no usage metering.
- Payment starts the environment. Provisioning begins as soon as Stripe confirms the payment, and the owner receives an email when the environment is ready.
- No realms on the shared platform. Realms and clients are created in your environment’s own console; creating them on the shared console is refused with
SharedTenancyNotIncluded.
Choose the plan
On the pricing page, choose Subscribe now on the Dedicated plan.
Create the account
Sign up as the founder. The account is created inactive and cannot sign in until the payment goes through.
Pay
Complete the payment in the checkout that follows. If the page loses track of your sign-up, for example after a refresh, Send me a payment link emails you a link that picks the payment up again. Signing in before paying shows Payment pending, with Finish the payment leading to the same link.
Follow the provisioning
Sign in. The console opens on Environment, which shows each building block of the environment as it is put in place, until the environment is ready.
If the subscription ends, the environment is suspended: its services stop and its data is kept for a grace period. The owner is told the date it will be deleted and reminded before it; subscribing again before that date starts the environment as it was. See Provisioning and lifecycle.