The Hidden Cost of 'Free' Authentication Providers
Auth providers are masterclasses in pricing-curve design. Free for 5,000 monthly active users, $25 for 7,500, $250 for 25,000, then a separate enterprise quote. Here's the real cost picture for 2026.
Key takeaways
- Free tiers are real but small (5K-10K MAU typically).
- The first paid tier is usually fine.
- The jump from "essentials" to "professional" tier is where you'll suddenly pay 10× more for features (SSO, MFA enforcement, custom domains) you should already have.
- Self-hosting (Keycloak, Authentik, Hanko) is genuinely cheaper at scale but adds ops burden.
The big four, compared
Auth0
- Free: up to 7,500 active users
- Essentials: ~$23/mo for first 1,000, scales up
- Professional: ~$240/mo for first 1,000 with MFA + custom domain
- Enterprise (SSO, federation): quote-only, typically $1,500+/mo
The "SSO tax" is real here. SAML SSO costs significantly more than password+social.
Clerk
- Free: up to 10,000 MAU
- Pro: $25/mo + $0.02 per MAU
- Higher tiers for additional features
- Famously fast pricing scaling
WorkOS
- Pricing per-connection rather than per-user, which suits B2B SaaS selling enterprise SSO
- Predictable for SSO-heavy products, expensive for individual user growth
Firebase Auth
- Free for unlimited users
- Charges only for advanced features (multi-factor, phone auth)
- Caveat: harder to migrate off if you outgrow
Self-hosted options
Keycloak: mature, feature-rich, expensive to run well (memory-hungry, complex)
Authentik: modern, Python-based, good UX
Hanko: passwordless-focused, newer
Supabase Auth: if you're already on Supabase, free with the platform
When to switch
You're paying for SaaS auth past ~$1,000/mo without enterprise features that justify it. Or your sales motion needs SSO and the per-connection cost stacks up.
What we recommend
Start with whichever fits your stack, Clerk for Next.js startups, Auth0 for complex needs, Supabase Auth if you're already on it. Plan a migration path before lock-in becomes painful.
FAQs
Is migrating between providers hard? Medium-hard, you can usually export users, but session continuity and edge cases (social logins, MFA setups) require care.
What about Magic.link, Stytch? Strong newer entrants; comparable pricing curves.
Cognito? AWS-native, cheaper, less polished DX.