Okta lists workforce SSO at $6 per user per month for its Starter tier. OneLogin lists $3 for Basic. Both numbers look small — until your seat count moves and identity stops feeling like a fixed cost.
Aerobase doesn’t price that way. The product is open source and self-hosted, and the Basic support plan is $690/month flat, billed annually, with no per-user component. Beyond about 100–230 users (depending on the tier you’d otherwise pick), the per-user clock catches up to the flat plan — and from then on, identity stops scaling with headcount.
This benchmark uses the published prices as of May 17, 2026:
Three products, two different cost models
Aerobase behaves like infrastructure with optional support. Okta and OneLogin behave like subscriptions that rise as identity volume grows.
Flat support pricing. No published per-user fee in the plan itself.
Entry workforce pricing looks small until every new employee adds recurring cost.
Cheapest entry tier, but still indexed directly to workforce growth.
What each vendor actually charges in May 2026
| Plan | Model | Per-User Price | Notes |
|---|---|---|---|
| Okta Starter | Per-user / mo | $6 | Entry workforce SSO |
| Okta Essentials | Per-user / mo | $17 | Adds Adaptive MFA and lifecycle workflows |
| Okta Professional | Custom | quoted | Required for advanced workflows + governance |
| Okta CIAM Enterprise | Base + MAU | $3,000/mo + usage | Customer Identity is priced separately from workforce |
| OneLogin Basic | Per-user / mo | $3 | SSO only |
| OneLogin Essentials | Per-user / mo | $6 | Adds MFA |
| OneLogin Business | Per-user / mo | $10 | Adds advanced policy + lifecycle |
| Aerobase Open Source | Self-host | $0 | Forever; community support |
| Aerobase Basic | Flat support | $690/mo | Annual contract; no per-user fee |
| Aerobase Enterprise | Flat + custom | contact | 24/7 critical incident, dedicated channel |
The structural problem with per-user IAM
The per-user model isn’t unique to Okta and OneLogin — it’s the default across the SaaS-IAM category. The issue isn’t price level; it’s price slope against three growth axes that almost always rise together:
- Workforce identity — every new hire adds a recurring line on the invoice.
- B2B partner access — contractors and partner organizations push the active-user count past the headcount you actually employ.
- Customer identity (CIAM) — Okta’s enterprise CIAM tier alone starts at $3,000/month before usage-based MAU charges, and that base sits on top of whatever workforce contract is already in place.
For finance, the question stops being “what does identity cost?” and becomes “what does identity cost next quarter, given a hiring plan we don’t entirely control?”
What gets more expensive as identity grows
Higher bars mean higher sensitivity to user-count or usage growth.
Where the flat plan catches up — the break-even math
Take Aerobase Basic at $690/month and divide by the per-user list price of the comparable tier. The crossover point is the seat count where the flat plan is at parity with the per-user plan, and below which the per-user vendor is still cheaper:
| Comparison | Break-even seat count |
|---|---|
| Aerobase Basic vs Okta Starter ($6/user) | ~115 users |
| Aerobase Basic vs Okta Essentials ($17/user) | ~41 users |
| Aerobase Basic vs OneLogin Basic ($3/user) | ~230 users |
| Aerobase Basic vs OneLogin Business ($10/user) | ~69 users |
The interesting case is Okta Essentials at $17/user — the tier most workforce buyers end up on, because Starter omits adaptive MFA and lifecycle. At that price point, Aerobase Basic costs less than Okta as soon as the workforce passes 41 people, before any CIAM or partner identity is layered on.
How fast the user meter catches up
Approximate published break-even points versus Aerobase Basic support.
What the break-even math leaves out
The per-user comparison above is generous to the SaaS vendors. A full TCO model on a multi-year horizon should also count:
- CIAM as a separate line item. Okta’s Customer Identity is sold as a base platform ($3,000/mo enterprise) plus MAU-based add-ons — distinct from the workforce contract. Aerobase serves workforce and customer identities from the same self-hosted deployment, so adding external identity doesn’t open a second invoice.
- Partner/B2B seats. Contractors, vendors, and franchisees count as billable users on most SaaS tiers. Self-hosted IAM treats them the same as employees: zero marginal license cost.
- Hosting cost. This is where the comparison gets honest. Aerobase needs a Postgres-backed VM (or pair, for HA). At AWS Graviton list prices, a production HA pair is in the low hundreds of dollars per month. Real, but a single line, not a curve.
- Renewal exposure. Per-user contracts compound. A 20% headcount growth year compounds your IAM bill at the same rate, regardless of whether identity work got any harder.
Aerobase makes commercial sense when…
- User counts are expected to grow more than 20% YoY.
- Customer or partner identities are part of the roadmap, not just employees.
- Self-hosting (on-prem, sovereign cloud, or air-gapped) is a hard requirement.
- Finance has asked for an IAM line item that stops scaling with headcount.
Okta or OneLogin still make sense when…
- The team wants a fully managed SaaS product first, and operating Postgres is a non-starter.
- The environment is small enough that the per-user math stays comfortably below break-even.
- The lowest entry license cost matters more than long-term platform economics.
- There’s no current need for sovereign or air-gapped deployment.
Frequently asked questions
Is Aerobase actually cheaper than Okta and OneLogin?
It depends on the seat count and the Okta or OneLogin tier in play. Against Okta Essentials at $17/user/month, Aerobase Basic is cheaper above ~41 workforce users. Against OneLogin Basic at $3/user/month, the crossover is ~230 users. The flatter the curve, the more sense the support model makes as the org grows.
Does Aerobase charge per user at all?
No. The Basic plan is a $690/month flat support contract, billed annually, with no per-user component. The Open Source plan is free with no user cap. Enterprise adds dedicated channels and SLA tightening, also without per-user metering.
What about customer identity and partner access?
Aerobase serves workforce, customer, and partner identities from the same self-hosted deployment. There’s no separate CIAM contract and no MAU meter. Okta and OneLogin both sell CIAM as a distinct product on top of workforce — Okta’s enterprise CIAM base alone starts at $3,000/month before usage charges.
What does “self-hosted” actually cost to operate?
A production HA pair runs on two small VMs plus a managed Postgres. On AWS Graviton list prices, the infrastructure cost lands in the low hundreds of dollars per month. The Aerobase Basic plan bundles SLA-backed support, a cloud test instance, and a defined monthly consulting allotment.
Bottom line
Aerobase is the simpler pricing story when identity is becoming infrastructure, not just a SaaS line item. Below ~41 seats on Okta Essentials, or ~230 seats on OneLogin Basic, the per-user vendors win on raw price. Above those thresholds, the flat-fee model lines pulls ahead — and the lead widens with every new hire, partner, or customer.
If you want to test the platform directly, start with the free Aerobase download. If you want help sizing support, see the plans page or read the Identity Agent integration-cost analysis.