| Provider | Free MAU ▼ | Starting $/mo | Pricing model | Open / self-host | Trustpilot | Notes |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Where auth bills surprise you
1) MAU cap overage: the free tier attracts you, but when active users exceed the limit, price can jump by hundreds at once (Auth0's known "growth penalty"). 2) SSO/SAML connections: enterprise customers' required single sign-on is often billed per connection (WorkOS $125/connection/mo, Clerk +$75, Stytch +$125) — not per user. 3) MFA and advanced security: many charge extra (Supabase Phone MFA +$75, Cognito Advanced Security +$0.05/MAU). 4) SMS verification: phone verification is billed per message separately (Firebase, Cognito) — can be a large line item.
How to avoid surprises: estimate real MAU realistically and check the next tier price, not just the free tier. If you need SSO, include connection fees. Self-host (Keycloak, Supabase, Ory, FusionAuth Community) removes MAU and connection fees entirely — cost is DevOps work, and data stays in the EU. Also compare password managers (for end users) and remote access (network-level access).
How to choose?
Largest free tier: WorkOS (1,000,000 MAU free) dominates if you do not need many SSO connections; Clerk and Supabase (50,000 MAU) suit startups, and Supabase's extra MAU is among the cheapest ($0.00325). Firebase and Cognito are usage-based with no monthly fee — good if you are already in Google's/AWS's ecosystem.
For enterprise (B2B, SSO): Auth0 and WorkOS are mature, but calculate connection and Enterprise fees. Data control and EU residency: Keycloak (fully free, unlimited), Ory (German, EU-focused), and Supabase/FusionAuth are self-hostable — then no MAU or connection fees, only maintenance cost. Checklist: verify MFA, SSO, and SMS add-on fees and which metric is used (MAU vs MRU vs aDAU) before choosing.