Hoq ID and platform

One sign-in, one organization and one drive across every Hoq app.

Open Hoq ID and platformLive19 featuresid.hoq.app

What it does

Hoq ID is the one account behind every Hoq app. You sign in with a code sent to your email or with a passkey, and no password is needed. You can add an authenticator app as a second step and keep recovery codes. Several accounts can be signed in on one browser, and you switch between them from the account menu.

An organization holds people with one of three roles: member, admin or owner. Admins invite people by email, and an invitation lasts 7 days. An organization turns apps on for its members and can limit a paid app to a set number of seats. Lowering a seat limit never takes an app away from someone who already has it. You can claim your company's domain with a DNS TXT record.

Every app checks access at one gate when you sign in to it, and the app switcher shows only the apps you may open. Files you make in any app land in one Hoq Storage drive. Programs reach apps with API keys that carry named scopes, and several apps serve MCP so AI agents can work in them with their own keys.

Organizations are on the Free, Team or Business plan. Usage-based services draw from a prepaid credit balance, and when an organization pays for AI, an empty balance stops the work rather than charging the person.

In numbers

3organization plans: Free, Team and Business

1,000,000AI input tokens included each month for every organization, plus 200,000 output tokens

7 daysbefore an unused invitation expires

14 daysnotice to people already using a domain before it becomes an organization's managed domain

108named API scopes an app or key can ask for

Specifications

Sign-in	An emailed code or a passkey on the sign-in page; a password if you set one. Authenticator-app codes as a second step, and recovery codes.
Several accounts	Sign in to several accounts in one browser and switch between them. The list is kept on the server, so your devices page is the same list.
Sign in on a device	A TV or terminal shows a code; you approve it from your phone at id.hoq.app/device.
Roles	Member, admin and owner. An admin cannot invite above their own role or demote the owner.
Invitations	Sent by email, bound to that address, valid 7 days.
Seats	Per app per organization. No limit means every member. Lowering the limit never removes anyone.
Domain claim	Prove you control a domain with a TXT record at _hoq-verify.<domain>. People who sign up at that domain get an invitation, not an automatic membership.
Outside apps	Apps not made by Hoq show a consent card listing every scope they ask for, and you can withdraw access later.
API keys	Every key is issued by Hoq ID and carries named scopes, such as files:read or sensor:post.
Plans	Free: up to 5 people, 3 mail seats, 5 GB mail storage. Team: mail seats for everyone, 10 GB mail per person, 30 days of deleted mail. Business: 50 GB mail per person, 90 days of deleted mail, a named support contact.

Features

19 features, all shipped. Listed from the product's code and documentation; each row shows the day it was last checked.

Sign-in 6
Email code	Type your email, get a code, no password.
Passkeys	Sign in with a passkey on the first screen.
Second step	Authenticator-app codes after the first factor.
Recovery codes	Get back in when you lose your other factors.
Account roster	Several accounts signed in at once, switched from the menu.
Device sign-in	Approve a TV or terminal from your phone.

Organizations 5
Roles	Member, admin, owner, with last-owner protection.
Invitations	Email-bound, 7-day invitations, accepted with an explicit click.
Apps and seats	Turn apps on for the organization and assign seats to named people.
Domain claim	Verify a domain by DNS TXT and invite people who sign up with it.
Plans	Free, Team and Business, upgraded now and downgraded at term end.

Access 5
One gate	Every app's access is decided once, at sign-in to that app.
App switcher	A menu in every app listing the apps you may open.
Scoped API keys	Keys carry named scopes; a key never works beyond them.
Consent for outside apps	Third-party apps ask once and can be removed from your account page.
MCP for agents	Todo, Board, Crew, Books and DB serve MCP to AI agents with their own keys.

Storage and billing 3
One drive	Documents from Docs, Sheets, Slides and other apps are saved to your Hoq Storage drive with versions.
Prepaid credit	Usage draws from a credit balance; renewals fall back to a card top-up.
Organization pays for AI	Members' AI use bills to the organization; an empty balance refuses rather than charging the person.

Works with

Hoq StorageEvery app saves into the same Hoq Storage drive.
Hoq IntelligenceAI use is metered through Hoq Intelligence and billed to the payer Hoq ID chooses.
Hoq ScreenEvery Hoq app signs in through Hoq ID and checks the same entitlement.

Your data

Where it is kept	Your account, sessions, passkeys and organization records are in Hoq ID's database. Files are in your Hoq Storage drive.
Getting it out	Not documented as a single account export.
If you leave	You can delete your account from the account page. An organization on a paid plan cannot be deleted until the plan ends; plan history is kept.

APIs and standards

OAuth 2.0 authorization code with PKCE at /authorize and /token
Device sign-in at /device
API keys with scopes, managed at id.hoq.app
MCP servers in Todo, Board, Crew, Books and DB
Standard: OAuth 2.0
Standard: PKCE
Standard: WebAuthn passkeys
Standard: TOTP
Standard: DNS TXT verification
Standard: Model Context Protocol

Compared

Checked 2026-11-01	Hoq ID and platform	Google Workspace	Microsoft Entra ID	Okta Workforce Identity
Cheapest paid price	Not published yet	$7.00 per user per month (Starter, monthly)¹	$7.00 per user per month (P1, paid yearly)²	$6 per user per month, billed annually, $1,500 yearly minimum³
Free tier	Free plan: up to 5 people, 3 mail seats, 5 GB mail	Essentials Starter, no Gmail⁴	Entra ID Free: MFA and SSO²	None; 30-day trial³
Passkeys	Yes, on the first sign-in screen; no password needed	Yes⁵	Yes, device-bound or synced⁶	Yes⁷
Single sign-on to outside apps	OAuth 2.0 with consent; no SAML	SAML and OIDC with an app catalog⁸	SAML and OIDC²	SAML and OIDC in every suite³
Organizations and roles	Organizations with member, admin, owner; seats per app	Org units, groups, built-in and custom admin roles⁹	Groups, admin units, built-in and custom roles¹⁰	Groups, standard and custom admin roles¹¹
API access	API keys with named scopes, one issuer	OAuth 2.0 scopes and service accounts¹²	Microsoft Graph OAuth permissions¹³	OAuth 2.0 scoped tokens and API tokens¹⁴
Storage	One Hoq Storage drive for every app	30 GB pooled per user (Starter)¹	None in Entra; 1 TB OneDrive in Microsoft 365 Business Basic¹⁵	None³
MCP for AI agents	Served by several apps (Todo, Board, Crew, Books, DB)	Official MCP servers for Gmail, Drive, Calendar and more, some in preview¹⁶	MCP Server for Enterprise, public preview, read-only¹⁷	Official MCP server, self-hosted or Okta-managed¹⁸