Proven with Industry Leaders
WSO2 publishes its products as open source and sells a subscription for its commercial distribution. The software is functionally the same. What the subscription buys is the right to run the commercial distribution, security and bug fixes delivered as they are released, and WSO2's own support.
| What to compare | Open source, no subscription | WSO2 subscription |
|---|---|---|
| What you run | Community releases built from the open-source code. | WSO2’s commercial distribution, under the WSO2 Software License. |
| Security and bug fixes | Arrive in the next public release. | Delivered to your installation as they are released, through WSO2 Updates 2.0. |
| Vendor support | None. Community channels only. | Unlimited incident tickets on a Basic or Enterprise support plan, plus capped query support. |
| Partner support | Available. A partner can support the deployment, but cannot supply WSO2’s commercial updates. | Available, alongside WSO2’s own support. |
| License cost | None. | A subscription, quoted by WSO2 or a reseller. |
Source: WSO2 subscription FAQ. Confirm current terms with WSO2 or your reseller.
WSO2 does not publish a price list for self-hosted subscriptions; every quote is built from four things.
Self-hosted, WSO2-run private cloud, or WSO2 SaaS. The same capability can carry a different pricing model depending on where it runs.
WSO2 prices subscriptions either on usage (deployed APIs, MCP servers, and LLM proxies; integration entry points; monthly transactions; and identity users) or per core. Which model applies depends on the product, the deployment, and the contract, and each deployment is quoted individually.
Production and non-production environments are rarely priced the same way. Confirm how your quote counts each one before you compare offers.
WSO2 offers two support plans, Basic and Enterprise, with Enterprise covering 24x7x365, and an optional named WSO2 consultant on top. The plan follows how critical the platform is.
The SaaS version of the WSO2 Identity Platform (Asgardeo) publishes its tiers: free up to 15,000 monthly active users, a Growth tier starting at $25 a month with 3,500 monthly active users included, and custom Enterprise pricing. Self-hosted and private-cloud identity sit in the Enterprise tier and are quoted. Source: WSO2 Identity Platform pricing.
A subscription and a partner buy different things, so their prices are not substitutes. Many organizations hold both. As a WSO2 reseller, we size the subscription against the estate you actually run, and price our own WSO2 support services by the coverage model you choose.
Incident response, patching, and upgrades for the platform you run, priced by the hours and criticality you need covered, from business hours through 24x7.
A team that manages and develops your WSO2 environment. You pay for a small persistent core of senior specialists, plus engineers added within an agreed lead time, typically weeks, when an initiative needs them. One P&C insurer runs on a core of two that has ramped to ten. See the outsourced WSO2 integration team.
| What to compare | WSO2 subscription | Partner support |
|---|---|---|
| What you pay for | A license to the commercial distribution, updates, and vendor support. | Engineers who operate, upgrade, and change your deployment. |
| How it is priced | Usage-based or per-core, quoted per deployment by WSO2 or a reseller. | Either by coverage model, from business hours through 24x7, or as an outsourced team: a persistent core plus capacity added on an agreed lead time. |
| What it does not cover | Building your integrations, running upgrades, operating environments, or staffing your team. | WSO2’s commercial updates, which only come with a subscription. |
These show which factors set the price, not what the price is. Every real quote depends on your counts.
The cost is set by how many identity users and APIs are in scope, the transaction volume through the gateway, and the support plan. Customer-facing identity and payment APIs usually justify a subscription with 24x7 support, because a security fix that waits for the next release is an open exposure. Partner support then covers upgrades, operations, and the integrations the subscription does not build.
WSO2 operates the control plane, so the subscription is driven by usage rather than infrastructure you size. If the insurer runs private data planes in its own environment, it still carries that infrastructure cost itself. Partner work is mostly design and build: integrations, policies, and the data-plane setup. Whether SaaS fits a regulated insurer at all is the first question; see Bijira vs API Manager.
Bijira vs API ManagerThe cost is set by the number of integration entry points (APIs, proxy services, inbound endpoints, scheduled tasks) and transaction volume. If the integrations are internal and not time-critical, the Basic plan may be enough. If they carry citizen-facing services, the case for Enterprise support, with 24x7 coverage and immediate security fixes, is much stronger.
The deciding factor is not cost. It is how long you can live with a known security fix that has not reached your installation, because open-source users get fixes only in the next release. We support open-source deployments, and we tell clients plainly when the exposure is too large.
A quote built on guesses gets renegotiated at renewal. These five steps give WSO2 or a reseller what they need to price it once. If WSO2 is new to your estate, our WSO2 consulting practice can help with the inventory.
Products, versions, and where each runs: self-hosted, private cloud, or SaaS.
APIs and proxies, integration entry points, monthly transactions, and identity users, per environment.
Basic or Enterprise, set by the components in the path of revenue, customers, or regulatory reporting.
Which operations, upgrades, and build work your team will carry, and which it will not.
From WSO2 directly or through a reseller who sizes it against the estate you actually run.
WSO2 quotes subscriptions individually rather than publishing a self-hosted price list. The cost depends on the products, how you deploy them, your usage (APIs, integrations, transactions, or identity users), and whether you choose Basic or Enterprise support. Partner support is priced separately, by the coverage model and scope you choose.
The open-source releases are free to download and run. What costs money is the commercial distribution: real-time security and bug fixes through WSO2 Updates, and WSO2’s own support. Open-source users get fixes only in the next public release and rely on community support or a partner.
Self-hosted Identity Server is sold under an enterprise subscription quoted by WSO2, which may be based on cores or on users depending on the contract. The SaaS version of the WSO2 Identity Platform (Asgardeo) has published tiers: a free tier for up to 15,000 monthly active users, a Growth tier starting at $25 a month, and custom Enterprise pricing.
A license to WSO2’s commercial distribution, access to WSO2 Updates 2.0 for security patches and bug fixes as they are released, unlimited incident support on a Basic or Enterprise plan, and query support for questions about usage, development, or migration, with hourly limits.
They buy different things, so the comparison is rarely like for like. A subscription buys the commercial distribution, updates, and vendor support. Partner support buys engineers who operate, upgrade, and change your deployment. Many organizations need both; some low-criticality deployments run on open source with partner support only.
Around a persistent core team of senior integration specialists, sized to your steady-state workload, plus additional engineers added within a lead time agreed in the contract, typically weeks, when an initiative needs them. You pay for the core continuously and for surge capacity only while you use it.
Yes. The open-source release can run in production with no license fee. The trade-off is that security and bug fixes arrive only in the next release, and there is no vendor support. That is defensible for internal, non-critical workloads with a skilled team, and hard to defend for internet-facing APIs or regulated data.
