Authentication pricing compared
Login, MFA and SSO costs depend on active users, enterprise connections and the features in your plan.
18 services · sources last checked 2026-10-06 · how we compare
What the most-compared services cost
Estimated yearly bill at 50K monthly active users, no enterprise SSO connections. Enter your own usage below.
Enter your usage to estimate each bill. Services differ in what they include; check the rates, assumptions and extra charges below.
The estimates below use the default usage. Choose your current provider to compare costs.
| Provider | Parent jurisdiction | Features / pricing source | Est. monthly | Est. yearly |
|---|---|---|---|---|
| ClerkDeveloper-focused auth and user management with prebuilt UI components, billed per monthly retained user with enterprise SSO priced per connection. | 🇺🇸 United States | GDPR DPAPublished rates | $0Hobby · $0 MAU + $0 SSO | $0 |
| Firebase Authentication / Google Identity PlatformGoogle's managed auth for Firebase and Google Cloud apps. 50,000 MAU free, then tiered per-MAU pricing; SAML/OIDC users billed per MAU. | 🇺🇸 United States | GDPR DPAPublished rates | $0Up to 100k MAU · $0 MAU + $0 SSO | $0 |
| LogtoOpen-source OIDC/OAuth identity platform with a hosted cloud. Pro has no MAU cap and bills per access token; enterprise SSO is $48 per connector. | 🇺🇸 United States | EU residencyGDPR DPAopen sourceModeled ratesAssumes one access token per MAU per month; frequent token issuance increases cost. Paid feature add-ons are excluded. | $0Free · $0 MAU + $0 SSO | $0 |
| Supabase AuthAuth bundled with Supabase's hosted Postgres. 50k MAU free; Pro includes 100k MAU then $0.00325 per MAU. | 🇺🇸 United States | EU residencyGDPR DPAopen sourcePublished rates | $0Free · $0 MAU + $0 SSO | $0 |
| WorkOSEnterprise-readiness APIs. AuthKit user management is free up to 1M MAU; SSO and directory sync are billed per connection. | 🇺🇸 United States | GDPR DPAPublished rates | $01-15 SSO connections · $0 MAU + $0 SSO | $0 |
| Amazon CognitoAWS user pools with Lite, Essentials and Plus tiers billed per MAU. 10,000 MAU free; SAML/OIDC users cost $0.015/MAU. | 🇺🇸 United States | EU residencyGDPR DPAPublished rates | $220Lite (up to 100k MAU) · $220 MAU + $0 SSO | $2,640 |
| FusionAuthSingle-tenant CIAM you can self-host for free (Community) or run on FusionAuth Cloud, priced in MAU brackets with unlimited identity providers. | 🇺🇸 United States | EU residencyGDPR DPAopen sourcePublished rates | $462Starter 50k MAU · $0 MAU + $0 SSO | $5,544 |
| KindeAustralian auth, feature-flag and billing platform. 10,500 MAU free, then per-MAU pricing; unlimited enterprise SSO from the Plus plan. | 🇦🇺 Australia | EU residencyGDPR DPAPublished rates | $716Pro · $691 MAU + $0 SSO | $8,595 |
| Ory NetworkHosted version of the open-source Ory stack (Kratos, Hydra, Keto), billed yearly plus a fee per average daily active user. | 🇺🇸 United States | EU residencyGDPR DPAopen sourceModeled ratesConverts daily activity to MAU assuming four active days per user per month. Login frequency changes cost. | $977Production · $912 MAU + $0 SSO | $11,720 |
| SuperTokens (managed)Managed core for the open-source SuperTokens auth framework. Free under 5,000 MAU, then $0.02 per MAU; enterprise SSO via sales. | 🇺🇸 United States | EU residencyGDPR DPAopen sourcePublished rates | $1,000Pay as you go · $1,000 MAU + $0 SSO | $12,000 |
| DescopeDrag-and-drop customer and B2B authentication flows with SSO tenants included on every plan, including the free tier. | 🇺🇸 United States | EU residencyGDPR DPAEstimated ratesOverage rates are estimates, not a published rate card. EU residency requires Growth. | $2,049Growth · $1,250 MAU + $0 SSO | $24,588 |
| ZitadelSwiss open-source identity platform with multi-tenancy built in. The cloud Pro plan bills per daily-active-user day. | 🇨🇭 Switzerland | EU residencyGDPR DPAopen sourceModeled ratesAssumes four active days per MAU per month; SSO block charges are averaged per connection. | $3,600Pro · $3,500 MAU + $0 SSO | $43,200 |
| StytchAPI-first authentication and fraud prevention for consumer and B2B apps, owned by Twilio. 10,000 MAU and 5 SSO/SCIM connections free. | 🇺🇸 United States | GDPR DPAModeled ratesUses the vendor calculator's MAU rate and extrapolates beyond its roughly $2,000/month contact-sales boundary. Larger-app rates need a quote. | $8,000$8,000 MAU + $0 SSO | $96,000 |
| Auth0Okta-owned customer identity platform with separate B2C and B2B plans, priced in fixed MAU brackets that end at 10k-30k MAU on self-serve. | 🇺🇸 United States | EU plan availableGDPR DPAPublished rates | —Over self-serve plan limits · contact sales | — |
MFA, custom domains, audit logs and SCIM are paid add-ons on several vendors. Check the notes.
Need EU residency? Turn on the EU filter to pick a plan that includes it, which may cost more. “EU plan available” alone does not mean the price shown includes residency. Shared links save your inputs and filters, but prices can change.
Self-hosted options
Operating cost not estimated · servers, licenses and engineering time are yours. We list these separately because there’s no calculated bill to compare with managed services.
- authentik (self-hosted) — Open-source identity provider for SSO (OIDC, SAML, LDAP, SCIM, RADIUS, proxy). Self-hosted only, with an optional per-user Enterprise license.
- Better Auth — MIT-licensed TypeScript auth library that runs inside your app and database, with plugins for SSO, SAML, SCIM, MFA and organizations. Owned by Vercel.
- Keycloak (self-hosted) — Open-source identity and access management (Apache-2.0), a CNCF project originally from Red Hat. SAML, OIDC, LDAP and MFA built in.
- SuperTokens (self-hosted) — Open-source SuperTokens core (Apache-2.0) run on your own servers with Postgres or MySQL. Core features free at any scale.
No self-hosted options match these filters.
Head-to-head comparisons
Authentication pricing explained
What drives the bill
Most managed auth vendors charge per monthly active user (MAU). B2B apps may also pay for each enterprise SSO connection (SAML/OIDC), which can become a large part of the bill. With self-hosted options such as Keycloak, authentik and Zitadel, you pay for infrastructure and the work of running the service.
Costs the calculator leaves out
- How each vendor defines an “active” user. Some count every token refresh, others only interactive logins.
- Add-ons that are often paid extra or reserved for higher tiers: MFA, SMS codes, custom domains, audit log retention, SCIM provisioning and role management.
- Lock-in on password hashes. Check whether you can export them. Without them, migrating means forcing every user to reset their password.
When paying more makes sense
A managed service can take care of security updates and provide breach monitoring, compliance reports and ready-made login components. Check what your plan includes. If user or SSO fees are becoming expensive, compare alternatives, but budget for upgrades, incident response and support before choosing to self-host.