Costs and pricing

How the money moves

Agent identity is cheap per call and expensive per seat.

Four families of meter exist, and none counts agents: per user (Microsoft, Okta), per token or call (the clouds, Clerk, Auth0), per consent or event (Descope, Arcade) and per contract (the specialists).

Here's the invoicing platform a year after opening its API and MCP server to agents, at list prices as of October 2026. My assumptions: login, SSO and roles are already paid for (the login guide prices those), and 90 customer organizations, 15%, connect agents:

• People's assistants: 6,000 users with one or two agent apps each, about 9,000 active consents a month. They're already monthly active users, so a per-user identity vendor charges nothing extra.
• Headless agents: five per organization, 450 clients running around the clock. With one-hour tokens they request about 324,000 tokens a month; with five-minute tokens, about 3.9 million.

Clerk describes its machine tokens as meant for your own infrastructure, so they may not suit customers' agents; Auth0 and Cognito do.

Year one, all in (my rough estimate):

The engineering (consent screens, scope design, attribution, revocation, MCP hardening) is three to six engineer-months up front, then half to one engineer. What the table says:

• The token meter is a design choice. The same 450 clients cost about 12 times more with five-minute tokens, which is what the security guidance asks for, so on per-token vendors price and security pull in opposite directions. Descope's per-consent meter and AWS's free-inside-the-runtime pricing avoid that conflict.
• People cost more than any vendor meter in every version I modelled.
• Customers pay too. If a customer governs agents with Microsoft, Agent 365 at the reported $15 a user a month comes to $90,000 a year for 500 licensed users, which may decide whether it turns agent access on at all.
• There's no line for incidents, because no source prices a token-theft incident.

How companies of different sizes use it

Nobody publishes agent-identity spend by company size, so the figures below are my rough estimates from list prices, the IANS budget data used in the cloud security guide and vendor material.

A startup (under 50 people) has no separate agent identity: its agents run on the founder's tokens and API keys in config files, and its API uses a login vendor's free tier. The CTO owns it, and my rough estimate is $0-5,000 a year. It moves on when the earliest enterprise customer asks for scoped tokens, audit logs and revocation, or when a key leaks.

A scale-up (about 50 to 500 people) runs one login vendor with agent features and governs its internal coding and support agents with a policy document and a spreadsheet. It buys an agent add-on and tool authorization from Arcade or Composio. Platform engineering owns the API side and the first security hire owns internal agents; the invoicing platform is this size. My rough estimate is $15,000-150,000 a year plus a quarter to one engineer. A customer's questionnaire asking how agents are identified and revoked pushes it on.

A mid-market company (about 500 to 2,000 people) gets agent governance through its workforce suite: Entra Agent ID with Conditional Access for agents, which now needs Agent 365 or E7, or Okta for AI Agents, priced as an uplift on Okta's per-user fees. The CISO or head of identity owns it, and my rough estimate is $100,000-500,000 a year beyond the base identity provider. A discovery tool finding far more agents than expected pushes it on: Okta described one prospect going from 50 known agents to 1,500 within weeks.

An enterprise (about 2,000 to 10,000 people) runs Okta, Entra or both, plus privileged-access and governance vendors. Agents sit in three places: inside SaaS products it buys, on a cloud agent platform, and on developers' laptops; GE Appliances runs more than 800 on Google's platform. It buys an agent control plane from its suite owner plus a specialist. My rough estimate is $300,000 to $3 million a year. Regulated uses, agents with write access to finance systems, and a peer's incident push it on.

A Fortune 500 company (revenue above about $7.5 billion) runs more than one identity provider and many hundreds to thousands of agents. It buys through an enterprise agreement with its suite owner plus a layer that claims neutrality (Okta's pitch); at list, E7 for 20,000 knowledge workers would cost $9.4 million a year more than E5, though nobody pays list at that size. The CISO, the CIO's identity team and an AI council share ownership. My rough estimate is $2-15 million a year. There's no next size up; the pressure comes from auditors, acquisitions and incidents.

What changes as a company grows (spend is my rough estimate):