00/Use case · SaaS platforms
Most auth vendors charge per organization, gate SAML behind the enterprise plan, and bill SCIM as an add-on. KavachOS includes organizations, roles, SSO, and SCIM on a single flat tier from 10k MAU upward. No surprise renewal line items.
01/TL;DR
Every user can belong to many orgs. Every org has its own roles, invitations, SSO config, and audit log. No extra charge per org.
SAML, OIDC, and SCIM 2.0 provisioning are on the Growth plan. No enterprise upsell, no per-connection fee, no procurement detour.
Every auth event is tamper-evident and exportable. Your biggest customers can tap into the audit stream via webhook or query API.
02/The problem
You picked Auth0 or Clerk because they were easy to ship with. Two years later, every enterprise deal your team closes has the same line item: ten thousand dollars a year for an SSO connection, SCIM on the top plan, per-org pricing for each customer. The auth bill quietly becomes one of your top ten line items.
SSO gated behind the enterprise plan
Auth0 charges $800 per month for Professional before SSO. Okta Customer Identity gates SAML behind a sales call. Enterprise-only pricing for a checkbox.
Per-organization billing scales faster than revenue
Charging per org makes sense for the vendor. For the SaaS buying it, every new customer increases the auth bill before any revenue lands.
SCIM provisioning priced separately
Most vendors treat SCIM as a second SKU. Your customer wants directory sync, your vendor wants a separate contract.
Audit log only visible to you
Your customers ask for an audit log. Your vendor gives you one. You rebuild a second one so customers can see their own data. That rebuild is real engineering time.
03/How kavachOS fits
KavachOS treats every B2B primitive as part of the same object graph. Users belong to organizations. Organizations carry roles, SSO config, and audit. Roles carry scopes. Everything uses the same query API.
Organizations
SSO
SCIM
RBAC
Audit
04/In code
Full examples with framework adapters live in the docs. This is the shape of what you wire into your app.
org-middleware.ts
Enforce organization-scoped RBAC on a Hono route. The middleware reads the session, resolves the current org, and checks the required scope.
import { Hono } from "hono";
import { kavachosOrg } from "kavachos/org";
const app = new Hono();
app.use("/orgs/:orgId/*", kavachosOrg({
requiredScope: "billing:read"
}));
app.get("/orgs/:orgId/invoices", async (c) => {
const { user, org, role, scopes } = c.get("kavachos");
// role is resolved from membership, scopes inherited from role.
return c.json(await listInvoices(org.id));
});
export default app;$79/mo
Growth plan with SSO + SCIM
Unlimited
Orgs per account
SAML + OIDC
SSO protocols included
SCIM 2.0
Provisioning out of the box
05/Before / after
Without scoped identity
With kavachOS
Our Auth0 renewal quote was forty thousand dollars a year, mostly SSO and per-org fees. We moved to KavachOS on the Growth plan for under a thousand. The migration took one engineer a week. That number still embarrasses me.
06/FAQ
Short answers. Link out to the docs if you want the long version.
07/Related reading
KavachOS includes orgs, SSO, SCIM, and customer-visible audit on the Growth plan. Move your existing users without password resets.