Flat pricing. No per-seat math.
Your IdP bills per user. Your tooling should not.
Individual
$10/mo
+ $5 per additional tenant / month
One user, 2 tenants included. The solo engineer bringing tenants under Terraform.
Business
$20/mo
+ $5 per additional tenant / month
Unlimited users, 2 tenants included. The whole team shares one install and one refreshed dataset.
| Individual | Business | |
|---|---|---|
| Users | 1 | Unlimited |
| Tenants | 2 included, +$5/mo each additional | 2 included, +$5/mo each additional |
| Providers (Okta, Auth0, Authentik) | Yes | Yes |
| Per-object Terraform with import blocks | Yes | Yes |
| Whole-tenant bundle export | Yes | Yes |
| Cross-reference rewriting | Yes | Yes |
| Secrets as sensitive variables (never in HCL) | Yes | Yes |
| Persisted encrypted exports, manual refresh | Yes | Yes |
| Roles (admin / user) | - | Yes |
| Email invites, reset links, TOTP MFA | MFA only | Yes |
| Audit log | Yes | Yes |
| Read-only architecture, no telemetry | Yes | Yes |
Licenses activate against our license server; the only thing ever sent is your
license id - never your tenants, never your data, never telemetry. Renewals and
added tenants apply automatically at the app's daily check-in, no new key needed.
One license runs one install at a time and moves freely between installs.
Air-gapped? Annual licenses can use an offline license file.
Existing customers: add tenants or manage your subscription here.
Questions people actually ask
Is there a free tier or trial?
No free tier. TFsmith is $10/month and does one job extremely well. Licenses activate instantly, subscriptions cancel any time from the manage page, and monthly billing means trying it costs one month at most.
Can TFsmith change or break my tenant?
No. It connects with a read-only admin API token and has no code path that writes to your identity provider. Exporting is reading. The worst it can do to your tenant is nothing.
Do you see my data?
No. TFsmith is self-hosted and has no telemetry. Paid licenses activate against our license server, which receives your license id and a random install id - never your tenants, never your data. Air-gapped installs can use an offline license file and never connect to us at all.
What happens when a license expires?
A 3-day grace window, then the app locks to the License screen until a current license is installed. Nothing is deleted - tenants, users, and stored exports all survive, and everything resumes the moment the license is current.
What counts as a tenant?
One connected identity tenant - an Okta org, an Auth0 tenant, or an Authentik instance. Both tiers include 2 (production plus a sandbox is the typical pair); additional tenants are $5/month each, added any time from the manage page and applied automatically.
Monthly or annual?
Both. Annual saves about 10% and is required if you want the offline license file (offline files cannot enforce monthly renewal, so we only issue them for annual terms).