Features Overview
Taco ships as three plan tiers — Lite, Team, and Business — baked into the Docker image at build time via PLAN_TIER. Higher tiers are strict supersets of lower ones.
Feature matrix
Section titled “Feature matrix”| Feature | Lite | Team | Business |
|---|---|---|---|
| Client management | ✅ | ✅ | ✅ |
| Multi-provider (Ory Hydra, Auth0, Entra ID, Okta, Keycloak, RFC 7592) | ✅ | ✅ | ✅ |
| Organizations | ❌ | ✅ | ✅ |
| Onboarding wizard | ❌ | ✅ | ✅ |
| Analytics | ❌ | ✅ | ✅ |
| Public API | ❌ | ✅ | ✅ |
| Teams | ❌ | ❌ | ✅ |
| White-label branding | ❌ | ❌ | ✅ |
| Client registration workflow | ❌ | ❌ | ✅ |
Feature details
Section titled “Feature details”Client management — all tiers
Section titled “Client management — all tiers”Create, update, clone, and delete OAuth2/OIDC and SAML clients; manage resource servers and their scopes. See Client Management.
Multi-provider — all tiers
Section titled “Multi-provider — all tiers”Connect to Ory Hydra, Auth0, Azure Entra ID, Okta, Keycloak, or any RFC 7592-compliant authorization server, switchable via OPENID_PROVIDER. Provider-level capability (SAML support, native resource servers, cloning) varies — see each provider’s page under Providers.
Organizations — Team, Business
Section titled “Organizations — Team, Business”Multi-tenant boundary with member roles (member, reviewer, org admin/owner). See Organizations.
Onboarding wizard — Team, Business
Section titled “Onboarding wizard — Team, Business”Guided first-run setup for connecting a provider and inviting the first organization members.
Analytics — Team, Business
Section titled “Analytics — Team, Business”Aggregated client and user statistics computed on a schedule: applications, users, active users (7d/30d), and organization counts. See Analytics.
Public API — Team, Business
Section titled “Public API — Team, Business”Bearer-token resource server at /api/v1 for programmatic client/registration access. See Public API.
Teams — Business
Section titled “Teams — Business”Groups of members within an organization; the unit that policy profiles are assigned to. See Teams.
White-label branding — Business
Section titled “White-label branding — Business”Per-organization logo, colors, and domain, plus instance-wide defaults. See Branding.
Client registration workflow — Business
Section titled “Client registration workflow — Business”Three-tier policy engine (platform policy, team policy profiles, human review) gating OIDC/SAML client provisioning, with change sets and templates. See Client Registration Workflow.