The deal is about to close. Then the buyer says they need SSO.

On a rented identity plane that sentence becomes a quote, and a new SKU. The login you already shipped is fine. The connection is the new line.

We do not sell the connection. We sell the plane.

Team is $299/mo flat, with unlimited users and unlimited SSO connections. Adding the prospect's identity provider is a configuration change, not a purchase order. Effective 2026-08-07. Hobby is $0, one instance each. One instance per company. No SLA. Business is $999/mo. Scale is $15,000/yr when you want the same build on your own metal. Enterprise is quoted.

Point the stock better-auth client at the instance, path /api/auth. There is no Signet SDK. Every user, session and secret is a row in a database you can inspect: PostgreSQL from Team up, encrypted SQLite on Hobby. Nothing phones home. Leaving is pg_dump on PostgreSQL. The questions sit on /faq.

What we will not dress up. No third-party compliance certification is held or claimed. You cannot yet make SSO the only way in for a domain. The OAuth provider does not claim full OpenID Connect conformance. Those sentences also live on /security and /product.

Updated 10 October 2026. When we wrote this note, SAML SSO had passed only against a conformance identity provider. Since then it has completed a round trip with a commercial identity provider (16 August 2026). It has also run against a live Microsoft Entra tenant (10 October 2026), with a certificate rotation in one call. This note also said the OAuth provider shipped its core flow only. Refresh, client credentials, introspection, revocation and client registration have shipped since.

This is one dated note, not a stream. If we write another, that page will say so.