Auth0 FGA Subscription Plans
Free trial
The Auth0 FGA Free Trial helps you learn FGA authorization models and how to integrate them in your application with Auth0 FGA’s SDKs.
Creating a proof-of-concept application that uses Auth0 FGA can take anywhere from days to months, so the Auth0 FGA free trial is currently not time-limited. We reserve the right to limit the trial period in the future.
This free trial is governed by the free trial terms in Okta's Master Subscription Agreement. It does not have an SLA and support is provided through the Auth0 Community.
The free trial has the limitations detailed below. Rate limits are per store.
| Entity | Limit |
|---|---|
| WriteAuthorizationModel Rate | 10 requests per minute |
| ReadAuthorizationModels Rate | 30 requests per minute |
| Check & BatchCheck Rate* | 20 requests per second |
| Read Rate | 25 requests per second |
| Expand Rate | 30 requests per minute |
| Write Rate | 20 requests per second |
| ReadChanges Rate | 5 requests per second |
| ListObjects Rate | 10 requests per minute |
| ListUsers Rate | 10 requests per minute |
| Authorization Model Size** | 400 KB |
| Number of Tuples per Write Transaction | 40 |
| Total Number of Tuples | 50 thousand |
| Monthly Active Users | 100 |
| Number of Stores | 10 |
| Available Regions | US, Europe and Australia |
* Each check sent in the checks array of BatchCheck applies to the overall Check rate limit.
** The authorization model size is measured after serialization. Simple types with a few relations typically use 200–500 bytes each, so most models are well within this limit even with hundreds of types.
Enterprise subscription
The Auth0 FGA enterprise subscription allows you to use the product in production under Okta's Master Subscription Agreement and Service Levels.
An enterprise contract is required to use Auth0 FGA; Auth0/Okta customers should contact their account executive for further details. If you are not an Auth0/Okta customer, you can contact Auth0/Okta here.
The limits for Auth0 FGA Enterprise are detailed below. Rate limits are per store. Higher limits can be requested by contacting an account executive or account manager, or by contacting us.
| Entity | Limit |
|---|---|
| WriteAuthorizationModel Rate | 10 requests per minute |
| ReadAuthorizationModels Rate | 30 requests per minute |
| Check & BatchCheck Rate* | 500 requests per second |
| Read Rate | 100 requests per second |
| Expand Rate | 30 requests per minute |
| Write Rate | 150 requests per second |
| ReadChanges Rate | 10 requests per second |
| ListObjects Rate | 20 requests per second |
| ListUsers Rate | 5 requests per second |
| Authorization Model Size** | 400 KB |
| Number of tuples per write transaction | 40 |
| Total of number of tuples | 10 million, more available to purchase |
| Monthly Active Users | Based on your contract |
| Number of Stores | 20 |
| Available AWS Regions | US, Europe and Australia |
* Each check sent in the checks array of BatchCheck applies to the overall Check rate limit.
** The authorization model size is measured after serialization. Simple types with a few relations typically use 200–500 bytes each, so most models are well within this limit even with hundreds of types.
Permissions Index subscription add-on
The Permissions Index is an add-on SKU for the Auth0 FGA Enterprise subscription — it requires an Enterprise subscription and is sold separately through an annual agreement.
Entitlement limits by subscription plan
| Subscription Plan | Indexes | Indexed Relations | Expansions |
|---|---|---|---|
| Free trial | 0 (no access) | 0 (no access) | 0 (no access) |
| Enterprise subscription (no add-on) | 1 complimentary | 1 per index | 10 million complimentary |
| Enterprise subscription + Permissions Index add-on | Up to 10 | Up to 10 per index | 20 million up to 20 billion (based on purchased amount) |
- Free trial: The Permissions Index isn't available on the free trial. Upgrade to an Enterprise subscription to get access.
- Enterprise subscription: Every Enterprise subscription includes one complimentary index with one indexed relation and up to 10 million expansions, at no extra cost.
- Enterprise subscription + Permissions Index add-on: Purchasing the add-on raises your entitlement to up to 10 indexes, each index supporting up to 10 indexed relations, and the total number of expansions based on the purchased tier amount (e.g., 20 million, 30 million, etc.).
How pricing works
The Permissions Index add-on is priced based on Active Expansions. An expansion is considered 'active' if the index that created it is 'active'. See below for which index statuses are considered 'active'.
An expansion is defined as a single flattened expansion event produced by a Permissions Index. Each INSERT and DELETE event counts as a separate active expansion.
For example, an index with 100 Million INSERT events and 100 Million DELETE events has 200 Million active expansion events, even if those inserts and deletes cancel each other out and net to zero live access grants on the final index.
| Day | Operation | Operation Count | Active Expansions | Rows in index |
|---|---|---|---|---|
| 1 | INSERT | 100M | 100M | 100M |
| 2 | DELETE | 100M | 200M | 0 |
As soon as an index is deleted, its expansions are removed from the account's Active Expansions count.
| Index Status | Counts toward expansion entitlements? |
|---|---|
CREATING | Yes |
ACTIVE | Yes |
DELETED | No |
ERROR | No |
Expansions are aggregated account-wide. Indexes created across multiple stores in a single FGA account add up to one account-wide total. For example, three active indexes across two stores producing 3 million, 1 million, and 500,000 expansions add up to 4.5 million for the account. Deleting an index removes its expansions from that total.
Your contract sets a yearly capacity, and it does not reset. When you purchase the Permissions Index add-on, you choose an expansion amount (e.g., 20+ million) based on what you expect to use that year. This capacity does not reset at each renewal. Instead, you look at where you ended up and purchase more/less expansions accordingly. For example, if you're at 19 million expansions on a 20 million tier when your contract renews, you'd move up to the 30 million tier for that contract year.
Going over doesn't break anything. If your account temporarily exceeds its entitlement — say, while you're building a replacement index before deleting the old one — your indexes keep working. If that monthly average stays over/below your entitlement, your account team will work with you to move up/down to the right tier.
If you're approaching or have exceeded your entitlement limits, contact your Auth0 FGA Account Executive (AE) or Technical Account Manager (TAM).
Private Cloud in AWS
Private Cloud is an add-on for the Auth0 FGA Enterprise subscription, that allows using Auth0 FGA per-customer dedicated infrastructure in several AWS regions.
| Entity | Limit |
|---|---|
| Rate Limits | Based on your contract |
| Authorization Model Size** | 400 KB |
| Number of tuples per write transaction | 40 |
| Total of number of tuples | Based on your contract |
| Monthly Active Users | Based on your contract |
| Number of Stores | 20 |
| Available AWS Regions | US, Australia, Germany, Ireland, UK, France, Japan, India, Singapore and Brazil |
** The authorization model size is measured after serialization. Simple types with a few relations typically use 200–500 bytes each, so most models are well within this limit even with hundreds of types.
Monthly active users calculation
Monthly Active Users are calculated based on the amount of different user field values that are sent to the Check and ListObjects API endpoints for each store over a one month period.
So the below will count as 6 unique users:
Check(user=user:anne, relation=can_view, object=document:1)
Check(user=user:beth, relation=can_view, object=document:1)
ListObjects(user=user:anne, relation=can_view, type=document)
ListObjects(user=user:carl, relation=can_view, type=document)
Check(user=user:*, relation=can_view, object=document:1)
Check(user=group:a#member, relation=can_view, object=document:1)
Check(user=employee:anne, relation=can_view, object=document:1)
Also note that MAU are counted per store, so the below will count as two distinct users:
Check(user=user:anne, relation=can_view, object=document:1) // store 1
Check(user=user:anne, relation=can_view, object=document:1) // store 2
Checking the current subscription level
The subscription level is displayed in the 'Manage Account' section of the Auth0 FGA Dashboard.