Pricing
An annual subscription for each production Authcha instance, sized by the number of network devices it serves. Every plan includes support.
One command installs it on your own hardware. Up to 100 devices. Point a few real devices at it, or try the hosted sandbox first.
Two-factor for every login to your network gear.
Support
Device logins plus endpoint policy, MAB and guest Wi-Fi for a campus or region.
Support
Large or regulated estates that need posture, HA and a named engineer.
Support
Side by side
| Feature | Starter | Professional | Enterprise |
|---|---|---|---|
| Limits | |||
| Network devices (NAS) | |||
| Admin seats | |||
| Production instances per subscription | 1 | 1 | 1 |
| Device administration | |||
| One-time codes on device logins over WhatsApp or SMS (you bring your own messaging provider) | |||
| Access-Challenge, phrase-OTP and password-only flows per NAS | |||
| Four-tier policy inheritance | |||
| Jump-server source-IP enforcement | |||
| Role-based access by user type | |||
| Vendor attribute profiles (30+ platforms) | |||
| Passwordless push sign-in (passkeys with number matching) | |||
| Passkey sign-in for administrators | |||
| Network access control | |||
| 802.1X user authentication (EAP-TTLS) | |||
| 802.1X certificate authentication (EAP-TLS) with a built-in CA | |||
| RadSec: RADIUS over TLS with device certificates | |||
| CoA and Disconnect over RadSec | |||
| Certificate enrollment: EST and SCEP | |||
| Access rules: first-match authorization for 802.1X and MAB | |||
| MDM compliance in access rules (Intune, Jamf Pro) | |||
| MAC Authentication Bypass | |||
| Device classes: VLAN, QoS, bandwidth, session timeout | |||
| Traffic quotas with RFC 5176 CoA-Disconnect | |||
| Kea DHCP integration | |||
| Device fingerprinting and classification | |||
| Endpoint posture agent and quarantine | |||
| Guest access | |||
| Guest vouchers with sponsor and approver roles | |||
| Guest self-registration and employee device portal | |||
| Captive-portal redeem page | |||
| Operations | |||
| Live auth stream and audit trail | |||
| Auth simulator | |||
| Admin TOTP | |||
| Automated backups with weekly restore drill | |||
| OIDC single sign-on for admins | |||
| Authcha as an identity provider for other apps | |||
| SIEM event streaming (syslog CEF/LEEF/JSON, HTTPS) | |||
| LDAP / FreeIPA directory sync | |||
| API access tokens | |||
| Deployment | |||
| Docker deployment on your own hardware | |||
| Signed license, online or offline activation | |||
| Air-gapped deployment assistance | |||
| High-availability deployment guidance | |||
| Support | |||
| Support channel and response | |||
| Onboarding and migration assistance | |||
Good to know
Your license is a signed key (Ed25519). The installer, or Settings → License, installs it and activates it for your server over HTTPS. Activation sends only the license, an installation ID and the Authcha version, and renews about once a week; short outages don't matter. Servers without internet access activate offline: download a request file, upload it from any connected computer, paste the certificate back.
On a paid plan (Starter, Professional or Enterprise) authentication is never interrupted. OTP, 802.1X and MAB logins keep working, and so do all existing devices, users and admin accounts. Only new provisioning pauses: adding admins, devices, users or vouchers. The console shows a banner until a renewed license is installed; renewal is a new file pasted in the same place.
Free trials and the 30-day evaluation are different. After the trial ends you have 7 days with a banner and no new provisioning, then 7 days with a read-only console, and 14 days after the end date network sign-in stops until you install a license. Installing a valid license restores everything immediately.
One Authcha deployment, with its own database, serving your live network. Authcha is single-tenant, so separate organisations need separate instances. If you also plan to run lab, staging or standby instances, tell us and we'll cover them explicitly on the quote.
Every module, for 30 days, up to 100 network devices, on your own hardware. Start it with one command (see how); we email you a code, no credit card. Use your work e-mail address: temporary or disposable addresses are not accepted, one trial is issued per installation, and some requests are reviewed by a person before the key is sent. Keep your configuration when you buy: installing your license is the only change.
The software that sends them is included in every plan; the messages themselves are not. Authcha does not resell WhatsApp or SMS. You connect the provider you already use (an SMS gateway, the WhatsApp Business API or any HTTP service) under Delivery Channels, and the provider bills you for the messages directly. Authenticator-app codes (TOTP) and e-mail need no provider.
Yes. The first ten customers get 30% off their first year on Starter or Professional. Ask for it when you talk to us; it is applied to the first invoice and the list price applies from the second year.
By invoice against a purchase order, annually in advance. INR prices are exclusive of GST, which is added at the applicable rate. USD prices are for customers outside India.
Help with installing, configuring, upgrading and troubleshooting Authcha. Response times depend on the plan: next business day on Starter, 4 hours during business hours on Professional, and 24×7 with a named engineer on Enterprise.
The public demo has sample people, devices, guest codes and live logins. Sign in as an admin, a front-desk sponsor or a read-only viewer. Or install your own in one command.
$ curl -fsSL https://get.authcha.cloud | sudo bash -s -- --trial you@company.com ✓ Authcha downloaded and verified ✓ Authcha is running