Pricing

Usage-based pricing with a single metric. Every plan includes the full Keycard control plane.

Starter

Try Keycard personally

Free
5,000 transactions/mo (hard cap)
  • ✓ Unlimited users, agents & apps
  • ✓ App Binding + Dependencies policy
  • ✓ RBAC, ABAC, ReBAC
  • ✓ Real-time telemetry (7-day retention)
  • ✓ Community support

Team

Bring it to your team

$500 /mo
100,000 transactions included. Billed monthly, no commitment. $1 per 1,000 additional transactions
  • Everything in Starter, plus:
  • ✓ SSO for organization users
  • ✓ Zone Policy
  • ✓ Telemetry retention
  • ✓ Full usage data & insights
  • ✓ Email support

Enterprise

Power your organization

Contact Sales
Custom transaction volume. Annual commitment.
  • Everything in Team, plus:
  • ✓ Org Policy + Device-Based Policy
  • ✓ SCIM, Active Directory, LDAP provisioning
  • ✓ Dedicated, BYOC, or on-prem deployment
  • ✓ Private networking
  • ✓ Customer-managed KMS
  • ✓ Continuous export (OCSF)
  • ✓ 24/7 support + dedicated CSM

One metric: transactions

A transaction is recorded each time Keycard is involved in a request — issuing a credential, validating an access request, exchanging a credential, or handling a step-up approval. Each plan includes a monthly allocation. Paid plans bill additional transactions at $1 per 1,000.

How transactions work →

Compare plans

Starter
Team
Enterprise
Agent Identity & Access
Users, Devices, Agents & Apps ?
Unlimited
Included
Included
Identity Provider Types ?
Application, User, Workload
Included
Application, User, Workload, Device
Authorization Models
RBAC, ABAC, ReBAC
Included
Included
Policy ?
App Binding + Dependencies
App Binding + Dependencies + Zone Policy
App Binding + Dependencies + Zone Policy + Org Policy + Device-Based Policy
Protocols ?
All protocols
Included
Included
Observability
Real-Time Telemetry ?
✓
Included
Included
Telemetry Retention ?
7 days
90 days
180 days Option to extend
Continuous Export ?
—
Included
✓
Usage Data & Insights ?
—
Full
Full + custom dashboards
Administration
SSO ?
—
✓
Included
Provisioning ?
—
Included
✓
Roles
RBAC
Included
RBAC + Custom Roles
Platform
Deployment ?
Multi-tenant cloud
Included
Multi-tenant, Dedicated, BYOC, or On-prem
Networking ?
Public internet
Included
Private networking available
Key Management ?
Keycard-managed
Included
Customer-managed (BYO KMS)
Automatic Key Rotation
Managed by Keycard
Included
Self-scheduled rotation
Support
Support Channel
Community
Email
Email + Slack + Dedicated CSM
Response SLA ?
—
Included
1 hour 24/7 (P1 issues)
Uptime SLA ?
—
Included
99.95%
All plans include every supported protocol: OAuth 2.1, Token Exchange, SPIFFE, WIMSE, MCP, A2A, API, CLI, and custom protocols via SDK. See all supported standards →

When to upgrade

Starter → Team
  • More than 5,000 transactions/mo
  • Zone Policy or SSO
  • Telemetry retention
  • Email support
Team → Enterprise
  • Org-wide or device-based policy
  • SCIM, AD, or LDAP provisioning
  • Dedicated, BYOC, or on-prem deployment
  • Private networking or customer-managed KMS
  • Continuous export to SIEM
  • Dedicated CSM or 24/7 support