Pricing
Usage-based pricing with a single metric. Every plan includes the full Keycard control plane.
Starter
Try Keycard personally
Free
5,000 transactions/mo (hard cap) - ✓ Unlimited users, agents & apps
- ✓ App Binding + Dependencies policy
- ✓ RBAC, ABAC, ReBAC
- ✓ Real-time telemetry (7-day retention)
- ✓ Community support
Team
Bring it to your team
$500 /mo
100,000 transactions included. Billed monthly, no commitment. $1 per 1,000 additional transactions - Everything in Starter, plus:
- ✓ SSO for organization users
- ✓ Zone Policy
- ✓ Telemetry retention
- ✓ Full usage data & insights
- ✓ Email support
Enterprise
Power your organization
Contact Sales
Custom transaction volume. Annual commitment. - Everything in Team, plus:
- ✓ Org Policy + Device-Based Policy
- ✓ SCIM, Active Directory, LDAP provisioning
- ✓ Dedicated, BYOC, or on-prem deployment
- ✓ Private networking
- ✓ Customer-managed KMS
- ✓ Continuous export (OCSF)
- ✓ 24/7 support + dedicated CSM
One metric: transactions
A transaction is recorded each time Keycard is involved in a request — issuing a credential, validating an access request, or exchanging a credential. Each plan includes a monthly allocation. Paid plans bill additional transactions at $1 per 1,000.
How transactions work →Compare plans
Starter
Team
Enterprise
Agent Identity & Access
Users, Devices, Agents & Apps
?
Unlimited
Included
Included
Identity Provider Types
?
Application, User, Workload
Included
Application, User, Workload, Device
Authorization Models
RBAC, ABAC, ReBAC
Included
Included
Policy
?
App Binding + Dependencies
App Binding + Dependencies + Zone Policy
App Binding + Dependencies + Zone Policy + Org Policy + Device-Based Policy
Protocols
?
All protocols
Included
Included
Observability
Real-Time Telemetry
?
✓
Included
Included
Telemetry Retention
?
7 days
90 days
180 days Option to extend
Continuous Export
?
—
Included
✓
Usage Data & Insights
?
—
Full
Full + custom dashboards
Administration
SSO
?
—
✓
Included
Provisioning
?
—
Included
✓
Roles
RBAC
Included
RBAC + Custom Roles
Platform
Deployment
?
Multi-tenant cloud
Included
Multi-tenant, Dedicated, BYOC, or On-prem
Networking
?
Public internet
Included
Private networking available
Key Management
?
Keycard-managed
Included
Customer-managed (BYO KMS)
Automatic Key Rotation
Managed by Keycard
Included
Self-scheduled rotation
Support
Support Channel
Community
Email
Email + Slack + Dedicated CSM
Response SLA
?
—
Included
1 hour 24/7 (P1 issues)
Uptime SLA
?
—
Included
99.95%
All plans include every supported protocol: OAuth 2.1, Token Exchange,
SPIFFE, WIMSE, MCP, A2A, API, CLI, and custom protocols via SDK.
See all supported standards →
When to upgrade
Starter → Team
- More than 5,000 transactions/mo
- Zone Policy or SSO
- Telemetry retention
- Email support
Team → Enterprise
- Org-wide or device-based policy
- SCIM, AD, or LDAP provisioning
- Dedicated, BYOC, or on-prem deployment
- Private networking or customer-managed KMS
- Continuous export to SIEM
- Dedicated CSM or 24/7 support