best 14 auth and identity providers

clerk's pro plan is $25 a month and includes fifty thousand monthly retained users. overage starts at the fifty-thousand-and-first user at two cents each, so the anchor for this category — total cost at 50,000 users — is $25 flat. auth0 charges $3,500 for the same workload. that is not a rounding difference, and it is the single most useful fact on this page.

note the unit. clerk bills monthly retained users rather than monthly active users, which is a narrower definition, and the free hobby tier is capped at the same fifty thousand with a hard ceiling rather than an overage path. the practical effect is that hobby covers a surprisingly large product until the day it stops entirely.

one enterprise sso connection — saml, oidc or easie — is included in pro, which is unusual. additional connections are $75 a month each from two to fifteen, tiering down to $15 each above five hundred. the b2b add-on brings organisations at a hundred monthly active orgs included and $1 each after. that combination makes clerk viable for early b2b in a way that per-connection vendors are not.

two limits are worth knowing before committing. pricing is per application rather than per account, so a company running three products pays three times. and application log retention tops out at thirty days even on the $300 business tier, which is short if anyone ever asks you to reconstruct an incident.

workos gives authentication away for the first million monthly active users, so the anchor figure for this page is $0. the next band is $2,500 a month per additional million. for any company that has not crossed a million users, the authentication line is genuinely free, and that is the pitch.

the bill arrives at the enterprise edge. sso is $125 per connection per month from one to fifteen, tiering to $100, $80, $65 and $50 as connection counts rise. directory sync for scim is billed on the same ladder, separately. audit logs are $125 a month per siem log-streaming connection plus $99 per million events retained.

so the honest way to read workos is that it inverts the usual comparison. a company with thirty enterprise customers on both sso and directory sync pays around $6,000 a month while its user count bill stays at exactly zero. against clerk's $75 per additional connection or kinde's unlimited connections at $75 total, that is the most expensive per-connection pricing in this ranking.

what you get for it is the cleanest enterprise implementation here — the admin portal that lets your customer's it team configure their own idp without a support ticket is the thing teams actually adopt workos for, and it is hard to price against because building it yourself is where the weeks go.

keycloak is the outlier in this ranking and deserves to be read as one. there is no pricing page because there is no hosted tier and nothing to buy. saml and oidc identity brokering, organizations, fine-grained admin permissions — all of it is in the apache 2.0 tree at github.com/keycloak/keycloak, with no enterprise directory and no second licence file. supertokens, ory, litellm and half this category run a commercial line through exactly these features.

the anchor is therefore infrastructure cost only. fifty thousand users, five hundred thousand, five million — the software does not meter, so what you pay is what the servers cost. against auth0's $3,500 a month at fifty thousand users, running keycloak on your own hardware is a rounding error, and that gap is why it persists in large organisations despite being the least fashionable option here.

organization support within realms is now a supported feature enabled by default, which closes the multi-tenancy gap that used to push b2b teams elsewhere. a first-party scim api ships in-tree as well.

two things temper it. that scim api is still a preview feature, disabled by default, so anyone with a hard provisioning requirement is deploying something not yet marked stable. and there is no first-party hosted option at all — you own the upgrades, the database, the availability and the security patching. keycloak is free the way a puppy is free.

supabase includes a hundred thousand monthly active users on the $25 pro plan, so the anchor for fifty thousand users is $25 — and that $25 is buying you a postgres database, storage and edge functions as well. on the free plan fifty thousand users is exactly the included allowance, at $0. as a cost line, auth here is close to free for anyone already on the platform.

the server is genuinely open source. the licence file at github.com/supabase/auth is plain mit, so the gotrue-derived auth server can be run independently of supabase's hosted platform, and there is no enterprise carve-out over it.

what ships is solid consumer authentication: email and password, social providers, and mfa via totp or phone. saml 2.0 enterprise sso is documented and available on paid plans, with fifty connections included and $0.015 per mau after — note that supabase meters sso per active user rather than per connection, which is cheaper than workos for a few large customers and more expensive for many small ones.

the gap is b2b. scim provisioning, an end-user organisations model and auth audit logs are not documented on the auth guide, and we have treated them as absent rather than assumed. if your roadmap has enterprise deals on it, that is the constraint that will move you — and it is the reason this sits fourth rather than first despite the price.

better auth cannot be placed on this ranking's anchor, and that is the point rather than a gap. it is a typescript framework you install into your own application, licensed mit at github.com/better-auth/better-auth with no open-core split. there is no per-user metering at fifty thousand users or five million, because there is no meter. what you pay is your own infrastructure.

that is why it has become the standard destination for teams leaving clerk or auth0 once the bill starts mattering. the migration trades a monthly invoice for owning the sessions, the tables and the upgrade path.

a commercial layer has appeared recently, and it is worth knowing about because it changes the shape of the project. a hosted service at dash.better-auth.com now attaches a dashboard, audit logs, security detection and sso management to your self-hosted install: $0 starter with ten thousand audit log events a month at one-day retention, $20 a month pro with twenty thousand events then $0.0001 each, seven-day retention, and one self-service sso and directory sync connection with further connections at $50 a month. crucially this is priced per event, not per user — so the $20 holds at any user count.

the honest weakness is that it is a library. there is no vendor to call, the enterprise features live behind that hosted service rather than in the framework, and whether organisations and multi-tenancy ship as a framework plugin we could not confirm. you are taking on operational responsibility in exchange for never seeing a per-user invoice.

logto's free plan covers fifty thousand monthly active users, which lands this category's anchor exactly on the ceiling at $0. that is the most generous published free tier of anything ranked here, and unlike a trial it does not expire.

the whole codebase is mpl-2.0, confirmed against the licence text at github.com/logto-io/logto rather than the readme badge. mpl is file-level copyleft — modified mpl files stay mpl when distributed and binaries must make source available — which is a lighter obligation than agpl and a heavier one than mit. we found no open-core split.

the unit changes when you cross into paid, and this is the thing to understand before adopting it. the free plan is bounded by monthly active users; pro is bounded by tokens, with fifty thousand access tokens included and $0.08 per hundred after. id and refresh tokens are not counted. so real cost above the free tier is driven by session and token volume rather than user count, which is a different forecasting problem from every per-mau vendor on this page.

b2b arrives as a stack of add-ons rather than a tier. organizations are $48, each enterprise sso connector is $48, machine-to-machine apps are $8 each beyond the first — all on top of the $24 base. that is still cheap against workos, but a b2b product needs three line items before it has what descope puts in its free tier. scim and audit log support are not listed on the pricing page and we have not assumed them.

descope puts things in its free tier that most of this category charges for. tenants and multi-tenancy are included on every plan — ten free, thirty-five on pro, a hundred on growth. scim user provisioning is listed as included on all tiers including the free one. audit logs are on every tier too, with retention as the differentiator: a week free, a month on pro, a month plus external connectors above that. three enterprise sso connections come with the free plan.

set against supabase, which has no documented scim or organisations model, or kinde, where scim is still marked coming soon, that is a genuinely stronger b2b starting position — and it is why this ranks above several cheaper options.

the pricing then stops being legible. free covers 7,500 monthly active users, pro is $249 for 10,000, growth is $799 for 25,000. fifty thousand users exceeds every published allowance, and the page describes overages only as 'usage-based' without printing a per-user rate. so the honest answer for this category's anchor is that the floor is $799 a month plus an unpublished charge on twenty-five thousand users, and anything more precise would be invention.

it is also fully closed source with no self-host path, which puts it in a different bracket from keycloak, logto and better auth for anyone whose requirement is owning the identity layer rather than renting it.

kinde's plus plan is $75 a month and includes unlimited enterprise sso connections at no additional cost. workos charges $125 for one. stytch charges $125 after five. auth0 charges $100 after three. for a b2b product where every new enterprise customer arrives wanting their own identity provider, that difference compounds fast — thirty customers costs $75 here and roughly $3,750 at workos before directory sync is added.

the per-user side is mid-table. every paid plan includes 10,500 monthly active users, then charges per user above that, so fifty thousand users on pro works out at $25 plus 39,500 at $0.0175, or $716.25 a month. plus and scale have lower per-user rates but higher bases and land slightly higher at this volume — $718.85 and $846.45 respectively — so pro is the cheapest published route to fifty thousand users. usefully, users on paid subscriptions are not counted toward mau at all.

organisations are billed as monthly active organisations: five free on the free plan, fifty included on every paid plan, then between $0.50 and $0.43 each. audit log retention runs from one day on free to thirty on scale.

and then scim is listed as 'coming soon' on every single plan, including the $250 one. that is disqualifying for enterprise buyers who require automated deprovisioning — when an employee leaves, their access has to disappear without a human doing it, and several procurement checklists make it non-negotiable. unlimited sso connections do not help if the buyer's security review stops at the provisioning question.

firebase's pricing page lists fifty thousand monthly active users free on both the spark and blaze plans, and does so for both 'authentication' and 'authentication with identity platform' — so this category's anchor lands at $0. for a consumer product that is the cheapest credible option on this page alongside logto.

the complication is that the same underlying service is sold twice. legacy firebase auth and google cloud identity platform are the same thing billed through different consoles, with different rate cards above the free tier, and firebase now shows both as separate lines on one page. working out which one you are on, and what you will pay above fifty thousand users, requires reading google cloud's pricing rather than firebase's.

we could not read it. the cloud.google.com identity platform pricing tables returned truncated content on two attempts, so the per-user rates above the free allowance and the separate standard-versus-enterprise tier bands are absent from this entry rather than estimated. phone authentication also bills per sms sent at a rate we could not confirm.

what is clear enough to act on: the free fifty thousand covers the standard tier — email and password, social, phone identifiers — and users signing in through enterprise saml or oidc are billed on identity platform's separate enterprise tier. so the headline free tier does not cover b2b sso, and any team planning enterprise deals should price that path before committing.

the self-hosted core has no mau limit at all, so fifty thousand users costs nothing but infrastructure. the managed cloud is free to five thousand users then $0.02 each with a $100 monthly minimum, which puts fifty thousand users at $900 a month — mid-table, and an order of magnitude above clerk for the same count.

the licence needs reading carefully. the repository at github.com/supertokens/supertokens-core is apache 2.0 except the 'ee/' directory, which carries a proprietary supertokens enterprise licence. that licence permits use 'for development and testing purposes, without requiring a subscription', but production use requires agreeing to the subscription terms and holding 'a valid supertokens enterprise license for the correct number of user seats'. redistribution in production is forbidden and supertokens retains title to modifications you make.

what sits behind that line is multi-tenancy, mfa, account linking, machine-to-machine auth, the attack protection suite, and dashboard users beyond the first three. and critically, those add-ons are billed on self-hosted deployments as well as cloud — mfa at $0.01 per mau with a $100 minimum, account linking at $0.005. so 'self-hosted and free' holds for core authentication and stops the moment you add a second factor.

multi-tenancy — the one a b2b product cannot avoid — is quoted only on request, alongside machine-to-machine auth and the attack protection suite. that means the feature most likely to determine whether supertokens fits cannot be priced from the public page at all.

aws cut cognito's free allowance from fifty thousand monthly active users to ten thousand for any user pool created on or after 22 november 2024, and made essentials rather than lite the default tier for new pools. the old fifty thousand figure survives only for pools created before that date. almost every comparison still published quotes it.

the practical effect at this category's anchor is a four-way answer depending on when you started and what you picked. a pre-november-2024 pool on lite pays $0 at fifty thousand users. a new pool on lite pays $220. a new pool on essentials — the default — pays $600. a new pool on plus pays $1,000, because plus has no free allowance at all and bills from the first user.

federated enterprise users bill on top of all of that: saml and oidc sign-ins are $0.015 per monthly active user above a fifty-user free allowance, on every tier. there is no per-connection charge, so one enterprise customer with a thousand employees costs about $14.25 a month — genuinely cheap against workos's $125 per connection, and it scales with their headcount rather than their existence.

multi-tenancy is documented, audit and monitoring come through cloudtrail and cloudwatch, and the whole thing inherits aws iam. scim is not mentioned anywhere on the features page and we have treated it as absent. the real cost of cognito has always been developer time rather than invoice — the console and the customisation limits are where teams lose weeks.

for a company's first handful of enterprise customers, stytch's terms are the best here. unlimited organisations are included at the base tier, five sso or scim connections come free from a pooled allowance, and there is no base subscription fee. against workos's $125 per connection or auth0's $150 b2b entry, a young b2b product genuinely pays less.

the fraud and device-fingerprinting tooling is also a real differentiator that the rest of this category mostly does not have, and for consumer products fighting account takeover it is the reason to look here at all.

then the pricing page lists 'additional monthly active member cost' as a line item and prints no rate against it. the faq says you 'pay for only what you use at the rates outlined above', and the rates are not outlined above. so the single most important number for anyone modelling this — what a user costs past ten thousand — does not exist publicly, and the anchor figure for this ranking is genuinely unknowable rather than merely hard to compute.

that is the entry's real weakness and it is why this sits twelfth despite good fundamentals. every other vendor on this page can be modelled from published figures, including the ones that are expensive. a product you cannot cost at scale without a sales call is a product you cannot compare, and being uncomparable is its own kind of answer.

kratos for identity and hydra for oauth2 are both apache 2.0, verified from the licence files, and both are headless and standards-first in a way that suits teams building their own flows rather than dropping in a widget. run them yourself and there is no licence key and no metering.

the hosted product cannot be placed on this page's anchor. ory bills per average daily active user rather than monthly active user, and publishes no conversion between them. on its own rates, fifty thousand adau works out at roughly $7,043 a month on production or $6,524 on growth — but adau is materially lower than mau for most applications, so those figures are upper bounds against a different measurement, not a quote. we have not converted them, because any conversion would be our invention rather than ory's.

the b2b ladder is where it falls down against the rest of this list. one-click saml sso is enterprise-only at custom pricing. scim is 'no' on every tier except enterprise. b2b organisations are capped at three on the $9,350-a-year growth plan and are not available on production at all. for a category where descope puts tenants and scim in its free tier, that is a long way back.

the company has also moved from ory.sh to ory.com, with the old pricing url now 301-redirecting — worth knowing if you are following an older integration guide or a bookmarked rate card.

auth0 is the incumbent and it shows in the surface area: separate fully-priced b2c and b2b plan ladders, inbound scim on every plan, organisations unlimited on the b2b tiers, and the widest set of enterprise connection types anywhere here. if a procurement checklist names a standard, auth0 supports it.

the price is $3,500 a month at fifty thousand monthly active users on b2c essentials. clerk is $25 for the same count. workos, logto, firebase and a self-hosted keycloak are all $0. that is not a premium for a better product, it is a different category of number, and it is why teams migrate away from auth0 as a matter of routine once the invoice becomes visible.

the billing mechanism makes it worse in a specific way. auth0 bills by mau tier rather than per-user overage, and states plainly that 'if your usage falls between tiers, you are billed at the next tier up'. one user over a threshold moves you a whole bracket. every other vendor here that meters users does it per user.

and the ladder runs out. b2c professional publishes prices only to twenty thousand users at $3,200 before switching to 'contact us', and b2b is a sales conversation above twenty thousand — so we could not verify a b2b figure at fifty thousand users at all. audit log retention is five days on essentials and ten on professional, which is short for a product sold on enterprise compliance.