# Ory vs BuildBase: priced per daily user, assembled per service

> Ory bills per average daily active user and ships as four services you run yourself. What that converts to, where Ory wins outright, and when BuildBase is the wrong shape for the job.

- Source: https://www.buildbase.app/compare/ory-vs-buildbase
- Section: Comparisons
- Author: Dharmendra Jagodana
- Published: 2026-10-31

## In short

Ory is an Apache-2.0 identity stack - Kratos, Hydra, Keto, Oathkeeper - you run yourself, or Ory Network at $770 a year with $21 of monthly credit at $0.14 per average daily active user. BuildBase is 20 modules on one instance, free for 10,000 monthly active users and $19 on Launch for 25,000.

Ory does not sell you a monthly active user.

That reads like a quibble until you try to budget. Ory Network meters average
daily active users, the average daily count of unique people who call the
Identities APIs, and every auth comparison you have read is written in MAU,
including the ones on this site. So the first job with an Ory quote is working
out what it says in the unit you actually hold. Nobody does that conversion for
you, and no pricing page can do it honestly: it depends on how often your users
come back.

## Which one should you pick

Pick Ory if your backend is not JavaScript, if you need to be an OAuth 2.0
provider that other people's software federates to, or if running the thing
yourself under a permissive licence outranks every other requirement. Pick
BuildBase if the login box is the small half of the problem and the real work is
workspaces, roles, plans, quotas and the mail that goes with them. Past the
sign-in form these two barely overlap, which both pricing pages make harder to
see than it should be.

## What you are choosing between

Ory is a set of services, not a product you install. Kratos holds identities and
runs the self-service flows around them: login, registration, verification,
recovery and profile, against an identity schema you define yourself.
Hydra is the OAuth 2.0 and OpenID Connect provider. Keto does permissions as
Zanzibar-style relationship tuples, sold on the Network as Ory Permissions.
Oathkeeper sits in front of your APIs as an identity-aware proxy, and Polis
bridges SAML into OAuth 2.0 and OIDC and speaks SCIM 2.0. You take the ones you
need and you operate them.

BuildBase starts from the workspace instead of the session. Someone signs in,
belongs to workspaces with roles, and each workspace carries a plan, quotas,
credits and invoices. Authentication is one of 20 modules on a single instance.
PlugNode, one of six products of ours that run on it, uses auth, team workspaces
with role-based access control, Stripe billing and usage-based credit metering
out of the same records.

So Ory asks how identity should work and hands you a lot of rope. BuildBase
assumes identity is settled and asks what the account does afterwards.

## What Ory Network costs, verified 31 October 2026

Four tiers, two published prices.

**Developer** is free: no usage metering, one member, two development
environments, and no production or staging environment at all, which makes it a
tier for building rather than shipping. **Production** is $770 a year and carries
$21.00 of included monthly usage credit, one production environment, three
staging, five development and one custom domain. **Growth** is $9,350 a year
with $255.00 of monthly credit, two production environments, five staging,
twenty development and up to three organizations. **Enterprise** is contact-only.

Three things are metered, and none of them is a monthly active user:

- Average daily active users: $0.14 on Production, $0.12 on Growth
- Machine-to-machine tokens from the client credentials flow: $0.007 and $0.006
  per token per month
- Permission checks against the Permissions API: $0.000090 and $0.000085 per
  check per month

Now do the arithmetic the page leaves to you. That $21.00 of credit at $0.14
covers 150 average daily active users before a usage charge appears, and $770 a
year is about $64 a month. On Growth, $255.00 at $0.12 is roughly 2,125. Whether
150 daily actives is a lot depends entirely on your product.

What happens past the credit is the part the page does not say. It publishes the
rates and it publishes the credit; it does not state how usage above the credit
is billed. Monthly-billed figures for Production and Growth are not shown
either. Plan with the annual numbers and treat them as a floor.

Read the tier table before the price, though, because the gating is where this
gets decided. One-click SAML, SCIM directory sync, multi-tenant production
environments and multi-brand projects are Enterprise only. B2B SSO on Growth is
OIDC and not SAML. B2B organizations start on Growth and stop at three. Every
Ory tier, the free one included, carries MFA with hardware keys, the
fine-grained Permission API, and OAuth 2.0 client credentials, authorization
code, token rotation and the OIDC provider. Ory also publishes a 99.99% SLA on its
Enterprise tier.

Our side is our own published pricing, last checked against the production
plans on 31 October 2026. Free is $0 with 10,000 monthly active users, 50
workspaces, 1 GB of storage and 2 team seats, and it stops at its allowance.
Launch is $19 a month with 25,000 monthly active users, 1,000 workspaces, 10 GB
of storage and 3 team seats. Grow is $49 with 100,000 and Scale is $99 with
500,000. The paid plans start with a 7-day trial that does not ask for a card.
Yearly billing is ten months for twelve. On the paid plans three things bill
over their allowance: workflow runs at $0.25, $0.15 or $0.10 per 1,000, web
analytics events at $2 per 100,000, and storage at $0.10 per GB-month. On uptime we publish
no number: targets vary by plan, which is less than Ory offers its Enterprise
customers.

> **Key takeaway:** There is no table in this post putting those two columns side by side in
> dollars, and you should distrust any post that builds one. A monthly active user
> and an average daily active user count different things. The ratio between them
> is a property of your product, and only you can measure it.

## What self-hosting Ory gives you, and what it does not

The binaries are free and unmetered. Kratos, Hydra, Keto, Oathkeeper and Polis
are Apache-2.0 on Ory's own open source page and on GitHub, and no licence fee
attaches to running them at any user count. That is real, and no pricing change
next year takes it back.

Then read the Kratos README. It describes an Ory Enterprise License, a paid
self-hosted edition adding features the free build does not have, SCIM and SAML
named among them, plus CVE patches under an SLA, advanced scaling and
multi-tenancy, premium support and a private Docker registry. Ory's open source
page positions the free build for evaluation and prototyping, and marks it as
lacking CVE security patching and production Helm charts.

Ory's own pages pull in two directions here. Polis ships SAML and SCIM 2.0
under Apache-2.0, the same two the Kratos README puts behind the Enterprise
License. Both are Ory properties. The Enterprise License carries no published
price, so there is no figure to quote. Which of those two shapes Ory is depends
on the build you run, and [the difference between self-hosted and open
source](/blog/self-hosted-vs-open-source) is worth settling before you commit
to either. Paid add-ons over a free self-hosted core are a common arrangement,
and [SuperTokens prices the same one in
public](/compare/supertokens-vs-buildbase): multi-factor sign-in, account
linking and multi-tenancy are paid there on self-hosted installs too, and two of
the three carry a monthly minimum whatever your user count. Read the figures off
their pricing page rather than off this one, because they were last checked for
that post and not for this one.

Ours is a smaller promise. There is no free self-hosted tier: self-hosting is
arranged by talking to us, priced per installation, and that price is not on
sale, so there is no number to give you there either. Once it is set up, you
create the installation in the dashboard, deploy the compose file with Docker,
and the installation checks in. Ory's floor is clone and run; ours is a
conversation first, then an installation that phones home. [The real cost of self-hosting against a managed
service](/blog/self-host-vs-managed-cost) prices the hours either way.

## Sign-in, SSO and permissions

The two method lists are not comparable, because they are not the same kind of
list. BuildBase ships a fixed set you switch on: email and password, magic
links, email codes, phone codes, passkeys, Google, LinkedIn, GitHub, Microsoft,
Apple, one OpenID Connect or OAuth 2.0 provider of your own, Ethereum and Solana
wallets, and Enterprise SSO. Around those sit guest users, usernames, device
code sign-in and Google One Tap, which are ways of using the methods rather than
methods themselves. Separately, every app is an OAuth 2.0 authorization server,
which is how agents and third-party apps get access.

Kratos gives you flows and an identity schema and leaves the list to what you
configure. Hydra is what makes you an OAuth 2.0 and OpenID Connect provider for
other people's software, and nothing on our side claims to be that. Agent access
is not the same product as being the identity provider a partner federates to,
and a comparison that blurs the two is doing you no favours.

Enterprise SSO is where the stories rhyme. BuildBase sells SAML and OIDC sign-in
and Directory Sync (SCIM) on the Enterprise plan, through your own WorkOS
account: a customer's IT admin connects their provider from a setup link,
verified domains send each person to their company sign-in, single sign-on can be
required per company, and directory groups map to roles. Ory puts one-click SAML
and SCIM on its Enterprise tier, with OIDC-only B2B SSO on Growth. Both products
charge for the thing your buyer's security review will ask about. The
[WorkOS comparison](/compare/workos-vs-buildbase) goes through what that
arrangement costs on our side, and [best auth for B2B
SaaS](/compare/best-auth-for-b2b-saas) sorts the wider field by whether you need
it this quarter.

Permissions is the one place Ory models something roles cannot. Keto works in
relationship tuples between objects and subjects, metered at $0.000090 per check
on Production. Ours is role-based at the organization and workspace level, with
custom permissions, role-scoped API keys and three-tier resolution, which
[what RBAC actually is](/blog/what-is-rbac) covers. Ask whether someone may read
a document because their team owns the folder it sits in. Ory models that.
Roles cannot.

| Feature | BuildBase | Ory |
| --- | --- | --- |
| Licence | Proprietary SDK and platform | Apache-2.0 core; paid Enterprise License for self-hosted SCIM and SAML |
| Free tier | Free plan, 10,000 MAU; 7-day trial on paid plans, no card | Developer tier free, but no production environment |
| What gets metered | Monthly active users, 25,000 on Launch | Average daily active users, M2M tokens, permission checks |
| Published entry price | $0 (Free), then $19/mo (Launch) | $770/yr, about $64/mo, plus $0.14 per aDAU past $21.00 of credit |
| Languages | TypeScript and JavaScript | Nine official SDKs plus a REST API |
| Enterprise SSO and directory sync | Enterprise plan, through your own WorkOS account | Enterprise tier; OIDC-only B2B SSO on Growth |
| Permissions model | Roles at org and workspace level, custom permissions | Zanzibar relationship tuples, billed per check |
| OAuth 2.0 provider for third parties | Authorization server for agents and connected apps | Hydra, a general-purpose OAuth 2.0 and OIDC provider |
| Billing, email, workflows | Included, 20 modules on one instance | Not part of the product |
| If you run it yourself | One compose file: server, client app, auth portal, Mongo, Redis | Kratos, Hydra, Keto, Oathkeeper and Polis, as needed |

> **Where Ory wins:** **Nine official SDKs, against one.** Ory publishes TypeScript, Go, Python, Java,
> PHP, Dart, Ruby, C# and Rust, plus a documented REST API. Our SDK is TypeScript:
> Next.js, Vite, React Router / Remix and TanStack Start on the front end, Express,
> NestJS, Fastify, Hono and Astro on the server. A Django or Go API is a
> straightforward Ory install and not a BuildBase one at all. This is the biggest
> honest gap between the two, and no module count closes it.
>
> **Apache-2.0 you can run forever.** Kratos, Hydra, Keto, Oathkeeper and Polis
> carry a permissive licence, which means you clone them, run them, and never have
> a vendor in the loop or a per-installation fee to renew for the life of the
> deployment. Self-hosting here is arranged with us, per installation, and each
> installation checks in with our dashboard. That is a smaller promise. When owning the
> deployment outright is the first requirement, Ory settles the comparison before
> anything else gets discussed.
>
> **A free tier that does real work.** Ory's Developer tier costs nothing, meters
> nothing, and still carries MFA, the fine-grained Permission API and the OAuth 2.0
> provider flows. It has no production environment, so it is a building tier rather
> than a shipping one. Ours is a Free plan with 10,000 monthly active users that
> stops at its allowance, without every feature the paid plans carry. Both are
> free; Ory's gives you more of its feature list for nothing.
>
> **Relationship-based permissions.** Keto expresses authorization that roles
> cannot reach, like a grant that exists because a team owns a parent object. If
> your access model is shaped that way, Ory has the product and we do not.
>
> **A published uptime SLA.** Ory commits to one on its Enterprise tier. Our
> targets vary by plan and we publish no figure, which is a weaker answer to the
> same question.

## How to decide

Two questions end this outright, and if either lands you can stop reading.

Is your backend JavaScript? If not, Ory is the only one of the two you can
adopt, and nothing further matters. Does a contract require you to run identity
on your own hardware under a licence nobody can revoke? Then Ory again, with the
Enterprise License question parked until you know whether you need SCIM in the
self-hosted build.

If neither lands, the question becomes what you are really buying. An identity
stack is not an account system. Ory will hold your users, federate your OAuth
clients and answer permission checks, and it will not invoice anyone, enforce a
quota, send a campaign or run a workflow, because it was never meant to. Those
stay yours to build and maintain, and [the cost of building auth
yourself](/blog/cost-of-building-auth-yourself) is the sibling arithmetic for
the half Ory does cover. If the workspace that signs in is also the record that
gets billed, a bundle removes a mapping you would otherwise own for the life of
the product. That is the trade, and it cuts both ways: fewer agreements to keep,
less freedom to swap one piece out.

## Sources

Ory figures verified 31 October 2026 against Ory's own pages. `ory.sh` now
redirects to `ory.com`.
[ory.com/pricing](https://www.ory.com/pricing/) for the four tiers, the $770 and
$9,350 annual prices, the $21.00 and $255.00 monthly credits, the $0.14 and
$0.12 aDAU rates, the machine-to-machine and permission-check rates, the
environment counts, the Enterprise-only SAML and SCIM gating, the OIDC-only B2B
SSO on Growth and the Enterprise SLA.
[ory.com/open-source](https://www.ory.com/open-source/) for the Apache-2
licensing of Hydra, Kratos, Polis, Keto and Oathkeeper and the evaluation
positioning of the free build.
[github.com/ory/kratos](https://github.com/ory/kratos) for the Ory Enterprise
License description, and [github.com/ory/polis](https://github.com/ory/polis)
for the SAML and SCIM 2.0 bridge under Apache-2.0.
[ory.com/docs/sdk](https://www.ory.com/docs/sdk) for the nine official SDKs.

BuildBase plans, modules and sign-in methods come from our own constants, last
checked against the production plans on 31 October 2026 (PLAN_FACTS).