Get started free

Who can open what, decided in one place.

IdRa is a full workforce identity platform: single sign-on, MFA, a directory, lifecycle automation and multi-tenant hosting. It’s free to use, and it speaks the same standards as Okta and answers part of its API.

Get started free Read the docs
Ana opens Payroll
  1. Not on a blocked network
  2. Assigned through the Finance group
  3. Laptop meets the device policy
  4. Confirmed with a passkey

Access allowed

Change the facts. Watch the decision.

This is the order IdRa checks things in when someone opens an app. Try it on a sample Payroll policy.

Network
Assignment
Device
Risk
Signed in with
Access allowed

Every check passed, and a passkey is strong enough for this rule.

System Logallowed: no denial to log

The sample rules: a compliant device at high risk needs a passkey, a compliant device otherwise needs a second factor, and anything else is denied. You write your own, per app.

One platform, from the first sign-in to the last.

Everything shares one directory, one policy engine and one System Log. Nothing is sold as an add-on.

Single sign-on

People open every app from one place, over OIDC, OAuth 2.1 or SAML 2.0, or through the Access Gateway for apps with no sign-in of their own.

My Apps, for one person
  • PayrollSAML 2.0
  • WikiOIDC
  • Support deskOIDC
  • Internal adminAccess Gateway
  • ExpensesSAML 2.0
  • HandbookBookmark

Example apps. One session opens them all.

MFA and adaptive access

Ten authenticators, and rules that ask for stronger proof when the network, device or risk calls for it.

The proof a policy can ask for
  1. PasswordLow-risk apps, from a trusted network
  2. Any second factorAuthenticator app, push, SMS, YubiKey, Duo, RSA
  3. Phishing-resistantPasskeys only. A password plus a security question never counts as MFA

API access management

Authorization servers, custom scopes and access policies for your own APIs.

An access token, decoded
{
  "iss": "https://acme.idra.team/api/auth",
  "aud": "https://api.example.com",
  "scope": "invoices:read",
  "sub": "user_8f3a",
  "exp": 1793404800
}

Example values. Scopes, audience and lifetime come from your authorization server. Check signatures against its JWKS.

Multi-tenant by construction

Each organization gets its own database, address, sign-in keys, policies and System Log, then moves to a domain it has verified.

Three organizations, three databases
  • acme.idra.teamOwn signing keys, policies and System Log
  • globex.idra.teamOwn signing keys, policies and System Log
  • login.example.comOwn signing keys, policies and System Log

Example addresses. A query for one can’t reach another: Postgres keeps them apart.

Coming from Okta? Many of your scripts can come too.

IdRa answers the Okta Management API for users, groups, group rules, apps, authorization servers, policies, zones, event hooks and the System Log. Our tests drive it with Okta’s own Node SDK.

It doesn’t cover the whole API, and we publish exactly where it stops.

See what’s compatible Compare IdRa and Okta
Okta’s Node SDK, pointed at IdRa
const client = new okta.Client({
  orgUrl: "https://acme.idra.team",
  token: process.env.IDRA_TOKEN,
  authorizationMode: "SSWS",
});

const users = await client.userApi.listUsers({
  search: 'profile.email sw "ana"',
});

Free to use. Going open source.

The hosted service costs nothing today. We’re preparing the public repository and its license, which will let you run IdRa on your own servers too, and we’ll link them here once they’re live.

What that meansSee pricing
Price
Free, for every feature on this site
Hosted
Create an organization on idra.team
Self-hosted
Once the repository is public

Good questions to ask an identity provider.

Is IdRa really free?

Yes. There are no tiers or per-user charges, and no feature on this site is held back for a paid plan.

Can it replace Okta today?

It depends on what you use. Core single sign-on, MFA, directory, SCIM and threat protection are here. Custom admin roles, AD and LDAP agents, access certifications and native desktop agents aren’t. The comparison goes row by row.

Is it certified?

Not yet. IdRa ran the OpenID Foundation’s conformance suite itself (Basic OP plan: 26 of 35 modules passed, 0 failed, the rest skipped or awaiting manual review), but that isn’t a formal certification. It holds no SOC 2 or ISO 27001 report and hasn’t had an external security review. The security page covers what has been done.

Who is it for?

Teams that want a real identity provider without per-seat pricing, and service providers hosting identity for many customers.

Read all the questions

Create your organization.

Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.

Get started free Read the docs