Comprehensive comparison of 20+ auth free tiers in 2026. Compare Auth0, Clerk, Supabase Auth, Firebase Auth, PropelAuth, Kinde, Keycloak, Authentik, Authelia, Appwrite, and more — MAU/MRU limits, overage costs, MFA, SSO, agentic AI support, and growth pricing.
Published 2026-04-03 · Not yet reviewed · Data verified from our index of 1,547 developer tools · 20+ auth services compared
Quick verdict: Auth0 just expanded its free tier to 25,000 MAU with enterprise connections, SSO, SCIM, and new AI Features (token vaults, agentic AI workflow support) included free — the strongest managed auth free tier. Clerk leads on developer experience with 50,000 free MRU (monthly returning users) and drop-in React components. Firebase Auth and Supabase Auth offer 50K free MAU each as part of their BaaS platforms. WorkOS AuthKit is the outlier at 1M free MAU for authentication.
The critical growth cost trap: Auth services look free at small scale, but overage costs vary wildly. At 100K MAU, Clerk costs ~$1,000/mo while Supabase Auth costs ~$162/mo. WorkOS remains free up to 1M MAU for basic auth. Self-hosted options like Keycloak, Authentik, and Authelia have zero per-MAU costs at any scale, trading operational complexity for cost predictability.
Industry signal: Auth is top-of-mind for developers in 2026. Auth0 added agentic AI support (token vaults for agent-to-service auth). MCP Dev Summit featured 6 dedicated auth sessions. The rise of AI agents is making machine-to-machine auth as important as user auth.
Side-by-side comparison of 20+ auth service free tiers.
| Service | Free Limit | Overage / User | Social Login | MFA | SSO/SAML | M2M / Agents | Self-Hosted? | Lock-in Risk |
|---|---|---|---|---|---|---|---|---|
| Auth0 BEST ENTERPRISE Source ↗ | 25K MAU | ~$0.07 | Unlimited social | Included | Enterprise + SCIM free | 1,000 M2M + AI token vaults | No | Medium |
| Clerk BEST DX Source ↗ | 50K MRU | $0.02/MRU | 5+ providers | Included | Pro plan ($25/mo) | — | No | Medium |
| Kinde Source ↗ | 10.5K MAU | Tiered ($0.035–$0.0275) | Unlimited social | Included | Paid plan | 200 | No | Low |
| PropelAuth Unsourced | 10K MAU | $0.05/MAU | Google, GitHub, etc. | Included | Growth plan | — | No | Medium |
| Stytch Source ↗ | 25K MAU | $0.05 | OAuth providers | Included | B2B SDK | 1,000 M2M | No | Medium |
| Descope Source ↗ | 7.5K MAU | Custom | 6+ providers | Included | 50 tenants | 50 M2M | No | Medium |
| WorkOS 1M FREE Source ↗ | 1M MAU | Free (auth only) | Social + enterprise | Included | SSO paid add-on | — | No | Low |
| Supabase Auth CHEAPEST AT SCALE Source ↗ | 50K MAU | $0.00325 | 20+ providers | TOTP + Phone | — | — | BaaS-integrated | Low (open source) |
| Firebase Auth Source ↗ | 50K MAU | $0.0055 | Google, Apple, etc. | Phone + TOTP | Identity Platform | — | BaaS-integrated | Medium |
| AWS Cognito Source ↗ | 50K MAU | $0.0055 | OIDC + SAML | SMS + TOTP | Included | Included | AWS-only | Medium |
| Appwrite Auth Source ↗ | 75K MAU | $0 (self-hosted unlimited) | 30+ providers | Phone + TOTP | — | — | Yes (Docker) | Low (open source) |
| Keycloak Unsourced | Unlimited | $0 (self-hosted) | Any OIDC/SAML | TOTP + WebAuthn | Full SAML/OIDC | Unlimited | Yes (Java) | None |
| Authentik Source ↗ | Unlimited | $0 (self-hosted) | Any OIDC/SAML | TOTP + WebAuthn + Duo | Full SAML/OIDC | Unlimited | Yes (Python/Django) | None |
| Authelia Unsourced | Unlimited | $0 (self-hosted) | Via OIDC proxy | TOTP + WebAuthn + Duo | OIDC provider | — | Yes (Go) | None |
| FusionAuth Source ↗ | Unlimited | $0 (Community) | Any OIDC/SAML | TOTP | SAML + OIDC | Unlimited | Yes (Docker) | None |
| SuperTokens Source ↗ | 5K (managed) | $0.02 (managed) | Social + passwordless | Included | Multi-tenancy (paid) | — | Yes (unlimited) | Low |
| Hanko Source ↗ | 10K (cloud) | Contact sales | Passkeys + social | Passkeys (built-in) | — | — | Yes (unlimited) | Low |
| Ory Source ↗ | 25K (cloud) | $0.07 (cloud) | OIDC + social | TOTP + WebAuthn | Full OIDC | Included | Yes (unlimited) | None |
Fully hosted authentication with drop-in SDKs, pre-built UI components, and managed infrastructure. Zero auth infrastructure to maintain — but per-user costs at scale.
| Provider | Free Limit | Overage | Best Feature | DX Quality | Best For |
|---|---|---|---|---|---|
| Auth0 BEST ENTERPRISE Source ↗ | 25K MAU | ~$0.07/MAU | Actions, SSO/SCIM free, AI token vaults | Excellent docs, Universal Login | Enterprise + agentic AI auth |
| Clerk BEST DX Source ↗ | 50K MRU | $0.02/MRU | React components, org management | Best-in-class React/Next.js DX | Next.js/React apps needing fast auth setup |
| Kinde Source ↗ | 10.5K MAU | Tiered pricing | Feature flags + auth combined | Good multi-framework SDKs | Teams wanting auth + feature flags in one |
| PropelAuth Unsourced | 10K MAU | $0.05/MAU | B2B-first: org management, roles, RBAC | Good React/Next.js/Python SDKs | B2B SaaS with multi-tenant auth |
| Stytch Source ↗ | 25K MAU | $0.05/MAU | Passwordless-first, B2B SDK | Strong API-first approach | B2B SaaS with SSO requirements |
| Descope Source ↗ | 7.5K MAU | Custom pricing | Visual flow builder for auth | No-code flow designer | Complex auth flows without custom code |
| WorkOS 1M FREE Source ↗ | 1M MAU | Free (auth only) | Enterprise SSO ready (SAML/OIDC) | Clean API, good docs | Apps that will need enterprise SSO later |
Authentication bundled with backend-as-a-service platforms. The highest free MAU limits, but you’re adopting the full platform — not just auth.
| Provider | Free MAU | Overage | Platform | MFA | Self-Hosted? | Best For |
|---|---|---|---|---|---|---|
| Appwrite Auth 75K FREE Source ↗ | 75,000 | $0 (self-hosted unlimited) | Appwrite (DB, Storage, Functions, Messaging) | Phone + TOTP | Yes (Docker) | Open-source BaaS with highest cloud free tier |
| Supabase Auth CHEAPEST AT SCALE Source ↗ | 50,000 | $0.00325/MAU | Supabase (Postgres, Realtime, Storage) | TOTP + Phone | Yes (open source) | Full-stack apps on Postgres |
| Firebase Auth Source ↗ | 50,000 | $0.0055/MAU | Firebase (Firestore, Hosting, Functions) | Phone + TOTP (Identity Platform) | No | Mobile-first apps on Firebase |
| AWS Cognito Source ↗ | 50,000 | $0.0055/MAU | AWS (Lambda, DynamoDB, S3, etc.) | SMS + TOTP | No | AWS-native applications |
Run your own auth infrastructure with zero per-MAU costs. Maximum control and no vendor lock-in, but you handle deployment, updates, and scaling.
| Provider | Free MAU | License | Language | Cloud Option | Best For |
|---|---|---|---|---|---|
| Keycloak MOST MATURE Unsourced | Unlimited | Apache 2.0 | Java (Quarkus) | Red Hat SSO (paid) | Enterprise SSO, SAML/OIDC federation |
| Authentik BEST UI Source ↗ | Unlimited | MIT (open core) | Python (Django) | Authentik Enterprise (paid) | Modern IdP with best admin UI, LDAP/SCIM bridge |
| Authelia Unsourced | Unlimited | Apache 2.0 | Go | None (self-hosted only) | Reverse proxy auth gateway (Nginx, Traefik, HAProxy) |
| FusionAuth Source ↗ | Unlimited | Apache 2.0 (Community) | Java | FusionAuth Cloud (from $37/mo) | Full-featured auth with multi-tenancy |
| SuperTokens Source ↗ | Unlimited (self-hosted) | Apache 2.0 (core) | Node.js / Go (core) | SuperTokens Managed (5K free MAU) | Node.js apps wanting open-source auth |
| Hanko Source ↗ | Unlimited (self-hosted) | AGPL-3.0 | Go | Hanko Cloud (10K free MAU) | Passkey-first authentication |
| Ory Source ↗ | Unlimited (self-hosted) | Apache 2.0 | Go | Ory Network (25K free MAU) | Microservice-native identity (Kratos, Hydra, Keto) |
Niche auth providers for specific use cases, plus dedicated authorization services that complement any auth provider.
| Provider | Free Tier | Specialty | Best For |
|---|---|---|---|
| Authgear Unsourced | 5K MAU (cloud) | Passkeys + biometric auth, pre-built login UI | Mobile apps needing biometric + passkey auth |
| MojoAuth Unsourced | 1K MAU | Passwordless-only: magic links, WebAuthn, biometric | Apps going fully passwordless from day one |
| Stack Auth Unsourced | Unlimited (open source) | Developer-first, open-source managed auth | Teams wanting Clerk-like DX with self-host option |
These handle authorization (what users can do) rather than authentication (who users are). They complement any auth provider above.
| Provider | Free Tier | Model | Best For |
|---|---|---|---|
| Permit.io Unsourced | 1,000 MAU, RBAC + ABAC | Policy-as-a-service (OPA-based) | Fine-grained permissions with visual policy editor |
| Cerbos Hub Unsourced | 100 principals, unlimited policies | Open-source policy engine (self-hosted or cloud) | Context-aware access control for microservices |
| Authress Source ↗ | 1,000 MAU, unlimited resources | API-first permission management | Complex B2B permission hierarchies |
This is the most important section of this comparison. Auth services that look free at launch can cost hundreds or thousands per month at scale. Here’s what each provider costs as you grow.
| Provider | At 10K MAU | At 25K MAU | At 50K MAU | At 100K MAU |
|---|---|---|---|---|
| Auth0 Source ↗ | $0 (free) | $0 (free) | ~$175/mo | ~$525/mo |
| Clerk (MRU) Source ↗ | $0 (free) | $0 (free) | $0 (free) | ~$1,000/mo |
| Kinde Source ↗ | $0 (free) | ~$508/mo | ~$1,383/mo | ~$2,758/mo |
| PropelAuth Unsourced | $0 (free) | ~$750/mo | ~$2,000/mo | ~$4,500/mo |
| Stytch Source ↗ | $0 (free) | $0 (free) | ~$1,250/mo | ~$3,750/mo |
| WorkOS AuthKit Source ↗ | $0 (free) | $0 (free) | $0 (free) | $0 (free up to 1M) |
| Appwrite Auth | $0 (free) | $0 (free) | $0 (free) | ~$100/mo (Pro plan) |
| Supabase Auth Source ↗ | $0 (free) | $0 (free) | $0 (free) | ~$162/mo |
| Firebase Auth Source ↗ | $0 (free) | $0 (free) | $0 (free) | ~$275/mo |
| AWS Cognito Source ↗ | $0 (free) | $0 (free) | $0 (free) | ~$275/mo |
| Self-hosted (Keycloak / Authentik / Authelia / Ory) | $0 | $0 | $0 | $0 (+ $20-100/mo server) |
Best-in-class React components, built-in user management UI, and organization support. 50K free MRU. The fastest path from zero to production auth for React developers. Clerk details →
1M free MAU for authentication with enterprise SSO as a paid add-on. If you don’t need SSO/SAML today, WorkOS is the clear winner on generosity. For BaaS-integrated: Appwrite (75K), Supabase/Firebase (50K each).
SOC 2, HIPAA, and PCI-DSS ready. 25K free MAU with MFA, SSO, SCIM, Actions, AI token vaults, and 5 organizations — all free. The safest choice for regulated industries. Auth0 details →
PropelAuth is purpose-built for B2B with org management, roles, and RBAC from day one. Clerk has broader DX but PropelAuth’s B2B features are deeper. Both have 10K+ free users.
Keycloak for enterprise federation. Authentik for the best admin UI and modern stack. Authelia if you just need an auth gateway for reverse proxies. All unlimited, all free.
Supabase Auth: $0.00325/MAU after 50K ($162/mo at 100K). Appwrite: ~$100/mo Pro plan covers auth + full BaaS. Both are open source with self-host escape hatch. Supabase vs Firebase →
Auth0’s new AI Features include token vaults for agent-to-service auth and agentic AI workflow support. 1,000 free M2M tokens. The only managed auth provider with first-class AI agent support in 2026. For self-hosted M2M, Keycloak and Ory have unlimited M2M tokens.
Purpose-built for passkeys and WebAuthn. Open-source self-hosted option with 10K free MAU on cloud. The best choice if you want to go passwordless from day one.
WorkOS: 1M free auth MAU + paid SSO/directory sync. Auth0: SSO + SCIM now free on all tiers. Both battle-tested. Auth0 is the complete package; WorkOS if you want to defer SSO costs until you have enterprise customers.
Auth pricing has several non-obvious costs beyond the headline MAU number. Here’s what to watch for.
Auth0’s Essential plan starts at $23+/mo — there’s no intermediate tier. You’re on the generous free tier (25K MAU) or jumping to paid. For teams that outgrow 25K MAU but don’t need all Essential features, this cliff can be jarring. Clerk and Kinde have more gradual pricing curves.
Clerk counts Monthly Returning Users (MRU), not MAU. A user who signs up but doesn’t return that month doesn’t count. This sounds generous, but for apps with high retention (which is the goal), MRU ≈ MAU. The 50K MRU free tier is effectively 50K MAU for most production apps. Don’t assume the MRU metric gives you meaningfully more headroom.
Auth0 includes 1,000 M2M tokens on the free tier, but enterprise apps and AI agent architectures can burn through these fast. Each agent-to-service call that needs a token counts. Exceeding the limit requires upgrading. Keycloak, FusionAuth, and Ory have no M2M limits since you control the infrastructure.
Firebase Auth SMS-based MFA charges $0.01–$0.06 per SMS depending on country. Phone verification for signup also costs per SMS. AWS Cognito charges for SMS MFA via SNS. TOTP-based MFA is free on all providers. Budget for SMS costs if you rely on phone-based verification.
Self-hosted auth is $0 per user but not $0 total. Keycloak needs 512 MB+ RAM and Java expertise. Authentik needs Python/Django skills and a Postgres database. You own security patches, upgrades, and scaling. Budget $20-100/mo for infrastructure and 2-4 hours/month for maintenance. The total cost is still far less than managed providers at scale, but it’s not free.
Migrating between auth providers is painful. Password hashes are provider-specific — users may need to reset passwords. Clerk and Auth0 use proprietary SDKs that require significant refactoring. Standards-based providers (Keycloak, Ory, Authentik, Kinde) use OIDC/SAML, making migration easier. Your auth provider is one of the hardest services to switch.
Supabase pauses inactive free-tier projects after 1 week. If your auth backend pauses, users can’t log in until un-paused. For production apps, ensure regular activity or upgrade to Pro ($25/mo). Supabase details →
Recent auth-related pricing changes from our tracker. See the full timeline for all 554 tracked changes.
| Date | Provider | Change | Impact |
|---|---|---|---|
| discovered Sep 10, 2026 · effective date unknown | Authress | The first 1000 billable calls are free, and after that, pricing is 0.0012 USD per call. Source ↗ | MEDIUM |
| discovered Sep 5, 2026 · effective date unknown | Proton Pass | Retracted — this record was our error (2026-09-05). The free tier now has limits on vaults (0 vaults) and secure sharing (0 others). The free tier also includes password health alerts and dark web monitoring. Retracted 2026-09-05: Proton Pass's free tier was not reduced to 0 vaults. proton.me/pass/pricing, fetched 2026-09-05, renders that row as "Organize stored items in vaults 0 vaults 0 vaults undefined vaults (per user account) 0 vaults" and the next as "Securely share vaults 0 others 0 others undefined others (per user account)". Every plan column reads 0 or the literal string "undefined", including the paid Pass Plus, Unlimited and Family columns — so 0 is what an unresolved client-side counter renders, not a limit Proton publishes. The literal "undefined" in the same row is the proof. The same page's free column states "Unlimited logins, notes and credit cards" and "Unlimited devices" in prose that did render, which is what our stored description already carried. Source ↗ | MEDIUM |
| discovered Sep 5, 2026 · effective date unknown | WorkOS | The free tier for User Management allows up to 1 million users, but other products like Single Sign-On, Directory Sync, and Audit Logs have different pricing structures. Single Sign-On starts at $125/connection, Directory Sync also starts at $125/connection, and Audit Logs are $0/month but have paid options for log streaming and event retention. Radar is free for the first 1,000 checks. Source ↗ | HIGH |
| discovered Sep 5, 2026 · effective date unknown | Appwrite Cloud | The free tier now has a limit of 2 projects, and the documentation details many more limits than were originally stated (e.g., API bandwidth, executions, storage, databases, buckets, functions, concurrent connections, messages, etc.). Source ↗ | HIGH |
| discovered Sep 5, 2026 · effective date unknown | Hanko | The free tier still exists but now includes 10,000 free MAUs across all tiers, including Pro. A startup plan offering 1 million MAUs is also available. Source ↗ | LOW |
| discovered Sep 5, 2026 · effective date unknown | SuperTokens | The free tier for self-hosted is now truly unlimited, whereas previously it was limited to the core features. The cloud tier remains free up to 5K MAUs, but now has additional paid features like Multi-factor Authentication and Account Linking. There's a minimum billing of $100/month for paid features. Source ↗ | MEDIUM |
| discovered Sep 3, 2026 · effective date unknown | Supabase | The free tier now has a 1 week inactivity pause, and compute is now a separate cost with a $10/month credit on paid plans. The free tier also has a spend cap. Source ↗ | MEDIUM |
| discovered Sep 3, 2026 · effective date unknown | Clerk | Retracted — this record was our error (2026-09-05). The Hobby tier still exists. The description of included features is more detailed and includes limits for Machine Authentication API Keys and M2M Tokens. The page also details pricing for exceeding the 50,000 MRU limit per app. Retracted 2026-09-05: Clerk's Hobby plan was not restructured. clerk.com/pricing, fetched 2026-09-05, renders Hobby as "Free", "No credit card required", "Unlimited applications" and "50,000 MRU limit per app", and the same page's FAQ states "Clerk pricing is based on Monthly Retained Users (MRU)" — which is what our stored description already carried. This record's own summary says the tier still exists and that what changed is the level of detail in the feature list. This row was our error, not a change Clerk made. Source ↗ | MEDIUM |
| discovered Sep 2, 2026 · effective date unknown | Logto | The free tier now includes 50K tokens, and many features are add-ons (RBAC, MFA, Organizations) that were previously. Source ↗ | HIGH |
| discovered Sep 1, 2026 · effective date unknown | FusionAuth | The Community tier is still offered. It now has a limit of 1,000 monthly active users. Source ↗ | MEDIUM |
| discovered Aug 28, 2026 · effective date unknown | Toggled.dev | The free plan now includes unlimited clients, role based access control, realtime notifications, release calendar (beta), Google & GitHub SSO, and 2F authentication. Source ↗ | MEDIUM |
| discovered Aug 28, 2026 · effective date unknown | Permit.io | The free tier now has limits of 1000 MAU, 20 Tenants, No Limit Authorization Queries, 25 Roles, 50 Resource Types, 5 Role Assignments, 2,000 Groups, 2,000 Resource Instances, 2,000 Relationship Tuples. There is also a free tier for OSS projects, requiring contact for qualification. Source ↗ | MEDIUM |
A source check reads each cited page for that service's name and a price; the figures in the tables above are from our own records.
Compare auth service free tiers, track pricing changes, and plan your authentication stack — all from your AI coding assistant.
claude mcp add agentdeals -- npx -y agentdealsWorks with Claude Desktop, Cursor, Cline, Windsurf → Full setup guide
We publish no ranking of these. Nothing we record measures popularity or generosity, so naming a best or a top few would be our preference rather than our data. We hold 30 Auth services in our catalogue, each with the free tier terms and the date we last verified them. This page compares them on free tier limits, what each charges past them, and lock-in risk; the table above carries the figures side by side. Our ranking rule is published at /criteria.
Free tier generosity varies by use case. Some providers offer more storage, others more compute or API calls. Our comparison table above shows exact limits side-by-side so you can evaluate based on what matters most for your workload.
Each provider structures free tier limits differently — some cap storage, others cap requests or compute hours. Our comparison table provides exact numbers for each provider. Check the growth cost analysis section to understand what you'll pay when you exceed free tier limits.