Teleport

Overview

Teleport provides identity-native access to servers, Kubernetes, databases, and applications using short-lived certificates instead of static credentials. Founded in 2015 with strong open-source roots, it reframes PAM for engineers: rather than vaulting and handing out passwords, it issues certificates tied to an SSO identity that expire automatically, so there are no standing secrets to steal.

Teleport extended that model to AI agents with Beams, announced 19 March 2026 with an MVP on 30 April. Each agent runs in an isolated Firecracker microVM with its own identity, reaching infrastructure and inference services without secrets and under the same audit trail. It governs agents you run on your own infrastructure, not SaaS assistants or third-party MCP servers.

What it is good at

Certificate-based access is the core, and it is a genuinely modern model: every connection is authenticated, authorized, and recorded against a real identity, with no shared keys or bastion sprawl. Kubernetes and cloud support are excellent, the audit trail is rich, and the developer experience is a clear strength, which is why platform engineers favor it. Source code is public under AGPL-3.0 and small teams can run Community Edition free, so engineers can evaluate the model before paying, and self-hosting gives control over the access plane.

Where it falls short

Teleport is access-and-identity native rather than a traditional vault, so password-centric legacy use cases (managing many static Windows admin credentials, classic vault workflows) are a weaker fit. Federation breadth and the support ecosystem trail the largest incumbents, and pricing for the enterprise tier is quote-based. Teams whose privileged estate is mostly legacy on-premises Windows will find a classic PAM suite more aligned.

Pricing

Three editions: Enterprise (Cloud), Enterprise (Self-Hosted), and Community Edition. Community Edition is not a free tier for everyone. Since Teleport 16 in June 2024 its binaries carry a commercial license that allows free use only for companies with fewer than 100 employees and under 10 million US dollars in annual revenue; the source on GitHub stays AGPL-3.0. Per the edition feature matrix (checked 2026-11-05), Community Edition supports GitHub as its only SSO provider, limits just-in-time access requests to the CLI, and leaves out Device Trust, session locks and moderation, SCIM, Access Lists and Reviews, Beams, HSM support, FIPS and FedRAMP builds, and premium support. Enterprise pricing is quote-based. Because self-hosting is viable, model the cost against per-seat commercial PAM with the TCO calculator.

Best for, and who should look elsewhere

Choose Teleport when identity-native, certificate-based access for engineers and modern infrastructure is the goal. For the proxy-broker alternative, see Teleport vs StrongDM; for the HashiCorp-stack approach, see HashiCorp Boundary; for credential-vaulting-first enterprise PAM, see CyberArk vs BeyondTrust.

Bottom line

A leading identity-native access platform for modern infrastructure, loved by platform engineers, and less suited to legacy password-vaulting scenarios.