Questions, answered plainly.
If something here would change your decision, we’d rather you know now.
The basics
Is IdRa really free?
Yes. There are no tiers or per-user charges, and no feature on this site is held back for a paid plan.
Can it replace Okta today?
It depends on what you use. Core single sign-on, MFA, directory, SCIM and threat protection are here. Custom admin roles, AD and LDAP agents, access certifications and native desktop agents aren’t. The comparison goes row by row.
Is it certified?
Not yet. IdRa ran the OpenID Foundation’s conformance suite itself (Basic OP plan: 26 of 35 modules passed, 0 failed, the rest skipped or awaiting manual review), but that isn’t a formal certification. It holds no SOC 2 or ISO 27001 report and hasn’t had an external security review. The security page covers what has been done.
Who is it for?
Teams that want a real identity provider without per-seat pricing, and service providers hosting identity for many customers.
What does “workforce identity” mean here?
Sign-in, MFA and access control for the people who work with your organization: employees, contractors and partners. IdRa doesn’t offer self-registration for your own product’s customers.
Why is it called IdRa, and what’s the pattern on the site?
The line-work is guilloché, the fine interlaced engraving on passports and banknotes that makes them hard to forge. IdRa’s mark is a small knot of it.
Getting started
How do I start?
Go to idra.team, pick an address and confirm your email. You’ll sign in as the first admin, enroll MFA and get a setup wizard you can leave and resume.
Can I use my own domain?
Yes. Add it under Customizations → Domains, prove ownership with a DNS TXT record, and make it primary. The issuer moves with it, so apps need the new issuer, and passkeys made on the old address stop working.
Can I run it myself?
Once the repository is public. The self-hosting guide shows what’s involved: one Bun process and one Postgres, on a single replica for now.
Is the code open source?
The hosted service costs nothing today. We’re preparing the public repository and its license, which will let you run IdRa on your own servers too, and we’ll link them here once they’re live.
Security
Where is my data?
On the hosted service, in a Postgres database dedicated to your organization. Self-hosted, once that’s available, wherever you put it. Regional choices for the hosted service aren’t offered today.
Which factors are phishing-resistant?
Passkeys. IdRa doesn’t count anything else as phishing-resistant, and a password plus a security question doesn’t count as MFA.
What happens when someone leaves?
Deactivate them once. Their sessions end, refresh tokens are revoked and OIDC apps with back-channel logout are told to sign them out. SAML apps keep their own sessions. JWT access tokens already issued stay valid until they expire, so keep their lifetimes short.
Okta
Do Okta SDKs work?
The Node SDK does, for the resources IdRa implements, and its tests drive it. Other languages’ SDKs are untested. See Okta compatibility for the list and the limits.
Is IdRa related to Okta?
No. IdRa is independent and isn’t affiliated with or endorsed by Okta.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.