Pricing

Free to build. Flat to run. Published overage.

Three hosted plans and a short list of add-ons. Every number on this page is generated from the same catalogue that meters your account.

Developer

$0forever

Build and evaluate — the whole platform, sized for development.

Start free

Included volumes

MAU10,000

Organizations10

Enterprise connections1

Active agents / mo10

M2M tokens / mo1,000

Custom domains0

Audit log3 days

Highlights

✓Email / password, magic link, OAuth 2.1 & OIDC
✓Passkeys / WebAuthn
✓TOTP, backup codes & adaptive MFA
✓SMS one-time codes (bring your own provider)
✓Social login (10 providers)
✓Push authentication (LumoAuth app)

Authentication

✓Email / password, magic link, OAuth 2.1 & OIDC
✓Passkeys / WebAuthn
✓TOTP, backup codes & adaptive MFA
✓SMS one-time codes (bring your own provider)
✓Social login (10 providers)
✓Push authentication (LumoAuth app)
—Custom domain
—Remove "Secured by LumoAuth" badge
—Custom CSS & HTML login page
—AI login theme generation
—Custom email templates
—LDAP / Active Directory
—SAML identity provider for your apps
—CIBA (backchannel authentication)
—DPoP sender-constrained tokens
—FAPI 2.0 security profile
—mTLS certificate-bound tokens

Attack protection

✓Lockout, rate limits, login-velocity signals
✓CAPTCHA (Turnstile, hCaptcha, reCAPTCHA)
✓Breached-password checks
+Full adaptive-auth risk engine (add-on: Fraud Shield)
+Managed IP reputation (VPN / proxy / Tor / hosting) (add-on: Fraud Shield)
—Attack-campaign detection & automated response

Authorization

✓Roles, permissions & groups
✓Groups
—Attribute-based access control
—Relationship-based access control (Zanzibar)

AI agents

✓AI agent registry & workload identity
✓AAuth cryptographic agent identity
—Workload identity attestation (AWS, GCP, Azure, Kubernetes, SPIFFE, CI/CD)
✓MCP server authorization
✓Client ID Metadata Documents (URL-based client identity, on by default)
✓Ask API
✓Agent kill switch
—Just-in-time agent permissions
—Human approval in Slack, Teams, ServiceNow, Jira
—Token vault for outbound credentials
—Delegation chains (token exchange)
—Agent budgets

Enterprise & platform

✓Webhooks
—Tenant Admin API
—Ephemeral sandbox organizations (lumo dev start)
—Self-service admin portal for your B2B customers
—SCIM outbound provisioning
—HRIS sync (BambooHR, Workday, Rippling, …)
—Device posture (CrowdStrike, Intune, Jamf, Kandji)
—Shared Signals (CAEP / RISC) in and out
+Security alerts to Slack, Teams, PagerDuty, Opsgenie (add-on: Fraud Shield)
—SIEM & log streaming (14 destinations)
—Analytics export (Segment, Mixpanel, Amplitude, PostHog)
—CRM sync (Salesforce, HubSpot)
✓Consent records & data-subject requests
—Full GDPR suite (ROPA, DPIA, breach)
—Bring-your-own signing keys (19 KMS / HSM providers)
—SSO for portal admins
—99.9 % uptime SLA

Pro

$49per month

Ship to production — custom domain, branding, full webhooks.

Start with Pro

Included volumes

MAU25,000 + $0.02 ovg

Organizations100 + $1 ovg

Enterprise connections1 + $75 ovg

Active agents / mo100 + $0.05 ovg

M2M tokens / mo10,000 + $0.0025 ovg

Custom domains1

Audit log30 days

Highlights

✓Email / password, magic link, OAuth 2.1 & OIDC
✓Passkeys / WebAuthn
✓TOTP, backup codes & adaptive MFA
✓SMS one-time codes (bring your own provider)
✓Social login (10 providers)
✓Push authentication (LumoAuth app)

Authentication

✓Email / password, magic link, OAuth 2.1 & OIDC
✓Passkeys / WebAuthn
✓TOTP, backup codes & adaptive MFA
✓SMS one-time codes (bring your own provider)
✓Social login (10 providers)
✓Push authentication (LumoAuth app)
✓Custom domain
✓Remove "Secured by LumoAuth" badge
✓Custom CSS & HTML login page
✓AI login theme generation
✓Custom email templates
—LDAP / Active Directory
+SAML identity provider for your apps (add-on: SAML identity provider)
—CIBA (backchannel authentication)
✓DPoP sender-constrained tokens
—FAPI 2.0 security profile
—mTLS certificate-bound tokens

Attack protection

✓Lockout, rate limits, login-velocity signals
✓CAPTCHA (Turnstile, hCaptcha, reCAPTCHA)
✓Breached-password checks
+Full adaptive-auth risk engine (add-on: Fraud Shield)
+Managed IP reputation (VPN / proxy / Tor / hosting) (add-on: Fraud Shield)
—Attack-campaign detection & automated response

Authorization

✓Roles, permissions & groups
✓Groups
+Attribute-based access control (add-on: Fine-grained authorization)
+Relationship-based access control (Zanzibar) (add-on: Fine-grained authorization)

AI agents

✓AI agent registry & workload identity
✓AAuth cryptographic agent identity
+Workload identity attestation (AWS, GCP, Azure, Kubernetes, SPIFFE, CI/CD) (add-on: Workload identity)
✓MCP server authorization
✓Client ID Metadata Documents (URL-based client identity, on by default)
✓Ask API
✓Agent kill switch
+Just-in-time agent permissions (add-on: Agent Governance)
+Human approval in Slack, Teams, ServiceNow, Jira (add-on: Agent Governance)
+Token vault for outbound credentials (add-on: Agent Governance)
+Delegation chains (token exchange) (add-on: Agent Governance)
+Agent budgets (add-on: Agent Governance)

Enterprise & platform

✓Webhooks
✓Tenant Admin API
—Ephemeral sandbox organizations (lumo dev start)
+Self-service admin portal for your B2B customers (add-on: B2B self-service portal)
—SCIM outbound provisioning
—HRIS sync (BambooHR, Workday, Rippling, …)
—Device posture (CrowdStrike, Intune, Jamf, Kandji)
—Shared Signals (CAEP / RISC) in and out
+Security alerts to Slack, Teams, PagerDuty, Opsgenie (add-on: Fraud Shield)
+SIEM & log streaming (14 destinations) (add-on: Audit & Compliance)
✓Analytics export (Segment, Mixpanel, Amplitude, PostHog)
✓CRM sync (Salesforce, HubSpot)
✓Consent records & data-subject requests
+Full GDPR suite (ROPA, DPIA, breach) (add-on: Audit & Compliance)
—Bring-your-own signing keys (19 KMS / HSM providers)
—SSO for portal admins
—99.9 % uptime SLA

Buy only the extras you need.

Each add-on names the plans it is available on and whether a plan already includes it.

Fraud Shield

$49/mo incl. 10,000 MAU, then usage

Full adaptive-auth signals, tunable risk policy and LumoAuth's managed IP reputation.

On Developer, Pro, Business 14-day trial, no card

Agent Governance

$149/mo

JIT permissions with human approval, token vault, delegation chains and agent budgets.

On Pro Included in Business

Audit & Compliance

$99/mo

One-year audit retention, a log stream and the full GDPR suite.

On Pro, Business

Fine-grained authorization

$99/mo

Attribute-based policies (ABAC) and relationship-based access control (Zanzibar ReBAC).

On Pro, Business

B2B self-service portal

$99/mo

Let your customers' admins manage their own members, roles and invitations at /b2b.

On Pro Included in Business

Workload identity

$99/mo

Secretless agents — attest from AWS, GCP, Azure, Kubernetes, SPIFFE and CI/CD platforms. GitHub Actions stays free.

On Pro Included in Business

SAML identity provider

$99/mo

Sign users into SAML-only apps such as Salesforce, Box and Slack with LumoAuth as the IdP.

On Pro Included in Business

Threat Detection

$199/mo

Campaign detection, automated responses, attacker network and agent anomaly detection.

On Business Needs Fraud Shield

Bring-your-own signing keys

$299/mo

Sign tokens with keys held in your KMS or HSM.

On Business

Developer sandboxes

$199/mo

Spawn throwaway sandbox organizations for branch previews, PR environments and CI from the CLI or the Admin API.

On Business

Volume packs and extras

Prepaid blocks below the overage rate. The more blocks you buy, the lower the unit price.

Additional MAU

$300 → $200/mo per block of 25,000 monthly active users (volume pricing)

Prepaid MAU at $0.012 → $0.008 each instead of $0.015 overage.

On Business

Additional active agents

$25 → $16/mo per block of 1,000 monthly active agents (volume pricing)

Prepaid agents at $0.025 → $0.016 each instead of $0.03 overage.

On Business

Additional M2M tokens

$160 → $100/mo per block of 100,000 machine-to-machine tokens (volume pricing)

Prepaid tokens at $0.0016 → $0.0010 each instead of $0.002 overage.

On Business

Additional log stream

$99/mo each

On Pro, Business

Additional custom domain

$20/mo each

On Pro, Business

Full breakdown

Every feature, every plan.

✓ included · + available as an add-on · ◐ limited · — not available

Feature	Developer	Pro	Business
Volumes
MAU	10,000	25,000 + $0.02 ovg	100,000 + $0.015 ovg
Organizations	10	100 + $1 ovg	1,000 + $0.5 ovg
Enterprise connections	1	1 + $75 ovg	10 + $60 ovg
Active agents / mo	10	100 + $0.05 ovg	2,500 + $0.03 ovg
M2M tokens / mo	1,000	10,000 + $0.0025 ovg	100,000 + $0.002 ovg
Custom domains	0	1	3
Audit log	3 days	30 days	90 days
Authentication
Email / password, magic link, OAuth 2.1 & OIDC	✓	✓	✓
Passkeys / WebAuthn	✓	✓	✓
TOTP, backup codes & adaptive MFA	✓	✓	✓
SMS one-time codes (bring your own provider)	✓	✓	✓
Social login (10 providers)	✓	✓	✓
Push authentication (LumoAuth app)	✓	✓	✓
Custom domain	—	✓	✓
Remove "Secured by LumoAuth" badge	—	✓	✓
Custom CSS & HTML login page	—	✓	✓
AI login theme generation	—	✓	✓
Custom email templates	—	✓	✓
LDAP / Active Directory	—	—	✓
SAML identity provider for your apps	—	+ (add-on: SAML identity provider)	✓
CIBA (backchannel authentication)	—	—	✓
DPoP sender-constrained tokens	—	✓	✓
FAPI 2.0 security profile	—	—	✓
mTLS certificate-bound tokens	—	—	✓
Attack protection
Lockout, rate limits, login-velocity signals	✓	✓	✓
CAPTCHA (Turnstile, hCaptcha, reCAPTCHA)	✓	✓	✓
Breached-password checks	✓	✓	✓
Full adaptive-auth risk engine	+ (add-on: Fraud Shield)	+ (add-on: Fraud Shield)	+ (add-on: Fraud Shield)
Managed IP reputation (VPN / proxy / Tor / hosting)	+ (add-on: Fraud Shield)	+ (add-on: Fraud Shield)	+ (add-on: Fraud Shield)
Attack-campaign detection & automated response	—	—	+ (add-on: Threat Detection)
Authorization
Roles, permissions & groups	✓	✓	✓
Groups	✓	✓	✓
Attribute-based access control	—	+ (add-on: Fine-grained authorization)	+ (add-on: Fine-grained authorization)
Relationship-based access control (Zanzibar)	—	+ (add-on: Fine-grained authorization)	+ (add-on: Fine-grained authorization)
AI agents
AI agent registry & workload identity	✓	✓	✓
AAuth cryptographic agent identity	✓	✓	✓
Workload identity attestation (AWS, GCP, Azure, Kubernetes, SPIFFE, CI/CD)	—	+ (add-on: Workload identity)	✓
MCP server authorization	✓	✓	✓
Client ID Metadata Documents (URL-based client identity, on by default)	✓	✓	✓
Ask API	✓	✓	✓
Agent kill switch	✓	✓	✓
Just-in-time agent permissions	—	+ (add-on: Agent Governance)	✓
Human approval in Slack, Teams, ServiceNow, Jira	—	+ (add-on: Agent Governance)	✓
Token vault for outbound credentials	—	+ (add-on: Agent Governance)	✓
Delegation chains (token exchange)	—	+ (add-on: Agent Governance)	✓
Agent budgets	—	+ (add-on: Agent Governance)	✓
Enterprise & platform
Webhooks	✓	✓	✓
Tenant Admin API	—	✓	✓
Ephemeral sandbox organizations (lumo dev start)	—	—	+ (add-on: Developer sandboxes)
Self-service admin portal for your B2B customers	—	+ (add-on: B2B self-service portal)	✓
SCIM outbound provisioning	—	—	✓
HRIS sync (BambooHR, Workday, Rippling, …)	—	—	✓
Device posture (CrowdStrike, Intune, Jamf, Kandji)	—	—	✓
Shared Signals (CAEP / RISC) in and out	—	—	✓
Security alerts to Slack, Teams, PagerDuty, Opsgenie	+ (add-on: Fraud Shield)	+ (add-on: Fraud Shield)	✓
SIEM & log streaming (14 destinations)	—	+ (add-on: Audit & Compliance)	✓
Analytics export (Segment, Mixpanel, Amplitude, PostHog)	—	✓	✓
CRM sync (Salesforce, HubSpot)	—	✓	✓
Consent records & data-subject requests	✓	✓	✓
Full GDPR suite (ROPA, DPIA, breach)	—	+ (add-on: Audit & Compliance)	✓
Bring-your-own signing keys (19 KMS / HSM providers)	—	—	+ (add-on: Bring-your-own signing keys)
SSO for portal admins	—	—	✓
99.9 % uptime SLA	—	—	✓

The same matrix, with the feature keys used by the API, is published on the docs site. Pricing matrix

Questions

Billing, in plain words.

What counts as a monthly active user?

A distinct person who signs in interactively during the calendar month. Token refreshes do not count. Machine-to-machine tokens and AI agents are metered separately and never count as users.

What happens when I go over a limit?

On the free Developer plan the user limit is a hard cap. On Pro and Business you keep running and pay the published overage price for the extra usage. There is no surprise tier jump.

How are AI agents billed?

By active agents per month: distinct agents that obtained a token. Registered but idle agents cost nothing on paid plans. The free plan includes ten agents; Pro includes 100, Business 2,500, with prepaid packs on Business.

Which features are on the free plan?

Passkeys, magic links, one-time codes, social login, MFA, lockout and rate limits, breached-password checks, CAPTCHA, roles and groups, webhooks, consent records, the agent registry, signed agent requests, one MCP server, the Ask API and the agent kill switch.

Can I buy an add-on on any plan?

Each add-on lists the plans it is available on. Fraud Shield is available on every plan, including Developer, with a 14-day trial. Several add-ons are included in Business.

Where is my data hosted?

In the US or the EU; you pick the region when you create your organization.

Is there an uptime commitment?

The Business plan includes a 99.9% monthly uptime SLA.

Do you offer annual billing?

Yes.

Ship passwordless sign-in this week. Put guardrails on your agents today.

The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.

Start free Talk to us Read the docs