§09 · Operations and identity · Which auth provider?
Auth and identity
An auth provider handles sign-up, sign-in, sessions, passwords, social login and multi-factor authentication, and at the top end enterprise SSO (SAML, SCIM) for selling to companies. Pricing is usually per monthly active user, with enterprise SSO priced separately and often steeply.
32 tools 32 with a free option Checked 28 Sept 2026
§1
Where we would start, by stage
Editorial picks from the data below, never paid. They change when prices or free tiers do; the full table is underneath.
Hobby $0–10/mo
Clerk 50,000 monthly retained users free per app, with drop-in components for Next.js, React and Astro.
From $25/mo (Pro, $20/mo billed annually)
Indie up to ~$50/mo
Logto 50,000 MAU on the free cloud plan, and open source if you want to self-host later.
From $24/mo (Cloud Pro)
Startup up to ~$500/mo
WorkOS AuthKit Free up to 1 million MAU; enterprise SSO is $125/mo per connection when you sell to companies.
From $125/mo per SSO or directory connection
Scale-up usage-driven
Auth0 30+ SDKs, B2B organisations and enterprise connections; free up to 25,000 MAU.
From $35/mo (B2C Essentials, 500 MAU)
Enterprise contracts
Keycloak Free, self-hosted SAML and OIDC with no user limits, if you can run it.
§2
All 32 compared
A to Z · never paid placement32 tools
| Tool | From | Free option | Free MAU | After free | Enterprise SSO | Self-host | Stages |
|---|---|---|---|---|---|---|---|
| Amazon Cognito aws.amazon.com · EU | Usage-based | Free tier | 10,000 MAU (Lite/Essentials); 50 federated | $0.015 per MAU on Essentials | SAML/OIDC federation $0.015 per MAU after 50 | No | |
| Appwrite Cloud appwrite.io · OSS · EU | $25/mo | Free tier | |||||
| Asgardeo wso2.com | $20/mo | Free tier | 7,500 consumer MAU (250 B2B, 50 workforce) | Essentials $20/mo per 1,000 MAU, pay as you go | SAML/OIDC enterprise logins from Professional ($160/mo) | Yes, via open-source WSO2 identity server | |
| Auth0 auth0.com · EU | $35/mo | Free tier | 25,000 MAU | B2C from $35/mo for 500 MAU; B2B from $150/mo | 1 connection free; 3 on B2B Essentials; extra $100/mo each | No (private cloud on Enterprise) | |
| Authelia authelia.com · OSS · EU | Free tier | Unlimited (self-hosted) | Free; no paid plans | OIDC provider and proxy SSO; no SAML | Yes (self-host only) | ||
| authentik goauthentik.io · OSS · EU | Usage-based | Free tier | Unlimited (self-hosted) | Enterprise $0.02 per external user/month | SAML, OIDC, LDAP free in open source | Yes (self-host only, no hosted version) | |
| Authgear authgear.com · OSS | $50/mo | Free tier | Unlimited MAU (2 apps) | Developers $50/mo; Business $500/mo for 25K MAU | SAML SSO, Entra ID, AD/LDAP on every plan | Yes (open source; ONCE licence $299 one-time) | |
| Better Auth better-auth.com · OSS · EU | $20/mo | Free tier | Unlimited (library in your app) | No per-user fees; infrastructure Pro $20/mo | SSO/SAML/SCIM plugins free; hosted self-service SSO $50/mo per extra connection | Yes, runs in your app | |
| Casdoor casdoor.org · OSS · EU | Free tier | Unlimited (self-hosted) | Free self-hosted; hosted pricing not confirmed | SAML, OIDC, CAS, LDAP, SCIM free | Yes (open source) | ||
| Clerk clerk.com | $25/mo | Free tier | 50,000 MRU per app | $0.02 per MRU beyond 50,000 (Pro) | 1 SAML/OIDC connection on Pro, then $75/mo each | No | |
| Descope descope.com · EU | $249/mo | Free tier | 7,500 MAU | Pro from $249/mo (10,000 MAU), billed annually | 3 connections free, 5 on Pro, 10 on Growth | No (custom deployments on Enterprise) | |
| Firebase firebase.google.com · EU | Usage-based | Free tier | |||||
| Frontegg frontegg.com | Free tier | 7,500 MAU | Pay as you go; unit prices shown only in calculator | 5 SSO/SCIM connections included free | No | ||
| FusionAuth fusionauth.io · EU | $162/mo | Free tier | Unlimited (self-hosted Community) | Starter $162/mo at 1,000 MAU (annual), rises with MAU | SAML/OIDC IdPs unlimited on every plan | Yes, free Community edition | |
| Hanko hanko.io · OSS · EU | $29/mo | Free tier | 10,000 MAU | $0.01 per MAU beyond 10,000 (Pro $29/mo) | SAML SSO $49/mo per connection (Pro) | Yes (open source) | |
| Hexclave (formerly Stack Auth) stack-auth.com · OSS · EU | $49/mo | Free tier | 10,000 total users (not MAU) | Team $49/mo for 50,000 users; Growth $299 unlimited | OIDC/OAuth SSO; SAML not listed | Yes (server AGPLv3, SDKs MIT) | |
| Kanidm kanidm.com · OSS · EU | Free tier | Unlimited (self-hosted) | Free; no paid plans | OAuth2/OIDC provider; no SAML listed | Yes (self-host only) | ||
| Keycloak keycloak.org · OSS · EU | Free tier | Unlimited (self-hosted) | Free; you pay only for hosting | SAML 2.0 and OIDC, free | Yes (Apache 2.0) | ||
| Kinde kinde.com · EU | $25/mo | Free tier | 10,500 MAU | $0.0175 per extra MAU on Pro ($25/mo base) | 1 connection free; unlimited from Plus ($75/mo) | No | |
| Logto logto.io · OSS · EU | $24/mo | Free tier | 50,000 MAU (cloud); unlimited self-hosted | Pro $24/mo; $0.08 per 100 tokens beyond 50K | $48/mo per enterprise SSO connector (Pro) | Yes (open source) | |
| Microsoft Entra External ID microsoft.com | Free tier | 50,000 MAU | Federation with enterprise IdPs; B2B guest collaboration | No | |||
| Nhost nhost.io · OSS · EU | $25/mo | Free tier | |||||
| Nile thenile.dev · EU | $15/mo | Free tier | |||||
| Ory Network ory.com · OSS · EU | $770/yr | Free tier | Self-host free; cloud Developer plan has no production env | $0.14 per aDAU/month on Production ($21 monthly credit) | B2B OIDC SSO on Growth ($9,350/yr); SAML/SCIM on Enterprise | Yes (open source; paid Enterprise License) | |
| Pocket ID pocket-id.org · OSS · EU | Free tier | Unlimited (self-hosted) | Free; no paid plans | OIDC/OAuth 2.0 only; no SAML | Yes (self-host only) | ||
| PropelAuth propelauth.com | $150/mo | Free tier | 10,000 MAU | $0.05 per MAU beyond 10,000 (Growth) | Unlimited SAML/OIDC SSO on Growth ($150/mo) | Partial ('Bring-Your-Own Auth' option) | |
| Scalekit scalekit.com · EU | $99/mo | Free tier | Not user-based; 5,000 tool calls/mo | Growth $99/mo incl. 100K calls, then $0.50 per 1K | SSO for MCP server login (plan details not stated) | VPC / on-prem on Enterprise | |
| Stytch stytch.com | $125/mo | Free tier | 10,000 MAU | Per-MAU overage; rate not shown on pricing page | 5 SSO/SCIM connections free, then $125 each | No | |
| Supabase supabase.com · OSS · EU | $25/mo | Free tier | |||||
| SuperTokens supertokens.com · OSS · EU | Usage-based | Free tier | Unlimited self-hosted | Managed $0.02/MAU; paid add-ons min $100/mo | Enterprise SSO via multi-tenancy add-on (paid) | Yes (open source core) | |
| WorkOS AuthKit workos.com | $125/mo | Free tier | 1,000,000 MAU | $2,500/mo per additional 1M MAU | $125/mo per connection, falling to $65 at volume | No | |
| Zitadel zitadel.com · OSS · EU | $100/mo | Free tier | 100 daily active users (cloud); unlimited self-hosted | Pro $100/mo incl. 25,000 DAU, then usage-based | 3 external IdPs included; more billed per active IdP | Yes (open source) |
No tools match these filters.
§3
How to choose an auth provider
- Price your expected monthly active users a year out; per-MAU pricing adds up.
- If you sell to businesses, check the price of SAML SSO and SCIM: some providers charge per connection.
- Open-source options (Keycloak, Ory, Zitadel, SuperTokens) can be self-hosted to avoid per-user fees, at the cost of running them.
- Check framework SDKs for your stack and whether the hosted UI can be customised or replaced.
Questions
Which auth provider has the biggest free tier?
Free tiers range from a few thousand to tens of thousands of monthly active users. The "Free MAU" column lists each one as published, with the date checked.
§4
Comparisons and pricing changes
Recent changes
-
Remote Config fetches become billable
Firebase · source ↗
-
Free plan loses email template editing on default SMTP
Supabase · source ↗
-
Free projects pause after 7 idle days
Appwrite Cloud · source ↗
-
Auth0 Free plan gains an enterprise connection, SCIM and self-service SSO
Auth0 · source ↗
-
Clerk raises free tier to 50,000 retained users, new plans
Clerk · source ↗