Skip to content

Features Overview

Taco ships as three plan tiers — Lite, Team, and Business — baked into the Docker image at build time via PLAN_TIER. Higher tiers are strict supersets of lower ones.

FeatureLiteTeamBusiness
Client management
Multi-provider (Ory Hydra, Auth0, Entra ID, Okta, Keycloak, RFC 7592)
Organizations
Onboarding wizard
Analytics
Public API
Teams
White-label branding
Client registration workflow

Create, update, clone, and delete OAuth2/OIDC and SAML clients; manage resource servers and their scopes. See Client Management.

Connect to Ory Hydra, Auth0, Azure Entra ID, Okta, Keycloak, or any RFC 7592-compliant authorization server, switchable via OPENID_PROVIDER. Provider-level capability (SAML support, native resource servers, cloning) varies — see each provider’s page under Providers.

Multi-tenant boundary with member roles (member, reviewer, org admin/owner). See Organizations.

Guided first-run setup for connecting a provider and inviting the first organization members.

Aggregated client and user statistics computed on a schedule: applications, users, active users (7d/30d), and organization counts. See Analytics.

Bearer-token resource server at /api/v1 for programmatic client/registration access. See Public API.

Groups of members within an organization; the unit that policy profiles are assigned to. See Teams.

Per-organization logo, colors, and domain, plus instance-wide defaults. See Branding.

Three-tier policy engine (platform policy, team policy profiles, human review) gating OIDC/SAML client provisioning, with change sets and templates. See Client Registration Workflow.