Duende IdentityServer's cheapest license can't do SAML
Duende IdentityServer is a fine piece of engineering, and if you are a .NET shop it is the obvious place to start. So you open the pricing page, see LITE at $5,750/yr, and think: fair enough for a self-hosted license I fully control.
Then you read the fine print, and two lines quietly rule LITE out for almost every real product.
Line one: LITE is capped at 2 client apps
A "client" in OIDC terms is an application: your web app is one, your mobile app is another, your public API is a third, your internal admin tool is a fourth. Two is not a lot. The moment you split a monolith into a couple of services, or ship a mobile app alongside the web one, you are over the LITE limit.
Going over means moving to STANDARD at $12,500/yr, which covers 10 client apps. So the pricing axis that decides your bill is not how many users you have, or how much value you ship. It is how many apps you happen to run. Break one service into two and your identity bill can more than double, for exactly the same product.
Line two: LITE has no SAML
This is the one that surprises people. Enterprise SSO, the reason most teams reach for a dedicated identity server in the first place, means SAML. And SAML is not on the LITE license at all. It is a STANDARD-tier add-on.
So the honest floor for "I want to sell to enterprises with SSO" is not $5,750. It is STANDARD at $12,500, plus the SAML add-on on top. The cheap tier was never really an option for the job you bought an identity server to do.
And that is before you have run anything
Everything above is just the license. Duende is self-hosted, which is the point and also the cost: you host it, you patch it, you scale it, you keep it secure. The admin portal your customers expect, MFA enrollment, audit logs a security reviewer will actually accept, none of that ships in the box. You build and run those, and that engineering time does not appear on any pricing page.
None of this is a knock on the code. It is a knock on a pricing model that charges you more for splitting your app in two, and puts the one protocol enterprises require behind its second-most-expensive tier.
The Authagonal version
We built the opposite on purpose. SAML, SCIM, MFA, custom domains, audit logs and unlimited OAuth clients are included on every plan, from $29/mo. There is no per-app tax, because the number of client apps you register has nothing to do with what it costs us to run. There is no per-connection SSO fee either, so onboarding your fifth enterprise customer costs the same as your first: nothing extra.
You can host Authagonal's open-source core yourself and pay nothing, or let us run it. Either way, the pricing does not punish you for shipping more software.
Price your own setup
Numbers beat adjectives. Put your real app count and enterprise customers into the calculator and see LITE, STANDARD and Authagonal side by side, with the assumptions shown so you can check the math.