Crossing $1M in revenue turns Duende's free IdentityServer tier into a $12,500 bill

The archived repository is the most direct source on the risk. IdentityServer4 "went out of support when .NET Core 3.1 end of support was reached (13th Dec 2022)," the notice states, and the same text says the codebase "contains multiple known security vulnerabilities and bugs, and has outdated documentation" ^[1][2]. Nobody publishes advisories against it now, so there is no patch stream to diff your deployment against. The dev.to post is right about the failure mode: an outdated logging library fails loudly, while an outdated authorization server keeps issuing tokens and authenticating users with no indication that a known redirect-URI bypass or token-validation flaw applies to your exact deployment ^[4].

Duende is the shortest move in code. It is built by the original IS4 authors, and the configuration model, the extensibility points and the mental model carry over closely ^[6]. The meter is client IDs and production deployments. Community Edition matches Standard's feature set, so an organization that outgrows the thresholds lands on Standard's list price of $12,500 a year ^[2], and the post says the move is to a paid tier on the same platform ^[8]. Per included client ID, the tiers work out at $2,875 for Lite, $1,250 for Standard and $830 for Advanced ^[1].

Duende ships the framework. Admin UI, theming and email templates are not included, and the post says teams build them or buy them separately, commonly from third-party vendors in the ecosystem ^[9].

Rock Solid Knowledge sells into that gap. Its Open.IdentityServer continues the Apache-2.0 IS4 codebase as a free open-source SDK, described in the post as an actively maintained fork with new fixes and features ^[10]. RSK states the project is not affiliated with or endorsed by Duende Software ^[11]. The free-forever part is the protocol SDK; the admin UI, email builder and theme builder are not in it ^[12]. AdminUI Universal, covering multiple environments, is £8,932 a year, and a Supporter License bundling AdminUI with passkeys, SAML, SCIM, WS-Fed, key rotation and policy-based access control is £5,750 a year ^[13][14]. The post's own conclusion on that stack: once you add a management UI to the free core, the total is comparable to, and sometimes above, a batteries-included commercial product ^[15].

The two nearest paths bill in dollars and pounds, so a head-to-head depends on the rate the day you sign. All figures in the post were verified in September 2026 from each vendor's own pricing and product pages, and the post tells readers to check current numbers before deciding ^[18]. The comparison covers six paths: Duende, Open.IdentityServer, OpenIddict, Keycloak, a cloud identity provider and IdentitySuite, scored on cost, effort, stack fit and data control ^[17]. OpenIddict, one of the six, is a free Apache-2.0-licensed OAuth 2.0 and OpenID Connect framework for .NET ^[16].