NewCasdoor for AI agents: OAuth for MCP servers, Token Exchange and DPoP
Open-source identity platformv4.25.0 released →

Identity for every user, app and AI agent

Casdoor secures how customers, employees and AI agents sign in and what they can access: single sign-on, MFA, passwordless login and fine-grained authorization, on open standards. Run it in your own data center or on a dedicated Casdoor Cloud instance.

Free trialTalk to an expert

$10 free credit to start, then Cloud from $24/month billed yearly with no per-user fees · or self-host for free →

OAuth 2.0 & OIDCSAML 2.0CASLDAP & RADIUSSCIM 2.0WebAuthnMCP
demo.casdoor.com
Casdoor admin console dashboard with user, application and provider totals

Built into products and platforms from leading AI companies, enterprises and Apache projects

Daimler Truck
Tencent
Bosch
LOTTE
CIMB Niaga
CNPC
Korea NDMI
iFLYTEKLobeHubApache APISIXApache DolphinSchedulerSangforApache ShenYuPerconaQiniuOpenCSGApache PulsarTsinghua FIB LabOpenListDeepchecksLerian

Casbin, the authorization engine inside Casdoor, runs in code from

MicrosoftAWSIBMRed HatVMwareIntelToyotaYandexT-MobileOrangeArgo CDMilvusWeaviateOpen edX

Proven in production, on every continent

From start-ups to banks, carmakers and ministries of education, teams run their sign-in on Casdoor, in the cloud or behind their own firewall.

Active login domains
5,000+
with a live Casdoor login page in the last 90 days*
Login page loads a month
1.5M+
across those deployments, September 2026*
Docker pulls
2.4M+
of the official Casdoor images
GitHub stars
14.7k
one of the most-starred open-source IAM projects
75+identity providers
20+official SDKs
23Cloud regions
11UI languages

* Counted from requests to Casdoor's public CDN, July to September 2026. Deployments that host their own assets or run on private networks are not included, so the real numbers are higher.

Capabilities

Everything an identity team needs. Nothing to bolt on.

Casdoor is one server with one console. Every capability below is in the free open-source edition. What each Casdoor Cloud plan includes is compared further down.

demo.casdoor.com/applications/built-in/app-built-in
Casdoor admin console: editing an application, with tabs for authentication, OIDC/OAuth, SAML, providers, UI customization and security

Authentication

  • Hosted, brandable login and sign-up pages
  • Passkeys (WebAuthn), Face ID and magic links
  • TOTP, SMS, email and RADIUS MFA, required per organization
  • 75+ social and enterprise identity providers
  • reCAPTCHA, hCaptcha, Turnstile and GeeTest
  • Password policies with history checks

Single sign-on & protocols

  • OAuth 2.0 and OpenID Connect provider, with PKCE
  • SAML 2.0 IdP with Single Logout and IdP-initiated SSO
  • CAS, LDAP, RADIUS and Kerberos/SPNEGO
  • Upstream OIDC and SAML: Entra ID, Okta, ADFS
  • Device flow, Token Exchange, DPoP, JWT client auth
  • Back-channel and RP-initiated logout

Authorization

  • Casbin models: ACL, RBAC, ABAC or your own
  • Roles, groups and per-resource permissions
  • Single and batch enforce APIs
  • Permissions that expire automatically
  • See which role or group granted each permission
  • Per-tool permissions for MCP servers

Users & directory

  • Organizations with their own users, apps and branding
  • Group trees, invitations and bulk import or export
  • SCIM 2.0 provisioning API
  • Sync from Active Directory, Entra ID, Google Workspace and Okta
  • Keycloak, AWS IAM, SCIM, WeCom, DingTalk, Lark and database syncers
  • Self-service account pages and impersonation for support

Extend & integrate

  • REST API and Swagger docs for every object
  • 20+ official SDKs for web, backend, mobile and desktop
  • Webhooks for sign-ins, sign-ups and changes
  • Marketplace of app integrations, IdP templates and login themes
  • Custom HTML and CSS on login pages
  • Built-in payments, plans and subscriptions
  • Email, SMS, storage and notification providers

Operations

  • Audit records, forwarded to Syslog and your SIEM
  • Session list with device and IP, and session limits
  • Retention settings for records and tokens
  • MySQL, PostgreSQL and other databases
  • Docker, Helm chart and Redis Cluster for HA
  • 11 interface languages

Casdoor Cloud pricing

Simple pricing. No per-user fees.

Every plan is a dedicated, fully managed Casdoor instance. Pay a flat price, not per monthly active user.

Basic

For small teams getting started with a hosted Casdoor.

$29$24/ month

Billed $288 yearly, save 17%

or $0.06 / hour pay-as-you-go

Get Basic
  • Dedicated Casdoor instance and database
  • Unlimited MAU, no per-user fees
  • OIDC, SAML, CAS and SCIM, no per-connection fees
  • Passkeys, MFA and 75+ social providers
  • 1 organization and 10 applications
  • 7-day audit log retention
  • Hosted in Singapore or Japan
  • Support via tickets
Most popular

Premium

For growing start-ups that need their own login domain.

$79$65/ month

Billed $780 yearly, save 18%

or $0.16 / hour pay-as-you-go

Get Premium
  • Everything in Basic
  • Custom domain with managed TLS certificate
  • Remove Casdoor branding, custom HTML and CSS
  • 10 organizations and unlimited applications
  • 90-day audit logs, IP allowlists and impersonation
  • Choose from 23 regions and switch any time
  • 8x5 technical support

Enterprise

For companies running Casdoor in production.

$249$199/ month

Billed $2,388 yearly, save 20%

or $0.50 / hour pay-as-you-go

Get Enterprise
  • Everything in Premium
  • Unlimited organizations and 5 custom domains
  • 1-year audit logs and SIEM forwarding
  • A staging instance included
  • Priority 8x5 technical support
  • Help with onboarding and migration
  • Custom terms and invoicing on request

New accounts get $10 in free credit to try a Basic instance on pay-as-you-go, valid for 30 days. Pay-as-you-go instances are billed by the minute from your prepaid balance.

Casdoor for large organizations

Need on-premises deployment, migration help or custom terms?

We help teams plan self-hosted and private-cloud deployments, migrate users from other identity platforms, design authorization models and agree contracts and invoicing that fit your procurement process.

Contact sales

Prefer to run it yourself? Casdoor is free and open source — self-hosting guide.

Prices in USD. Payments are processed by Stripe. Existing subscribers keep the price they signed up at. Casdoor Cloud is operated by Casbin Inc. See our Terms of Service and Refund Policy.

Plan features

Compare plans. No SSO tax on any plan.

Every plan includes OIDC, SAML, SCIM, passkeys and MFA, with no per-user or per-connection fees. Higher plans add more organizations, your own branding, longer audit logs, security controls and faster support.

Casdoor Cloud plans compared feature by feature
FeaturesBasic$24 / month billed yearlyGet BasicPremium$65 / month billed yearlyGet PremiumEnterprise$199 / month billed yearlyGet Enterprise
Plan
Billed monthly$29 / month$79 / month$249 / month
Billed yearly$24 / month ($288 / year)$65 / month ($780 / year)$199 / month ($2,388 / year)
Pay-as-you-go, billed by the minute$0.06 / hour$0.16 / hour$0.50 / hour
Free trial credit$10 for 30 daysNot includedNot included
Suggested sizeGuidance, never throttledUp to 10,000 MAUUp to 100,000 MAUUp to 500,000 MAU
Organizations110Unlimited
Applications10UnlimitedUnlimited
PaymentCardCardCard, or invoice on request
Hosting
RegionsSingapore or JapanAll 23 regionsAll 23 regions
Move to another regionNot includedIncludedIncluded
Custom domainsNot included15
Staging instanceNot includedNot included1 included
Branding
Custom HTML and CSS on login pagesNot includedIncludedIncluded
Remove "Powered by Casdoor"Not includedIncludedIncluded
Authentication
Require MFA for a whole organizationNot includedIncludedIncluded
MFA through your RADIUS serverNot includedNot includedIncluded
Users & directory
Impersonation for supportNot includedIncludedIncluded
Authorization
ABAC and custom Casbin modelsNot includedIncludedIncluded
Permissions that expire automaticallyNot includedIncludedIncluded
Security & logs
Audit log retention7 days90 days1 year
IP allowlistsNot includedIncludedIncluded
Forward records to Syslog or your SIEMNot includedNot includedIncluded
Developers
Webhooks320Unlimited
Built-in payments, plans and subscriptionsNot includedIncludedIncluded
Support
First response2 business days1 business day4 business hours
8x5 technical supportNot includedIncludedIncluded
Priority supportNot includedNot includedIncluded
Help with onboarding and migrationNot includedNot includedIncluded
Custom termsNot includedNot includedOn request

See all 70 features compared →

Cloud or self-hosted

Same Casdoor. You choose who runs it.

Self-hostedCasdoor Cloud
PriceFree (Apache-2.0)From $24/month billed yearly, flat
SoftwareOpen-source CasdoorThe same open-source Casdoor
Who runs and upgrades itYour teamWe do
RegionYour servers or cloud account23 regions to choose from (Basic: Singapore or Japan)
DomainAny domain you ownyourcompany.casdoor.com, or your own domain on Premium and Enterprise
DatabaseYour MySQL, PostgreSQL or other databaseA dedicated database per instance
SupportCommunity on GitHub and DiscordTickets or 8x5 support, depending on plan
Switch laterMove to Cloud with our helpExport your data and self-host any time

Casdoor Cloud regions

North America

US WestUS EastCanadaMexico

South America

BrazilArgentina

Europe

United KingdomEU (Germany)EU (Norway)EU (Finland)Turkey

Oceania

AustraliaNew Zealand

Middle East

IsraelSaudi ArabiaUnited Arab Emirates

East Asia

JapanSouth Korea

Southeast Asia

SingaporeIndonesiaMalaysiaVietnam

South Asia

India

Basic plans run in Singapore or Japan. Premium and Enterprise plans can use any region and switch later.

FAQ

Frequently asked questions

How is Casdoor different from Auth0, Okta or Keycloak?
Casdoor is open source (Apache-2.0), so you can self-host it for free or use our managed Cloud, and switch between the two. Cloud plans have a flat price with no per-user or per-MAU fees. It speaks more protocols than most alternatives (OAuth 2.0, OIDC, SAML, CAS, LDAP, RADIUS, SCIM), and ships with Casbin for fine-grained authorization instead of leaving permissions to your code.
Can Casdoor secure AI agents and MCP servers?
Yes. Casdoor can act as the OAuth authorization server for your MCP servers: it publishes the metadata MCP clients look for, lets AI clients register themselves (RFC 7591), issues tokens scoped to one server (RFC 8707) and to the tools a user approved, and supports Token Exchange and DPoP. You can also keep a registry of your MCP servers, sync their tools and scan your network for unregistered ones.
Can we migrate from Okta, Keycloak or Active Directory?
Yes. Casdoor has syncers that import users and groups from Active Directory, LDAP, Entra ID, Google Workspace, Okta, Keycloak, AWS IAM, SCIM directories and databases. Because Casdoor speaks OIDC, SAML and CAS, most apps only need a new issuer URL and client credentials. We can help plan larger migrations.
What's the difference between Casbin and Casdoor?
Casbin is an authorization library that you embed in your code to enforce access-control models such as ACL, RBAC and ABAC. Casdoor is a complete identity server with a web console: login, single sign-on, MFA, users and organizations. Casdoor uses Casbin for its permission features.
What's the difference between Casdoor Cloud and the open-source version?
It's the same Casdoor. With Cloud, we host a dedicated instance and database for you, keep Casdoor upgraded, manage HTTPS certificates and give you support. With the open-source version, you run and maintain it yourself.
Which regions can I choose?
You can choose from 23 regions: North America (US West, US East, Canada, Mexico); South America (Brazil, Argentina); Europe (United Kingdom, EU (Germany), EU (Norway), EU (Finland), Turkey); Oceania (Australia, New Zealand); Middle East (Israel, Saudi Arabia, United Arab Emirates); East Asia (Japan, South Korea); Southeast Asia (Singapore, Indonesia, Malaysia, Vietnam); South Asia (India). Basic plans run in Singapore or Japan; Premium and Enterprise plans can use any region and switch later. If your data must stay in a specific country, contact us before you subscribe.
Do you have SOC 2 or ISO 27001 certification?
Casdoor Cloud does not hold SOC 2 or ISO 27001 certification today. Because Casdoor is open source, teams with strict compliance requirements usually self-host it inside their own certified environment, where they control the infrastructure and data.
Can I move from Cloud to a self-hosted deployment later?
Yes. Your instance runs open-source Casdoor, so your data can be exported and imported into your own deployment. Contact us and we'll help with the migration.
How do billing and cancellation work?
Sign up, then create an instance in the console and pay by card through Stripe. Choose a monthly or yearly subscription, charged automatically each period, or pay-as-you-go, billed by the minute from a balance you top up. You can cancel a subscription at any time and your instance stays active until the end of the period you paid for. Payments are non-refundable.
Do you offer consulting, for example on designing authorization?
Yes. We can help you design authorization models, integrate Casdoor with your apps or plan a self-hosted deployment. Contact us for a quote.

Ready to secure your next big move?

Put login, single sign-on, MFA, permissions and AI agent access behind one open-source platform, hosted by us or run by you.

Try Casdoor Cloud free

A dedicated instance in the region you choose, from $24/month billed yearly with no per-user fees.

Free trial

Self-host for free

Run the same Apache-2.0 Casdoor on your own servers with Docker or Kubernetes.

Read the docs

Talk to an expert

Plan a migration, an on-premises rollout or an authorization model with our team.

Contact sales