---
title: "Pricing and limits"
description: "EZGH SSO is free. The quotas and limits that apply to directories, users, groups, applications, identity providers, SCIM and custom domains."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pricing and limits

## Pricing

EZGH SSO is free: directories, users, sign-ins, applications, tokens and SCIM provisioning in
both directions cost nothing. It isn't on your invoice.

## Quotas

| Quota ID | Name | Scope | Default | Adjustable |
| --- | --- | --- | --- | --- |
| `sso.directories.count` | Directories per organization | Organization | 1 | No |
| `sso.users.count` | Users per organization | Organization | 5,000 | Yes |
| `sso.groups.count` | Groups per organization | Organization | 1,000 | No |
| `sso.applications.count` | Applications per organization | Organization | 200 | No |
| `sso.identityProviders.count` | Identity providers per organization | Organization | 10 | No |

`sso.users.count` counts every user: hosted, created by an identity provider, or provisioned by
SCIM. A create over a quota is `409 quota_exceeded`, with the quota in the error; over
[inbound SCIM](/sso/scim) it's `403`; a person whose first federated sign-in would go over it sees
an error page. Deleting users, groups, applications or identity
providers frees their quota at once. See [Service quotas](/quotas) to view your quotas.

## Limits

| Limit | Value |
| --- | --- |
| Email domains per directory | 50 |
| Custom domains per directory | 1 |
| Members added or removed per request | 1 to 100 |
| Assignments per application | 1,000 (100 added or removed per request) |
| Redirect URIs, post-logout redirect URIs per application | 20 each |
| Client secrets per application | 2 |
| Client keys (`jwks`) per application | 10 |
| Group mappings per identity provider | 100 |
| Inbound SCIM requests | 1,200 a minute per SCIM token; bodies up to 1 MiB; up to 200 results a page |
| SAML ACS URLs per application | 10 |
| SAML attributes per application | 50 |
| Service provider certificates per SAML application | 10 |
| Service provider metadata | 256 KiB |
| SAML signing certificate | RSA-3072, valid 3 years; the next one is published 90 days before expiry |
| Provisioning attribute mappings per application | 1 to 50 |
| Users listed by a provisioning reconcile | 10,000 |
| Passkeys per user | 20 |
| TOTP authenticators per user | 1 |
| Session length | 5 minutes to 24 hours |
| Console applications per directory | 1 |
| Console session length | 15 minutes to 12 hours |
| Directory groups and users a bot trusts | 100 |
| Logo | PNG or JPEG, 512 KiB, 1024 × 1024 pixels |
| Tags per resource | 50 |
| Activation and factor-reset links | Single use, 24 hours |
| Dynamic client registrations | 20 an hour per IP address, 500 an hour per directory |
| List page size (`limit`) | 1 to 100 |

Sign-in attempts are throttled to protect your users: see [Throttling](/sso/users#throttling).

Source: https://docs.ezghcloud.com/sso/pricing-and-limits/index.mdx