Why We Ship SAML & OIDC SSO Free in MIT Open Source
Legacy SaaS vendors gate basic login security behind 3x Enterprise seat markups. In FrogBot, SAML, OIDC, API keys, and row-level RBAC ship free in the MIT core.

Key takeaways
- Single Sign-On is a security baseline, not a luxury feature. Gating SAML and OIDC behind an Enterprise tier punishes teams for securing their logins.
- SAML 2.0, OIDC, API keys, and RBAC are MIT-licensed in FrogBot. Every app you build gets enterprise identity out of the box for $0.
- IT teams can govern internal AI apps from day one. Put Okta, Google Workspace, or Microsoft Entra ID in front of every FrogBot app without negotiating a five-figure contract.
Ending the "SSO Tax"
For the last decade, SaaS pricing pages have followed the same playbook: offer a $20/seat starter tier, then require an upgrade to a $65–$175/seat "Enterprise" plan the moment your IT team asks for Okta or Google Workspace SAML login.
Charging 3x more per user just to verify a signed XML or OIDC token is the exact kind of rent-seeking we built FrogBot to kill.
What ships free in the MIT core
Every FrogBot application includes full authentication and authorization in the open-source framework:
- SAML 2.0 & OIDC strategies: Connect Okta, Microsoft Entra ID, Google Workspace, OneLogin, or any standard identity provider.
- Row- and field-level RBAC: Write TypeScript access functions that filter rows by user role, department, or client tenant—enforced automatically in both REST and Local API calls.
- Scoped API keys: Generate hashed bearer tokens for scripts, CI pipelines, and MCP clients.
How this changes the conversation with Enterprise IT
When an internal builder replaces a $25,000/year SaaS tool with a FrogBot app, IT's first three questions are always:
- How do employees log in and how do we revoke access when someone leaves?
- Who can read or mutate sensitive records?
- Where does the database live?
Because SAML/OIDC SSO and row-level RBAC are already built into your FrogBot app—whether deployed on Dojo for $29/mo or self-hosted inside your company's VPC—security review becomes a 15-minute checklist instead of a blocker.
