· ReadyStack
Worked example
Real numbers from this tool, line by line.
6 findings and a 16,500 USD-a-year Duende bill: that is what one .NET team's Program.cs returns when a backend developer runs it through OpenIddict Migration Check, a VS Code extension with 18 rules that maps every Duende IdentityServer call to its OpenIddict replacement.
What Duende changed, in Duende's own terms
Duende IdentityServer is free only as the Community edition, for for-profit companies with "less than $1M USD projected annual gross revenue and access to less than $3M USD in capital facilities" (duendesoftware.com/products/communityedition). Everyone else pays yearly. The list prices on duendesoftware.com/pricing, checked 2026-09-29, are Lite 5,750 USD (2 client IDs), Standard 12,500 USD (10 client IDs) and Advanced 24,900 USD (30 client IDs). Automatic key management sits in Advanced, or as a 4,000 USD add-on on Standard. The free predecessor, IdentityServer4, reached end of support on 2022-12-13 and gets no security fixes.
OpenIddict is Apache-2.0. The question every team above the Community line has to answer before the renewal date is simple: what does our setup cost on Duende, and what breaks if we move?
The sample file
The sample is the Program.cs most Duende projects start from: AddIdentityServer with in-memory identity resources, API scopes and clients, server-side sessions switched on, and three clients (a client-credentials worker, a web app and a mobile app). The check reports:
- duende-licence: the Duende.IdentityServer namespace. Swap to OpenIddict.AspNetCore and OpenIddict.EntityFrameworkCore.
- host-wiring: AddIdentityServer and UseIdentityServer. Replace with AddOpenIddict().AddCore().AddServer(). OpenIddict enables no endpoint by default, so set SetTokenEndpointUris("connect/token") or every client gets a 404.
- inmemory-config: the in-memory clients and scopes. Seed them through IOpenIddictApplicationManager; each AllowedGrantTypes value becomes a Permissions.GrantTypes entry, and each flow must be switched on.
- key-management: KeyManagement.Enabled = false is missing, so automatic key management stays in use. OpenIddict does not generate or rotate keys; you load certificates yourself.
- server-side-sessions: a Standard feature. OpenIddict has no equivalent; keep the login session in the ASP.NET Core cookie with a custom ITicketStore.
- edition: 3 clients plus those two features means the cheapest Duende option is Standard plus the key management add-on, 16,500 USD a year at list price.
What changes with other inputs
A two-client setup with KeyManagement.Enabled = false and its own signing credential drops to Lite at 5,750 USD a year. An IdentityServer4 app with 12 clients gets an end-of-support warning with the day count, and the 12 clients alone push a Duende upgrade to Advanced at 24,900 USD.
What a chatbot misses
Ask a chatbot to port AddIdentityServer and it will write an AddOpenIddict block. It will not tell you that OpenIddict encrypts access tokens by default, so APIs validating plain JWTs need DisableAccessTokenEncryption() or the OpenIddict validation handler. It will not count your clients against Duende's tiers. The check reads your file, so the list is yours.
Try it
The free scan works on the open file in VS Code or in the web version at getreadystack.com/tools/openiddict-migration-check, with no key and no limit. The full version scans every project in a solution and exports a migration plan per project.
15 seconds — what it actually does
Questions people ask
What does OpenIddict Migration Check do?
It reads a Program.cs, Startup.cs or .csproj and flags every Duende IdentityServer or IdentityServer4 call with its OpenIddict replacement, using 18 rules. On the sample Program.cs it reports 6 findings: the Duende licence, host wiring, in-memory configuration, automatic key management, server-side sessions, and the cheapest Duende edition for that setup, 16,500 USD a year.
Who is this for?
.NET teams running Duende IdentityServer or the unsupported IdentityServer4 who are above the Duende Community edition limit of 1M USD annual revenue or 3M USD capital, and who must decide before the next renewal whether to pay for a Duende edition or move the token server to OpenIddict.
Why not just ask a chatbot or read the OpenIddict samples?
A chatbot rewrites one call at a time and does not know which Duende edition your features belong to. The samples show a fresh OpenIddict server, not your file. This check reads your actual code, names each Duende feature it finds, prices the edition it needs and lists the OpenIddict defaults that break clients, such as endpoints off by default.
What is free and what does the full version add?
Free: scan the open file, with every finding, its OpenIddict replacement and the Duende edition price, with no key and no limit. The full version, a one-time payment, scans every project in the solution at once and exports a migration plan per project as Markdown or CSV for the pull request and the licence review.
What does staying on Duende cost compared to this?
Duende IdentityServer list prices are Lite 5,750 USD a year for 2 clients, Standard 12,500 USD for 10 clients and Advanced 24,900 USD for 30 clients, with automatic key management a 4,000 USD add-on on Standard. OpenIddict is Apache-2.0 with no licence fee. The check shows which of those prices your file needs.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.