This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of October 21, 2026. Spotted a mistake? Tell us.
Customer identity and access management (CIAM) is the part of identity that faces your customers: how they sign up, sign in, recover their account and manage their profile in your apps, and how you keep those accounts secure. Workforce IAM does the same job for employees and contractors.
The technology underneath is the same (OpenID Connect, OAuth 2.0, SAML, MFA), but the priorities are different.
CIAM vs workforce IAM
| Workforce IAM | CIAM | |
|---|---|---|
| Users | Employees and contractors, hundreds to tens of thousands | Customers, thousands to millions |
| Who creates accounts | IT, often synced from HR or a directory | Users themselves, through sign-up |
| Sign-in | Company IdP, MFA required by policy | Social login, passwordless, passkeys, with MFA where it doesn't drive users away |
| Main goal | Control and compliance | Conversion and security without friction |
| Branding | The vendor's portal is fine | Must look like your product, on your domain |
| Typical pricing | Per user per month | Per monthly active user (MAU), or flat |
What a CIAM platform needs
- Self-service sign-up and sign-in with a form you control: which fields are required, email or phone verification, terms acceptance.
- Social and passwordless login: Google, Apple, GitHub and regional providers; email or SMS codes, magic links and passkeys.
- Adaptive security: MFA, CAPTCHA, limits on failed sign-ins, and breached-password checks, applied without making every sign-in painful.
- Branded, hosted pages on your own domain, or APIs if you build the screens yourself.
- Account self-service: profile, password reset, connected accounts, MFA devices, sessions.
- B2B organizations: if your customers are companies, each needs its own users, roles and admins, and often its own SSO through the customer's IdP. This is sometimes called B2B CIAM.
- Standard protocols and SDKs, so every app (web, mobile, partner integrations) uses the same accounts.
- Privacy and consent: data residency, export and deletion on request, and records of what users agreed to.
How CIAM is priced
Most hosted CIAM services charge per monthly active user, with a free tier and higher rates for enterprise SSO users or extra connections. That is cheap at the start and can grow quickly with success, which is why teams compare per-MAU pricing with flat pricing or self-hosting. See our auth pricing comparison and dedicated managed identity providers for the numbers.
Open-source CIAM with Casdoor
Casdoor is an open-source IAM and CIAM platform: the same server can run sign-in for your customers and single sign-on for your employees, in separate organizations.
For customer identity it gives you hosted sign-up and sign-in pages that you brand per application (themes, custom CSS, your own domain), configurable sign-up fields, social login with dozens of providers, email and SMS codes, magic links, passkeys, TOTP and SMS MFA, CAPTCHA providers and limits on failed sign-ins. For B2B apps, each customer can be an organization with its own users, roles, admins and SAML or OIDC identity provider. Apps connect over OIDC, OAuth 2.0 or SAML, with SDKs for most languages.
Self-host it for free, or run it on Casdoor Cloud: a dedicated instance from $24/month billed yearly, with no per-user fees. See also What is SSO and open-source IAM.
FAQ
Is CIAM the same as CIAM software like Auth0? Auth0, Cognito, Firebase Authentication, Entra External ID and similar services are CIAM products. CIAM is the category.
Can one platform do both IAM and CIAM? Yes, if it separates the two populations. In Casdoor they're separate organizations in one instance, with their own sign-in policies and branding.
Do customers need MFA? Offer it to everyone and require it for sensitive actions or high-value accounts. Passkeys give strong security with less friction than codes.
What is B2B CIAM? Customer identity where the customers are businesses: organizations, roles inside each organization, and SSO through each customer's own identity provider.
Sources
Product names are trademarks of their respective owners.