Langflow Pricing: The Bill Arrives Per Run, Not Per Seat

Langflow pricing has no price list. The software is MIT-licensed and free to download, and the vendor publishes no tiers, no seat rates, and no per-workflow fee. What you pay instead is a variable monthly bill assembled from four suppliers you choose yourself: model tokens, compute, retrieval, and observability. The unit is the run, not the seat.

Our position is that the seat-versus-run distinction is the whole story, and that it is why Langflow budgets are wrong so often. Every managed automation platform charges you for a countable thing you provision in advance: a user, a task, an operation. Langflow charges you for something you emit at runtime, and the visual canvas is very good at hiding how much of it a single flow emits. One Langflow user, filing GitHub issue #8701 in June 2025, measured a default agent tool injecting roughly 4,600 tokens into the system prompt before the agent did any work, rising to about 9,600 once a second date component was wired in. The caption on the attached screenshot was blunt: the tool generated those tokens "without doing anything". Nobody provisioned them. They arrived because a node was on the canvas.

The short answer: Langflow itself costs nothing, so budget the run. Multiply monthly runs by model calls per run by tokens per call by your provider's published rate, then add compute, vector storage, observability, and the security maintenance a self-hosted deployment obliges you to fund.

Last updated: July 30, 2026.

One licence line replaced by six variable ones. The shape of a Langflow bill.

We should say plainly what this article is and is not. Nobody on our side has run a production Langflow deployment for a month and published the metered bill, so every figure below is derived from vendor list prices we fetched on 30 July 2026 and from arithmetic we show in full. Where a number is our estimate rather than a published rate, it is labelled. Treat the formula as the deliverable and our example numbers as an illustration you should replace.

What Langflow Actually Costs: Four Invoices, No Licence

Langflow is distributed under the MIT licence, confirmed in the project's LICENSE file on GitHub, where the repository carries over 152,000 stars as of 30 July 2026. There is no paid edition of the software you must buy to use it commercially. The langflow.org site offers a free cloud account and states that it is the same Langflow whether you use the open-source build or the cloud, and it publishes no tier table, no seat price and no usage rate card.

That absence is the correct answer to the Langflow pricing question, and it is also the trap. A tool with no invoice attached tends to get approved without a budget line, and then produces invoices from four other companies that nobody assigned an owner to.

Six rows, and only one of them is zero. The rest of this article prices each one from published rates, and then tells you which two most often break a budget.

Why the Run Is the Right Unit of Account

A per-seat platform lets you forecast by counting people. Langflow does not, because a Langflow deployment with three builders can emit ten million tokens a month or ten billion depending on what those three people drew. Cost tracks execution volume and prompt size, and both are properties of the flow rather than the org chart.

This matters for procurement in a specific way. If you approve Langflow on a per-seat mental model — "three engineers want it, it is free, approve it" — you have approved an open-ended liability with no cap attached. The competitor articles on this keyword tend to segment budgets by team size: solo builder, startup, enterprise. Team size is the wrong independent variable. A two-person team running a customer-facing retrieval agent at 500,000 monthly requests will out-spend a fifty-person team running nightly internal summaries by an order of magnitude, and no headcount-keyed budget tier predicts that.

The variables that actually move the bill are: how many times the flow runs, how many model calls each run makes, how many tokens each call carries, and how often the whole thing retries. Everything else is rounding. Our earlier analysis of enterprise AI implementation cost found that the licence is roughly a third of year-one spend even when there is a licence. With Langflow the licence is zero, so the ratio is not two-thirds hidden. It is all of it.

The Run Ledger: Six Inputs You Can Fill In Today

We call the following the Run Ledger, and it is the one artifact worth taking away from this page. It is a formula with six named inputs, and you can fill in five of them from your own flow in about twenty minutes.

Monthly model spend = R x C x ((Ti x Pi) + (To x Po)) / 1,000,000 x F

Two of those inputs are the ones people get wrong. C is wrong because a builder counts the model nodes visible on the canvas and forgets that an agent node is a loop, not a call. Three tool-use iterations mean three round trips, each carrying the full conversation so far. Ti is wrong because the system prompt on screen is not the system prompt that ships; tool schemas, retrieved chunks and message history are appended invisibly.

Here is the ledger filled in for a plausible internal support-triage flow at 20,000 runs a month, using rates published on the vendors' own pages and fetched 30 July 2026. "Lean" is one model call per run carrying 1,500 input tokens; "as-built" is the same flow after an agent node with three average iterations and 6,000 input tokens per call, with a 1.25 retry multiplier instead of 1.05.

Rates used: OpenAI's published pricing lists gpt-5.4-mini at $0.75 per million input tokens and $4.50 per million output tokens; Anthropic's pricing page lists Claude Sonnet 5 at $2 per million input and $10 per million output, noting that $2/$10 is introductory pricing through 31 August 2026 and reverts to $3/$15 afterwards. Output length is held at 400 tokens in all four rows. The arithmetic is ours; the rates are theirs.

The spread is the point. Same flow, same platform, same monthly volume, and a 19x difference between the cheapest and dearest row, none of which is a licence decision. Three design choices did that: which model, how many iterations, how fat the prompt.

Note the last row against a managed platform quote. Once a Langflow flow is doing real customer-facing work on a frontier model, $14,400 a year in tokens alone is in the same range as a mid-market automation subscription, before compute, before retrieval, before the engineer maintaining it.

Cost Line One: Model Tokens, and What the Canvas Hides

Model inference is the largest and least predictable line in most Langflow deployments, and the visual builder actively obscures it, because a node's cost is invisible on the canvas while its position is not. Two GitHub issues make this concrete rather than theoretical.

In May 2025, a user filing issue #8226 reported that the agent's default time tool injected a full list of world timezones rather than a numeric offset, describing the result as "4000 tokens before it even gets to anything important". A month later, issue #8701 put a measurement on the same behaviour: roughly 4,600 tokens per run from the default current-date tool, roughly 9,600 when an explicit date component was also connected. Both issues are now closed, and we have not re-tested current builds, so treat them as an illustration of the class of problem rather than a live defect. The class is what matters: a default component you did not choose can add several thousand input tokens to every single call, and nothing in the interface shows you a number.

Apply the Run Ledger to that specific case. At 20,000 runs a month, three calls per run, and gpt-5.4-mini's $0.75 per million input tokens, an extra 4,600 tokens per call costs 20,000 x 3 x 4,600 x $0.75 / 1,000,000 = $207 a month, or roughly $2,484 a year, for a timezone list nobody read. On Claude Sonnet 5's $2 per million input rate the same overhead is $552 a month.

Three failure modes account for most token blowouts we can identify from public reports and vendor documentation:

• Unbounded agent loops. An agent that cannot decide when to stop keeps calling. Each iteration resends the growing conversation, so cost grows faster than linearly in iterations. A hard iteration cap is the single cheapest control available.
• Unbounded context. Retrieval nodes configured to return generous numbers of chunks, plus full conversation history, plus tool schemas, produce input token counts that dwarf the user's actual question. Input tokens are usually the majority of the bill in agentic flows, not output tokens.
• Retry storms. A downstream connector timing out inside a flow that retries at the flow level rather than the node level re-runs the model calls that already succeeded. The retry multiplier F is where this shows up, and it is the input people most often set to 1.0.

Two mitigations are worth naming because both are free. Prompt caching cuts the price of repeated input dramatically. OpenAI's rate card shows cached input for gpt-5.4-mini at $0.075 per million against $0.75 standard, a tenfold reduction on the portion of your prompt that does not change between calls, and Anthropic prices cache reads for Sonnet 5 at $0.20 per million against $2 standard. Routing the cheap steps of a flow to a cheap model is the other; we set out the mechanics in our analysis of how AI model routing cuts LLM costs. In the table above, moving the as-built flow from Sonnet 5 to gpt-5.4-mini is a $8,730 annual difference on its own.

Cost Line Two: Compute and the State You Did Not Plan For

Compute is the most predictable line and the smallest one for most teams, which is why it gets over-discussed. A single Langflow server that serves a handful of internal flows fits comfortably on a small virtual machine. DigitalOcean's published Droplet pricing, fetched 30 July 2026, lists a 4 GiB / 2 vCPU Basic Droplet at $24.00 per month and an 8 GiB / 4 vCPU at $48.00 per month, with per-second billing introduced from 1 January 2026.

The trap in this line is not the instance. It is state. Langflow's documentation says the default storage option is a SQLite database on local disk, with the file path varying by installation method, and it points to an external PostgreSQL database as the alternative for production. A SQLite file on a container's local disk is not a production datastore: it does not survive a redeploy on ephemeral storage, it does not support two Langflow replicas, and it is where your flows, your users and your chat history live.

So the honest compute line for a production Langflow deployment is not one droplet. It is:

• The Langflow server itself, sized for concurrency rather than for the number of flows.
• A managed PostgreSQL instance, or a self-run one plus the backup discipline that goes with it. We did not verify a specific managed-Postgres list price for this article, so leave it as an input on your own provider's rate card rather than trusting a round number.
• A reverse proxy with TLS. Langflow's deployment documentation walks through Docker plus Caddy, or Nginx with Let's Encrypt, or Kubernetes for high availability: three different amounts of engineering, all of them yours.
• Whatever you run for the connectors your flows call, which is frequently more infrastructure than Langflow itself.

Kubernetes deserves a note, because it is where the compute line quietly becomes a headcount line. Langflow documents a Kubernetes path for "production-grade deployments with high availability, scalability, and robust orchestration". If your organisation already runs Kubernetes, that is nearly free. If it does not, the cluster you stand up for a flow builder is the most expensive thing on this page and it will not appear in any cost table. Our earlier comparison of self-hosted AI deployment against SaaS sets out how to make that call without re-arguing it here.

Cost Line Three: Retrieval, Where Re-Indexing Eats the Budget

You do not need a vector database to run Langflow. You need one the moment a flow answers questions from your own documents, which is what most Langflow flows end up doing. Retrieval then adds two separate charges: a standing platform fee, and an embedding charge that is spiky rather than steady.

Pinecone's published pricing, fetched 30 July 2026, lists four tiers: a free Starter plan; Builder at $20 per month flat; Standard at a $50 per month usage minimum, which is the first tier to include RBAC and SAML 2.0 single sign-on; and Enterprise at a $500 per month usage minimum, which is where audit logs, bring-your-own-cloud, private endpoints and customer-managed encryption keys begin.

Read that ladder as a governance ladder rather than a capacity one. The jump from $50 to $500 a month is not mostly about vectors. It is about audit logs and key custody, controls a regulated buyer needs on day one and a hobbyist never needs at all. If your compliance function requires an audit trail over what the retrieval layer returned, your vector store floor is $6,000 a year, and that has nothing to do with how many documents you have.

The embedding charge behaves differently from everything else in this article, because it is not proportional to traffic. It is proportional to how often you rebuild the index. Re-embedding a corpus is a one-off cost each time, and the pattern that surprises people is a CI pipeline that re-indexes the whole knowledge base on every deploy. Ten deploys in a week means ten full re-embeddings of a corpus you did not change. That is a design defect that shows up as a billing anomaly, and the fix is content hashing rather than a cheaper embedding model.

There is a third path worth pricing: not running a vector store at all. OpenAI's rate card prices a hosted file-search tool at $2.50 per 1,000 calls plus $0.10 per GB per day of storage with the first GB free, and a web-search tool at $10 per 1,000 calls. For a low-volume internal flow, hosted retrieval at $2.50 per thousand queries undercuts a $50 monthly minimum until you pass roughly 20,000 queries a month. Above that, the dedicated store wins. The crossover is arithmetic, not ideology.

Cost Line Four: Buying Back the Observability You Gave Up

Here is the structural fact that most Langflow cost breakdowns skip: the tracing you need in order to run the Run Ledger at all is a separate purchase, and its governance features sit at the top of someone else's pricing page.

You cannot manage a variable bill you cannot see. To fill in C, Ti, To and F with measured values rather than guesses, you need per-run traces with token counts attached. Langfuse's published pricing, fetched 30 July 2026, is a clear example of the shape this takes: a free Hobby plan with 50,000 units a month and 30 days of data access, capped at two users; a Core plan at $29 per month with 100,000 units and additional units at $8 per 100,000; a Pro plan at $199 per month adding three years of data access, SOC 2 and ISO 27001 reports and a HIPAA-ready region; and enterprise SSO, SSO enforcement and fine-grained RBAC available as a Teams add-on at $300 per month on top.

Add those two lines and the observability layer for a governed deployment is $499 per month, or $5,988 a year, before a single token is spent. That is not a criticism of the vendor's packaging, which is ordinary. It is a statement about the true price of a free builder: the parts an enterprise buyer cannot go without are exactly the parts that carry a price tag.

The obvious rebuttal is that Langfuse, like Langflow, can be self-hosted, and its pricing page publishes self-hosting guides for Docker Compose, Kubernetes and three cloud providers. That is true and it is the right choice for some teams. It also does exactly what self-hosting Langflow does: it converts a monthly invoice into a second service your team runs, backs up, upgrades and patches. You have not removed the cost, you have moved it from the row labelled "tracing" to the row labelled "maintenance", where it is harder to see and harder to cap.

The 30 July 2026 rates in that table describe two vendors and are not a market survey. Check your own candidates, because the tier at which access controls appear varies more between vendors than headline prices do.

On the Langflow side, single sign-on is possible and unpriced, in the sense that you build it. The external authentication documentation describes putting an OIDC proxy or corporate SSO gateway in front of Langflow, validating forwarded tokens against the identity provider's JWKS endpoint and auto-provisioning users, with a worked Keycloak example including realms, clients, audience mappers and token claims. That is a real capability and a genuine advantage of open source. It is also several engineer-days of setup and an ongoing maintenance obligation, which is a cost, just not one that arrives as an invoice.

The Fifth Invoice: The Patch Treadmill Nobody Budgets

This is the line item that separates a self-hosted Langflow budget from a managed platform subscription, and no competing article on this keyword prices it. When you self-host, you own the patch obligation, and Langflow's public vulnerability record shows what that obligation has actually looked like.

Five Langflow vulnerabilities appear in the CISA Known Exploited Vulnerabilities catalog, the US government's list of flaws with confirmed exploitation in the wild, which carried 1,656 entries in the release dated 29 July 2026. Every row below was read from the catalog's published JSON feed and cross-checked against NIST's National Vulnerability Database on 30 July 2026.

Three details deserve reading twice. CVE-2025-3248, described by NVD as code injection in the /api/v1/validate/code endpoint allowing "a remote and unauthenticated attacker" to execute arbitrary code in versions before 1.3.0, is flagged in the KEV catalog as known to be used in ransomware campaigns. CVE-2026-0770, added on 21 July 2026, is another unauthenticated remote code execution issue rated 9.8. And two of the five carried a three-day federal remediation deadline, which is what a same-week emergency upgrade looks like when translated into a calendar.

Convert that into money the way a procurement review would. Five emergency patch cycles in roughly fifteen months, each consuming an engineer for something between half a day and two days including regression testing on your own flows, is on the order of five to fifteen engineer-days a year. At a fully loaded senior engineer cost of $600 to $900 a day, an assumption of ours rather than a published figure, so substitute your own. That is $3,000 to $13,500 a year of unbudgeted maintenance. It is the single largest line in a small deployment, and it is invisible in every pricing comparison we have seen.

Two qualifications, because this cuts both ways. A high CVE count in a fast-moving open-source project partly reflects scrutiny and responsive disclosure, which is a virtue; closed platforms have the same bugs and you simply do not get a table of them. And a managed platform does not eliminate this risk, it transfers it. You inherit the vendor's patch velocity instead of setting your own. The honest framing is not "Langflow is unsafe". It is "self-hosting converts a vendor's security budget into a line on yours, and you should size that line before you approve the tool, not after the first advisory".

The Sixth Invoice: Whose Key Just Spent That Money

The last cost line is the one that only appears after an incident, and it is a direct consequence of how credentials work inside a shared flow builder.

A Langflow deployment holds two classes of secret: Langflow's own API keys, and the component API keys that let a node talk to OpenAI, Anthropic, your CRM or your database. Langflow's authentication documentation is explicit that a Langflow API key "adopts the privileges of the user who created it", and that in single-user environments you are always a superuser. Long-lived provider keys sit in the deployment so that flows can run unattended, which is exactly what makes them useful and exactly what makes them a liability.

The consequences are financial before they are ever a breach. Three questions decide whether you have a cost-control problem:

• Attribution. When the OpenAI invoice arrives, can you say which flow, owned by which person, spent which portion? If every node uses one shared organisation key, the answer is no, and there is no way to charge the spend back to the team that caused it.
• Ceiling. Is there a hard dollar cap per flow, per team, per month, enforced before the call is made rather than discovered on the invoice? A provider-level spend limit is a blunt instrument that stops everything at once.
• Revocation. When the person who built the flow leaves, does the key they created go with them, or does the flow keep running on a credential nobody owns?

That third one is not hypothetical for this codebase. CVE-2026-55255, in the KEV catalog since 7 July 2026, is described by NVD as an insecure direct object reference in the /api/v1/responses endpoint that let an authenticated attacker "execute any flow belonging to another user by specifying the victim's flow ID", in versions before 1.9.1. Executing someone else's flow means spending against whatever credentials that flow holds. A cross-user authorisation bug in an agent platform is a billing vulnerability as much as a security one.

This is the non-human identity problem in its purest form, and we have written about it separately in our analysis of owner, scope and expiry for AI agents. The short version for a budget owner: a credential without an owner, a scope and an expiry is an uncapped spending authority that outlives the person who created it.

Three Costed Scenarios, Built Only From Published Prices

A Langflow pricing estimate is only as good as the workload it is keyed to, so the scenarios below are built from workload shape rather than headcount. Every price is one we fetched from a vendor page on 30 July 2026; every total is arithmetic we are showing rather than an estimate we are asserting. Engineer time is priced at our stated $600–$900 per day assumption and shown separately, because it is the number most likely to differ at your organisation.

Scenario A — Prototype on a laptop. One builder, Langflow Desktop or a local Docker container, a few hundred runs a month while designing, SQLite storage, no vector store, no tracing beyond the free tier.

This is the number that makes people say Langflow is free. It is accurate, and it describes a stage you leave in about three weeks.

Scenario B — Internal tool in production. One flow serving an internal team, 20,000 runs a month, retrieval over a modest corpus, a real server, real storage, real tracing.

Note the shape. The token line is 87% of the invoiced total, and the two lines everyone argues about, compute and the vector database, are 8% between them.

Scenario C — Customer-facing, governed. A flow in front of customers, frontier model, SSO enforced, audit logs required, higher volume.

Roughly $38,000 to $44,000 a year, for a product whose price is zero. The licence saving is real; it is just not the biggest number on the page. And note that between Scenario B and Scenario C, the governance requirements alone, meaning the enterprise vector tier, SSO and audit logs, add about $950 a month before any additional traffic.

The Hybrid Nobody Prices: Keep Langflow, Buy the Envelope

Cost articles on this keyword tend to end in a binary: self-host the open-source builder, or buy a managed platform. Most organisations we would expect to read this end up doing neither cleanly, and the hybrid is worth costing explicitly because it is usually what actually happens.

The hybrid keeps Langflow as the build surface, since engineers like it, flows already exist there and the licence is free. It stops trying to make Langflow supply the controls it was never designed to supply. Model access, spend caps, credential custody, approval gates and the audit record move to a layer that sits in front of it.

There is a real cost saving in the hybrid, and it is not the licence. It is that you stop building, and maintaining, the same four things in-house: an SSO integration, a spend-cap mechanism, a per-agent audit record, and a credential broker. Priced at the engineer-days above, those four are a multi-month project, and they are not what your team was hired to build.

That hybrid is what LeapForce is; that is also the whole of our product bridge, so the next section is short.

When Langflow Is the Cheap Choice, and When It Is Not

Langflow is genuinely the cheap choice when three things are true at once: you already employ people who run production infrastructure, your volume is low enough that token spend stays small, and control over models and data residency is worth real money to you. Under those conditions the zero licence is a genuine saving and the maintenance obligation lands on capacity you already pay for.

Read against that test, a Langflow pricing decision is really a staffing decision. It is the expensive choice when the people who need the automations are not the people who can maintain infrastructure. That is the single strongest predictor of a Langflow deployment going over budget, because every cost in this article converts into engineering time when it goes wrong, and engineering time is the resource that team does not have.

Three specific tests, in the order we would run them:

1. Name the patch owner. Say a name, not a team. If nobody's job description includes upgrading Langflow inside three days of a KEV listing, you cannot afford to self-host it, whatever the compute costs.
2. Fill in the Run Ledger before you build. If you cannot estimate R, C and Ti within a factor of two, you do not yet know what the flow costs, and neither does anyone quoting you an alternative.
3. Answer the attribution question. If you cannot say which team's budget a given flow's spend lands on, you will not be able to control it later, no matter which platform you pick.

We considered and rejected framing this as a head-to-head against managed platforms. For most readers the honest answer is that Langflow will stay, because it is already in the building and the engineers like it, so the useful question is what it costs to run properly rather than which vendor wins a table.

What Has to Sit Around a Builder in Production

Once a flow acts on company systems rather than a developer's laptop, four questions decide the real cost, and none of them is a question about the builder: who is allowed to attach which model to which flow, what dollar ceiling applies per team and per agent, which credential the agent used, and what the audit record shows. LeapForce builds that layer: one governed endpoint in front of every model, non-human identities with owner, scope and expiry, human approval gates on costly or irreversible actions, and budgets enforced in dollars rather than tokens. Our published rollout model for it is deliberately unglamorous: observe first, enforce second, optimize third. Watch real traffic before you write a policy, because a cap set from guesses either breaks a working flow or never binds. To be clear about what we are not: LeapForce is not a flow builder and does not replace Langflow, and per our published build-status convention, some governance capabilities are live today while others are in development, so check the current status before you plan around any specific control.

Honest Limits on Everything Above

Several things in this article are weaker than they look, and you should know which.

We did not run a metered month. No one on our side has operated a production Langflow deployment and published the resulting invoice. Everything here is list-price arithmetic with the working shown. A real bill would differ, and the direction it differs is usually upward, because real traffic is spikier than a model assumes.

Prices move faster than articles. Every rate here was fetched on 30 July 2026. Anthropic's own page flags Sonnet 5's $2/$10 as introductory through 31 August 2026, reverting to $3/$15, which would raise the Scenario C token line by roughly half on its own. Re-fetch before you commit a budget.

Our engineer-day rate is an assumption. The $600–$900 per day figure is ours, is not sourced from a published survey, and is the input most likely to be wrong for your organisation. Every maintenance figure inherits that uncertainty.

The vendor sample is narrow. We priced one vector store and one tracing vendor because we could verify their published rates. That is an illustration of the tier structure, not a market survey, and cheaper or dearer options exist in both categories.

The CVE analysis measures disclosure, not risk. A KEV listing means confirmed exploitation, which is serious. It does not by itself mean Langflow is less safe than an unaudited alternative, and it does not tell you the exposure of an instance that was never reachable from the internet. We could not verify a reliable count of publicly exposed Langflow instances, so no such figure appears above.

Two things we could not fetch. IBM lists an "Elite Support for Langflow" offering on its product page but publishes no price for it, so paid commercial support is a real option whose cost we cannot state. Request a quote if it matters to your model. Separately, our search of the YouTube Data API for a credible conference talk or technical explainer on this topic returned a quota error rather than results, so this article carries no video where one might have helped.

Ready to Govern Your AI?

Talk to LeapForce — one controlled layer for every AI tool, connector, model, and agent.