For Authentik, Okta, and Auth0
Your identity provider has no undo button. Now it does.
IdPVault is self-hosted backup, drift detection, and restore for your IdP. Encrypted snapshots of every app, flow, policy, user, and assignment - diffable, restorable, and entirely on your hardware.
374 objects across 12 types in a single snapshot · One compose file, any platform (amd64 + arm64) · Open-core on GitHub, full changelog published
Know what changed.
Every backup diffs against the last. A deleted flow, a modified policy, a new admin - it shows up in your events feed and your inbox, not in a postmortem.
Get it back.
Config restore with dry-run preview: see exactly what would change before it changes. Users & Access restore brings back users, group memberships, and app assignments.
Own your data.
Self-hosted, encrypted at rest, zero telemetry. License keys verify offline. IdPVault never phones home - we could not see your data if we wanted to.
Everything a backup tool owes you
Config backup
Applications, providers, flows, stages, policies, groups, mappings - snapshotted on your schedule, encrypted before they touch disk.
Drift detection
The unbacked-changes counter reads the provider's own event log, so you know about changes before your next backup runs.
Config restore
Selective restore with a dry-run preview of every add, update, and delete.
Users & Access
Back up and restore users, memberships, and app assignments across all three providers. Business and MSP plans.
Alerts
Email or webhook on drift, failures, and restores - you choose what is worth waking up for.
Security
Envelope encryption (AES-256-GCM), scrypt passwords, TOTP MFA, server-side sessions, audit log, roles enforced at the API.
Zero-config deploy
One compose file. Linux, macOS, Windows, ARM - amd64 and arm64 images under a single tag.
No lock-in
Snapshots are JSON on your disk. Source available on GitHub under BSL 1.1.
Up and running in four steps
docker compose up
No config required - keys generate themselves on first boot.
Connect a tenant
Paste an API token. It is encrypted immediately (AES-256-GCM) and never stored in plain text.
Backups run themselves
Schedules run in your timezone; every change is diffed, logged, and alertable.
Restore anything
From any snapshot, selectively. Dry-run first, always.
For managed service providers
Built for MSPs from day one
Run every client's IdP from one pane of glass. Group tenants into client orgs and give clients scoped logins that see only their own tenants - org admins can back up and restore, org viewers are read-only, and other clients are invisible, not just hidden.
Renewal dates and billing memos live next to the tenants they belong to. Onboard an entire client book with one CSV import.
See MSP pricing
Flat pricing. No per-user math.
Your IdP bills per user. Your backup tool should not.
Community
Free forever
The full binary, one tenant. The trial that never expires.
Deploy from GitHubBusiness
$2,500/yr
4 tenants, unlimited users, Users & Access backup and restore.
Buy BusinessMSP
$2,500/yr + $399/tenant/yr
Everything in Business plus client orgs, scoped logins, and renewals tracking. Add tenants any time from the Stripe portal.
| Community | Business | MSP | |
|---|---|---|---|
| Tenants | 1 | 4 | 4 included, +$399/yr each additional |
| Users | 1 admin | Unlimited | Unlimited + client org logins |
| Config backup, drift, restore | Yes | Yes | Yes |
| Users & Access backup & restore | - | Yes | Yes |
| Client orgs + scoped roles | - | - | Yes |
Keys verify offline and never phone home. Renewal keys extend from your previous
expiry, so renewing early never costs you time. Add MSP tenants any time from the
Stripe portal - a replacement key arrives by email within a minute.
Existing customers: add tenants or manage your subscription here.