Activepieces SSO Cost: Plans and Pricing for 2026
Oct 23, 202613 min read
You get SSO on Team, which Activepieces lists at $200 a month with 50,000 credits and 25 users, and $0.007 for each credit over.
Billed annually, Canopyne reports Team at $166 a month, so the choice of billing period moves the figure by $34 a month.
Activepieces SSO costs $200 a month on Team
viz type=groupedbars title="Monthly versus annual billing on Activepieces paid plans" unit="$ per month" source="Canopyne - https://canopyne.com/activepieces-pricing/" cols="Billed monthly,Billed annually"66 a month on annual billing versus $200 billed monthly." Plus: 20, 16 Team: 200, 166
What Activepieces SSO is
Your staff log in to Activepieces with the identity provider your organisation already controls, instead of a separate password held by Activepieces.
That is what single sign-on means here, and on Team at $200 a month it covers the 25 users the plan includes, so your team needs to fit within that limit.
For an approver, the point is the audit trail: you handle joiners and leavers in one place, and you can withdraw access centrally.
The credentials behind connected apps get the same treatment: on self-hosted and enterprise cloud, Activepieces routes API keys and OAuth tokens to your own secret manager, and a self-hosted database holds none of them, which you can confirm by inspecting it.
Secret managers sit on the same access-control side of the product as SSO/SAML, SCIM and custom RBAC, so the tier that settles your sign-in also settles where your credentials live. Your credentials are never ours to hold.
Setting it up is a configuration task. The plan decides whether you may do it at all.
What each plan includes for SSO
On Activepieces's pricing ladder, Free and Plus don't give you SSO, so the real step is from Plus at $20 a month to Team at $200, a tenfold jump that you have to justify to whoever approves the spend.
| Plan | Monthly price | Included credits | Users | SSO | How bought |
|---|---|---|---|---|---|
| Free | $0 | 1,000 | Not stated here | No | Self-serve |
| Plus | $20 ($16 billed annually) | 10,000 | Not stated here | No | Self-serve |
| Team | $200 ($166 billed annually) | 50,000 | 25 | Yes | Self-serve |
| Ultimate | Quoted by sales | Quoted | Quoted | Agreed in the quote | Sales |
| Self-hosted enterprise | Quoted by sales | Quoted | Quoted | Agreed in the quote | Sales |
| Embed | From $36,000 a year | Quoted | Quoted | Agreed in the quote | Sales |
Team is therefore the cheapest self-serve route to SSO.
When the free Community Edition is enough and when it is not
If one team runs its own instance, manages its own logins and doesn't need access tied to a corporate identity provider, the free Community Edition is enough.
Once an auditor or security reviewer asks for central sign-on and central removal of leavers, it isn't. At that point the decision is a paid plan, not a longer configuration session.
What drives a sales quote
You won't find a public price for Ultimate, self-hosted enterprise or Embed, and I won't guess at them. Embed starts from $36,000 a year, which means it requires annual budget commitment. Four things shape the quote:
- the number of users
- the volume of credits
- the deployment model
- the level of support
If you are buying self-serve, start at the pricing page. Anyone needing self-hosted enterprise, SSO beyond Team, Ultimate or Embed should use the sales form.
If you are running this arithmetic for your own team, see what the same workload costs on Activepieces.
How single sign-on works between your identity provider and Activepieces
Your identity provider vouches for a person, and the application accepts that assertion instead of checking a password of its own. The decision to trust it's a contract between two systems, and you must record it.
Identity provider and service provider roles in SSO
The identity provider is the system that authenticates people: it holds the credentials, challenges for a second factor and decides who is a current employee.
The service provider is the application relying on that decision. When someone opens the application, it redirects them to the identity provider, which signs a statement of who they are and sends them back.
Two protocols are common for this: SAML and OpenID Connect. Confirm in the vendor's documentation which one your plan supports before you open a ticket with your identity team.
Typically you hand the application your provider's sign-on address and signing certificate (or issuer and client credentials, under OpenID Connect), and you hand the provider the application's callback address and identifier.
How a SAML login travels
When a person opens the application, it builds a request and redirects their browser to the identity provider. The provider authenticates them, then returns a signed assertion carrying their email and name.
The application checks the signature against the certificate you stored, and the audience against its own identifier.
Assertions are valid for only minutes, so clock drift between the two systems is a quiet cause of rejected logins. Signing certificates also expire, usually yearly, so someone must own the renewal date.
Other ways to solve the same problem
OpenID Connect does the same job with JSON tokens instead of signed XML, and is the usual choice for newer applications. Directory protocols such as LDAP check passwords against your directory, but leave the second factor and the browser flow to the application.
Provisioning is a separate problem
SSO governs who can sign in; SCIM governs whether accounts are created and removed automatically. Without it, a leaver loses the ability to log in, but their account lingers until someone deletes it.
What SSO does not do
Your work doesn't move with SSO. Flows, projects, role assignments and credit usage stay inside the application, and removing a person from the directory doesn't by itself delete what they built.
Who it matters most for
Where an auditor will ask how leavers lose access, it matters most.
Set up Activepieces SSO in five stages
Before you begin, name the approver for each stage: setup runs in five stages, and the identity team described above owns two of them.
Each stage leaves one thing working and records one value the next stage needs, which gives your change log a clean audit trail.
Stage 1: confirm that the workspace is on the Team plan and that the person doing the work holds administrator rights. Without both, the SSO settings won't appear.
If the plan is wrong, the fix is a purchasing approval, not a configuration change, so raise it first. Done when the admin screen shows the SSO settings.
If the plan is wrong, the fix is a purchasing approval, not a configuration change, so raise it first.
Stage 2: Register the application with your identity provider
Your staff accounts live in the identity provider (IdP), the system that signs them in. In it, create a new SAML application and enter the ACS URL and the Entity ID exactly as the admin screen displays them.
The ACS URL is where the IdP sends the signed login response. The Entity ID is how the two systems recognise each other.
Then map three attributes: email, firstName and lastName. A mismatch in letter case here is a common reason accounts fail to match later. Done when the provider's application page shows the app as created and the three mappings saved.
Stage 3: Enter the provider details in Activepieces
Paste the IdP metadata into the matching field on the admin screen, then verify your email domain.
Because domain verification is the control that stops anyone else claiming your addresses, expect your DNS owner to be involved; it belongs to the same Team-plan setup, so the $200 a month you are paying waits on them.
If that's a different team, ask them before you reach this point. Done when the domain shows as verified and Activepieces has saved the metadata.
Stage 4: sign in through SSO with a single non-administrator account, ideally in a private browser window so no existing session interferes. Check that the name and email arrive as mapped. Done when that one login succeeds and lands in the correct workspace.
Stage 5: before announcing anything, keep one administrator able to sign in without the IdP. At Stage 5, in the event of an IdP outage or certificate expiration, this account is the only route back in for such scenarios, and auditors will ask whether it exists.
Record who holds it and who approved it. Then invite the wider team.
Worth checking against a plan that does not meter every step: one credit covers a whole run on Activepieces.
Mistakes that break Activepieces SSO rollouts
Rollouts fail at the invitations. The failures trace to four mistakes: the wrong plan, a redirect or domain mismatch, no fallback admin, and user or credit caps nobody budgeted for.
Match a ticket to a remedy with the table below, which pairs each symptom with its cause and fix, so whoever approves the rollout can act on it.
| Mistake | Symptom | Cause | Fix |
|---|---|---|---|
| Wrong plan | No SSO settings to configure | Workspace sits on a tier without SSO | Move to Team at $200 a month, the self-serve entry point |
| Over 25 users on Team | Seats run out before everyone is invited | Team includes 25 users, so a larger department doesn't fit | Remove dormant accounts, or ask sales about a larger arrangement |
| Redirect or domain mismatch | Login fails after the identity provider step | Registered callback address or email domain differs from what users actually use | Copy the redirect value exactly and confirm the domain matches staff email |
| No fallback admin | Nobody can reach settings when SSO fails | Every admin depends on the identity provider | Keep one named admin with password access |
| Assuming enterprise SSO is self-serve | Requirements go beyond what checkout offers | SSO beyond Team is quoted by sales | Submit the sales form before the deadline |
| Credit overage at $0.007 | Invoice exceeds the approved budget | Each credit past the plan allowance is billed separately | Review usage monthly and set an internal ceiling |
Team at $200 a month is the self-serve route; needs beyond it, such as a self-hosted enterprise deployment with SSO and SCIM, go through the sales form at https://www.activepieces.com/sales.
Raising that late means the approval chain starts again, so budget holders should see the plan decision first.
When the callback address the provider holds differs, even by a trailing character, from the one the platform expects, the provider rejects the login.
The same applies to email domains: a user on a different domain from the one registered won't match. Record both values in the change ticket so an auditor can trace them.
Frequently asked questions
Is SSO available on the Activepieces free plan? No. SSO isn't part of the Free plan at $0 with 1,000 credits, or the Plus plan at $20 a month; Team at $200 a month is the self-serve plan that includes it.
If your security review requires single sign-on before anyone logs in, the plan decision is made before any configuration starts, so confirm the tier with whoever approves the spend.
Does self-hosted Activepieces support SSO? Not in the free Community Edition. A self-hosted deployment that needs SSO moves onto a paid licence, which is quoted by sales.
The quote is driven by user count, credit volume, deployment arrangement and the level of support you want. Ask for the SSO terms in writing, because the licence is what your auditor will be shown.
Can I use Google or Microsoft as my identity provider?
Most teams already hold Google or Microsoft, and they are the usual starting point. What stalls rollouts is rarely the provider itself.
It's the domain: the email domain your users sign in with must be one your organisation controls and can verify, and the person who can change its records is often not the person doing the setup.
Establish who holds that access, and who approves the change, before you book the work.
What happens to workflows when I remove a user?
Their access to the platform goes when you remove a user. It doesn't by itself tell you who now owns the work they built.
Before offboarding anyone who has built or maintains flows, check which flows they own, confirm that someone named has taken over each one, and record that handover. Do this first, so that a departure doesn't leave a live automation with no accountable owner.
How do I get SSO beyond the Team plan?
Through the sales form at https://www.activepieces.com/sales. Use it if you need SSO on a self-hosted enterprise deployment, on the Ultimate plan, or alongside Embed.
With no published price for Ultimate, self-hosted enterprise or Embed, state your user numbers, expected credit volume, deployment model and support needs in the first message.
That gives sales what they need to quote, and gives you a figure to take through your own approval chain. If Team covers your need, the pricing page at https://www.activepieces.com/pricing is the self-serve route.
Choosing a plan or contacting sales
If your user count and credit estimate fit inside Team, choose it through the pricing page; send every other case, including self-hosted enterprise, to the sales form. Both routes need the same preparation, and none of it requires a call.
Do the preparation before anyone opens a purchase request. An approval chain moves slowly when the request has to be corrected afterwards, and a plan bought on a guess about headcount or usage is the commonest correction.
Below, the checks run in the order in which a wrong answer would stop you. The first two decide whether Team fits at all and the last three decide where you go next.
- Count the people who will actually log in, and compare the number with Team's 25 users, revealing your team's actual participation rate, by which you discover how many paid seats go unused. Over that, Team is the wrong plan whatever the budget says, and you're in a sales conversation.
- Estimate monthly credits from your busiest flows, and compare the figure with Team's 50,000. Going over means paying per credit on top of the $200 fee, so a busy month costs more than the plan price suggests.
- Name your identity provider and the email domain your staff sign in with. Most stalled SSO rollouts trace back to these two details, and your IT team can confirm them in an afternoon.
- Send Team-sized needs to https://www.activepieces.com/pricing. Send self-hosted enterprise, SSO beyond Team, Ultimate or Embed to https://www.activepieces.com/sales, where the quote depends on users, credits, deployment and support.
- Re-verify plan limits and prices on the vendor's page on the day you buy. Figures in an article, this one included, age faster than the contract you're about to sign.
If your security reviewer asks for a SOC 2 report, note that the vendor's programme is in progress and not complete. Don't write certification into the approval paperwork, and ask sales what evidence exists today.
Related reading
References
Running the numbers
See what the same workload costs here.
Free forever plan, and every paid plan self-hosts at no extra cost.
See pricing Talk to sales
