Ory vs BuildBase: priced per daily user, assembled per service

Ory does not sell you a monthly active user.

That reads like a quibble until you try to budget. Ory Network meters average daily active users, the average daily count of unique people who call the Identities APIs, and every auth comparison you have read is written in MAU, including the ones on this site. So the first job with an Ory quote is working out what it says in the unit you actually hold. Nobody does that conversion for you, and no pricing page can do it honestly: it depends on how often your users come back.

Which one should you pick

Pick Ory if your backend is not JavaScript, if you need to be an OAuth 2.0 provider that other people's software federates to, or if running the thing yourself under a permissive licence outranks every other requirement. Pick BuildBase if the login box is the small half of the problem and the real work is workspaces, roles, plans, quotas and the mail that goes with them. Past the sign-in form these two barely overlap, which both pricing pages make harder to see than it should be.

What you are choosing between

Ory is a set of services, not a product you install. Kratos holds identities and runs the self-service flows around them: login, registration, verification, recovery and profile, against an identity schema you define yourself. Hydra is the OAuth 2.0 and OpenID Connect provider. Keto does permissions as Zanzibar-style relationship tuples, sold on the Network as Ory Permissions. Oathkeeper sits in front of your APIs as an identity-aware proxy, and Polis bridges SAML into OAuth 2.0 and OIDC and speaks SCIM 2.0. You take the ones you need and you operate them.

BuildBase starts from the workspace instead of the session. Someone signs in, belongs to workspaces with roles, and each workspace carries a plan, quotas, credits and invoices. Authentication is one of 20 modules on a single instance. PlugNode, one of six products of ours that run on it, uses auth, team workspaces with role-based access control, Stripe billing and usage-based credit metering out of the same records.

So Ory asks how identity should work and hands you a lot of rope. BuildBase assumes identity is settled and asks what the account does afterwards.

What Ory Network costs, verified 31 October 2026

Four tiers, two published prices.

Developer is free: no usage metering, one member, two development environments, and no production or staging environment at all, which makes it a tier for building rather than shipping. Production is $770 a year and carries $21.00 of included monthly usage credit, one production environment, three staging, five development and one custom domain. Growth is $9,350 a year with $255.00 of monthly credit, two production environments, five staging, twenty development and up to three organizations. Enterprise is contact-only.

Three things are metered, and none of them is a monthly active user:

• Average daily active users: $0.14 on Production, $0.12 on Growth
• Machine-to-machine tokens from the client credentials flow: $0.007 and $0.006 per token per month
• Permission checks against the Permissions API: $0.000090 and $0.000085 per check per month

Now do the arithmetic the page leaves to you. That $21.00 of credit at $0.14 covers 150 average daily active users before a usage charge appears, and $770 a year is about $64 a month. On Growth, $255.00 at $0.12 is roughly 2,125. Whether 150 daily actives is a lot depends entirely on your product.

What happens past the credit is the part the page does not say. It publishes the rates and it publishes the credit; it does not state how usage above the credit is billed. Monthly-billed figures for Production and Growth are not shown either. Plan with the annual numbers and treat them as a floor.

Read the tier table before the price, though, because the gating is where this gets decided. One-click SAML, SCIM directory sync, multi-tenant production environments and multi-brand projects are Enterprise only. B2B SSO on Growth is OIDC and not SAML. B2B organizations start on Growth and stop at three. Every Ory tier, the free one included, carries MFA with hardware keys, the fine-grained Permission API, and OAuth 2.0 client credentials, authorization code, token rotation and the OIDC provider. Ory also publishes a 99.99% SLA on its Enterprise tier.

Our side is our own published pricing, last checked against the production plans on 31 October 2026. Free is $0 with 10,000 monthly active users, 50 workspaces, 1 GB of storage and 2 team seats, and it stops at its allowance. Launch is $19 a month with 25,000 monthly active users, 1,000 workspaces, 10 GB of storage and 3 team seats. Grow is $49 with 100,000 and Scale is $99 with 500,000. The paid plans start with a 7-day trial that does not ask for a card. Yearly billing is ten months for twelve. On the paid plans three things bill over their allowance: workflow runs at $0.25, $0.15 or $0.10 per 1,000, web analytics events at $2 per 100,000, and storage at $0.10 per GB-month. On uptime we publish no number: targets vary by plan, which is less than Ory offers its Enterprise customers.

What self-hosting Ory gives you, and what it does not

The binaries are free and unmetered. Kratos, Hydra, Keto, Oathkeeper and Polis are Apache-2.0 on Ory's own open source page and on GitHub, and no licence fee attaches to running them at any user count. That is real, and no pricing change next year takes it back.

Then read the Kratos README. It describes an Ory Enterprise License, a paid self-hosted edition adding features the free build does not have, SCIM and SAML named among them, plus CVE patches under an SLA, advanced scaling and multi-tenancy, premium support and a private Docker registry. Ory's open source page positions the free build for evaluation and prototyping, and marks it as lacking CVE security patching and production Helm charts.

Ory's own pages pull in two directions here. Polis ships SAML and SCIM 2.0 under Apache-2.0, the same two the Kratos README puts behind the Enterprise License. Both are Ory properties. The Enterprise License carries no published price, so there is no figure to quote. Which of those two shapes Ory is depends on the build you run, and the difference between self-hosted and open source is worth settling before you commit to either. Paid add-ons over a free self-hosted core are a common arrangement, and SuperTokens prices the same one in public: multi-factor sign-in, account linking and multi-tenancy are paid there on self-hosted installs too, and two of the three carry a monthly minimum whatever your user count. Read the figures off their pricing page rather than off this one, because they were last checked for that post and not for this one.

Ours is a smaller promise. There is no free self-hosted tier: self-hosting is arranged by talking to us, priced per installation, and that price is not on sale, so there is no number to give you there either. Once it is set up, you create the installation in the dashboard, deploy the compose file with Docker, and the installation checks in. Ory's floor is clone and run; ours is a conversation first, then an installation that phones home. The real cost of self-hosting against a managed service prices the hours either way.

Sign-in, SSO and permissions

The two method lists are not comparable, because they are not the same kind of list. BuildBase ships a fixed set you switch on: email and password, magic links, email codes, phone codes, passkeys, Google, LinkedIn, GitHub, Microsoft, Apple, one OpenID Connect or OAuth 2.0 provider of your own, Ethereum and Solana wallets, and Enterprise SSO. Around those sit guest users, usernames, device code sign-in and Google One Tap, which are ways of using the methods rather than methods themselves. Separately, every app is an OAuth 2.0 authorization server, which is how agents and third-party apps get access.

Kratos gives you flows and an identity schema and leaves the list to what you configure. Hydra is what makes you an OAuth 2.0 and OpenID Connect provider for other people's software, and nothing on our side claims to be that. Agent access is not the same product as being the identity provider a partner federates to, and a comparison that blurs the two is doing you no favours.

Enterprise SSO is where the stories rhyme. BuildBase sells SAML and OIDC sign-in and Directory Sync (SCIM) on the Enterprise plan, through your own WorkOS account: a customer's IT admin connects their provider from a setup link, verified domains send each person to their company sign-in, single sign-on can be required per company, and directory groups map to roles. Ory puts one-click SAML and SCIM on its Enterprise tier, with OIDC-only B2B SSO on Growth. Both products charge for the thing your buyer's security review will ask about. The WorkOS comparison goes through what that arrangement costs on our side, and best auth for B2B SaaS sorts the wider field by whether you need it this quarter.

Permissions is the one place Ory models something roles cannot. Keto works in relationship tuples between objects and subjects, metered at $0.000090 per check on Production. Ours is role-based at the organization and workspace level, with custom permissions, role-scoped API keys and three-tier resolution, which what RBAC actually is covers. Ask whether someone may read a document because their team owns the folder it sits in. Ory models that. Roles cannot.

How to decide

Two questions end this outright, and if either lands you can stop reading.

Is your backend JavaScript? If not, Ory is the only one of the two you can adopt, and nothing further matters. Does a contract require you to run identity on your own hardware under a licence nobody can revoke? Then Ory again, with the Enterprise License question parked until you know whether you need SCIM in the self-hosted build.

If neither lands, the question becomes what you are really buying. An identity stack is not an account system. Ory will hold your users, federate your OAuth clients and answer permission checks, and it will not invoice anyone, enforce a quota, send a campaign or run a workflow, because it was never meant to. Those stay yours to build and maintain, and the cost of building auth yourself is the sibling arithmetic for the half Ory does cover. If the workspace that signs in is also the record that gets billed, a bundle removes a mapping you would otherwise own for the life of the product. That is the trade, and it cuts both ways: fewer agreements to keep, less freedom to swap one piece out.

Sources

Ory figures verified 31 October 2026 against Ory's own pages. ory.sh now redirects to ory.com. ory.com/pricing for the four tiers, the $770 and $9,350 annual prices, the $21.00 and $255.00 monthly credits, the $0.14 and $0.12 aDAU rates, the machine-to-machine and permission-check rates, the environment counts, the Enterprise-only SAML and SCIM gating, the OIDC-only B2B SSO on Growth and the Enterprise SLA. ory.com/open-source for the Apache-2 licensing of Hydra, Kratos, Polis, Keto and Oathkeeper and the evaluation positioning of the free build. github.com/ory/kratos for the Ory Enterprise License description, and github.com/ory/polis for the SAML and SCIM 2.0 bridge under Apache-2.0. ory.com/docs/sdk for the nine official SDKs.

BuildBase plans, modules and sign-in methods come from our own constants, last checked against the production plans on 31 October 2026 (PLAN_FACTS).