Auth0 Pricing 2026: Plans, Tiers and Monthly Costs
Nov 3, 202614 min read
Free tier, paid self-serve tiers, then an Enterprise plan sold by quote.
Auth0 meters all of them by monthly active users, so your bill follows your user count rather than the headline price, something worth modeling early, much as teams do when they map out Activepieces workflows before committing to a stack.
Auth0 pricing is the tiered, usage-based fee structure for Okta's Auth0 identity platform, in which each plan, from Free through self-serve paid tiers to quoted Enterprise, is charged by monthly active users and gates features such as SSO, MFA and custom domains by tier.
The sticker price's the starting point. Where you end up depends on your user growth and the features you need.
Auth0 pricing in 2026: the direct answer
What Auth0 is and how it charges
Auth0's Okta's customer identity platform. It handles login, signup, social sign-in and token issuing for the apps you build.
The metered unit's the monthly active user, meaning anyone who authenticates in a billing month. That includes users created by a signup form or by an automated workflow.
Growth in logins therefore raises the bill even when your plan stays the same.
The pricing has four parts: a free tier, paid self-serve tiers, Enterprise by quote, and a billing unit of monthly active users, checked 3 November 2026.
The last part matters most, because the first three only set the limits inside which Auth0 counts users. Next come the cost drivers in turn: user counts, gated features and the move to a quote.
Treat 3 November 2026 as the point after which tiers, limits or feature placement may have changed. The figures here come from auth0.com/pricing and the Auth0 documentation. Confirm anything you plan to budget on against the live pricing page before you commit.
If you are running this arithmetic for your own team, see what the same workload costs on Activepieces.
Auth0 plans, pricing and limits
Auth0 meters every plan on the monthly active user.
Plan comparison table
The table sets Free, Essentials, Professional and Enterprise against price, MAU, connections, organizations, MFA, custom domains, log retention, support and rate limits. Read across a row to see what a tier lets you ship. Read down a column to see which limit binds first.
Because Auth0 prices and packages the same tier name differently on each line, the B2B and B2C variants get their own rows.
Your user count may not be what forces the upgrade: a missing custom domain or a restricted MFA option can do it first. That's why the feature gates matter more than the quantities.
B2C versus B2B plan lines
B2C plans are built for consumer volume: many individual users, few or no customer companies. B2B plans add organizations, which model each customer company with its own members and login rules.
Choose by your tenancy model, not by the tier label, because the same tier name can cost different amounts depending on which line you pick. The wrong line means either paying for organizations you never use or lacking the ones your customers expect.
Auth0 Enterprise pricing and contact sales
At Enterprise the table stops quoting a price, and the cell becomes a conversation. You can't model that cost from the page, so you have to ask what the quote's metered on: MAU volume, contract term, or add-ons.
Get rate limits and log retention in writing as well. They're the cells most likely to differ from the self-serve tiers, and they're the ones you'll notice only after an incident.
What Auth0 costs at different scales
At 1,000 users, the B2C Essentials plan comes to about $70 a month, then $700 at 10,000 and a negotiated quote at 100,000. Auth0 meters monthly active users.
Read the 100,000 bar as arithmetic, not a price, because it's an estimate. The chart shows the estimated monthly bill at each level and the plan behind it.
Up to 10,000 users the bill's a straight line, and the quote's where that line ends.
At 1,000 users Essentials costs $70 a month, according to Seamless Auth's cost comparison. At 500 users it's $35, so the rate's $0.07 per active user and every signup that logs in adds to the bill.
At the same rate, 2,500 users cost $175, 5,000 cost $350, 7,500 cost $525 and 10,000 cost $700. Ten times the users means ten times the bill, or $8,400 a year.
That's before any enterprise feature pushes you off the tier.
Extend the $0.07 rate and you get roughly $7,000 a month, but that's my extrapolation, not a published price.
At this size you should expect a sales conversation, so the real figure's whatever you negotiate. Treat $7,000 as the number to argue against, and check whether the quote lands below it.
Hidden Auth0 costs and limits
Even when the list price looks safe, any of five limits can push a quote past $7,000. They sit outside the headline price and cause most surprises: user counting, tier-gated features, enterprise connection caps, machine-to-machine quotas, and log retention.
What you pay for is a distinct user who logs in during the month, not a seat you chose, because Auth0 meters monthly active users. A bot that completes signup becomes a billable user, so a spam wave shows up as a bill increase.
Put bot protection on signup before launch.
**A bot that completes signup becomes a billable user, so a spam wave shows up as a bill increase.
Features locked behind higher tiers
A feature you need to ship can force an upgrade before your user count does, because MFA, SSO and custom domains are gated by plan. Enterprise connections show this most clearly.
According to SSOJet, Free allows 1 connection, so your first SAML customer uses the whole allowance. Essentials B2B allows 3, so the fourth customer forces a tier change. Professional B2B allows 5, so the sixth moves you into a sales conversation.
It sets those three self-serve steps against Auth0's hard cap.
Even when no human logs in, scheduled jobs and service-to-service integrations draw on the allowance, because machine-to-machine tokens are metered by quota and every token request counts. Cache tokens until they expire so background traffic doesn't spend the quota.
When an incident is older than your log window, you can't investigate it inside Auth0, because log retention's tied to your tier. Stream logs to your own storage from day one. Support level's also a plan feature, and that's another reason the quote can grow.
Worth checking against a plan that does not meter every step: one credit covers a whole run on Activepieces.
Auth0 pricing versus competitors
Once SSO enters the picture, Auth0's rarely the cheapest of the five. Each rival meters a different unit, so the cheaper sticker often moves the cost somewhere else rather than removing it.
Comparison table
The table shows what each vendor meters and where it gates features, without a price attached. Read the SSO column first: it shows whether you pay per user, per connection or per plan tier, and that unit decides how the bill grows.
| Vendor | Free-tier MAU | Beyond free | SSO/SAML | MFA | Self-hosting |
|---|---|---|---|---|---|
| Auth0 | Yes, on the self-serve free plan | Per MAU, rising by plan tier | Enterprise connections gated by plan | Available, with some factors gated by plan | No, managed only |
| Clerk | Yes | Per MAU | Paid add-on | Available, with some options on paid plans | No |
| Firebase Auth | Yes, for basic sign-in | Per MAU after upgrading to Identity Platform | Needs the Identity Platform upgrade | Available after the upgrade | No |
| Cognito | Yes | Per MAU, tiered | Federated users billed as MAU | Available, SMS billed separately | No, AWS only |
| WorkOS | Yes, for its hosted login | Per MAU for login | Per connection | Included | No |
None of the five can be self-hosted, so migration risk's a shared cost you have to price in.
Auth0 wins when you need B2C login, enterprise federation and extensibility from one vendor. Buying those integrations separately adds integration time, and that time's got a price.
Cognito wins if you already run on AWS and mostly serve consumers. WorkOS wins when SSO's the only enterprise feature you need, because you pay per connection instead of for every user.
Ways to keep an Auth0 bill down
Five ways to cut Auth0 costs
If WorkOS isn't the fit, the bill still shrinks when you control the two things that drive it: monthly active users and the paid features you switch on. Five tactics're enough for most of it, and each one moves a specific part of the invoice.
Prune inactive users, because dormant and test accounts stop generating logins and the metered count then reflects real customers. Block bot signups, since fake accounts never become billable actives and the spikes that bring no revenue disappear.
Pick B2B or B2C correctly, because the wrong plan family's a charge for capabilities you don't use. Delay enterprise features: the cheaper tier's enough until a customer requires more. Negotiate annual contracts, trading flexibility for a lower rate and a predictable total.
The three groups below sort these by where the savings come from.
Reduce your Auth0 monthly active users
Every login you can't attribute to a customer's a charge, since Auth0 meters active users. Clear out test accounts, turn on bot detection at signup, and check which of your own scripts authenticate as users. The effect's a smaller meter before any negotiation starts.
Match plan and features to your model
Match the plan family to your model: organizations suit B2B, per-user pricing suits B2C. Then ask whether SSO or MFA's a launch requirement or a hopeful add-on. If no customer's asked, leaving it off keeps you out of the jump to a sales quote.
Negotiate your Auth0 contract term
Bring your cleaned-up MAU history to the conversation. A committed annual term's worth more to the vendor than monthly flexibility, so ask for a lower rate in exchange. Start before renewal, while leaving's still a credible option.
Automate Auth0 user tasks with Activepieces
Activepieces can take over the glue code you wrote around Auth0 (onboarding, offboarding, syncing users to a CRM, Slack or billing), and with 746 integrations, roughly 60% of them community-contributed, the tool on the other end of each sync is usually already covered.
It does nothing to Auth0's price, and that's the right way to size it.
Where workflows fit around Auth0
Activepieces charges 1 credit per flow run, however many steps the flow has, so an offboarding flow split into ten small steps costs the same as the two-step shortcut it replaced. Zapier bills per task, which means every extra step adds to the invoice.
Here the run is the meter and the steps inside it are yours to arrange. The useful question's how many hand-written scripts you currently maintain to react to Auth0 events.
When a new signup creates a CRM contact, posts to a Slack channel and opens a billing record, that's three pieces of custom code, each with its own credentials and failure modes.
In a workflow builder, that becomes one trigger followed by three actions you can read at a glance.
The screenshot shows the shape of it with a different trigger. It's a three-step flow named "Calendly Tracking," where a Calendly "Event Canceled" trigger feeds a Slack message and a Gmail email.
Swap the trigger for an Auth0 event and the pattern's the same, one event fanning out to the tools your team already uses. What to take from it's the maintenance model: changing a step means editing a block and pressing Publish, not redeploying a service.
Offboarding benefits most. Removing a departing user from Auth0, notifying the team and closing the billing record can run as one flow instead of a checklist someone forgets.
Activepieces can also be self-hosted, and its core is MIT-licensed, so the free Community Edition keeps the automation layer from becoming another metered vendor line beside your identity bill.
What it doesn't change
Your Auth0 bill's still driven by monthly active users, the enterprise features you need and the quote you get at the top of the self-serve tiers.
Activepieces sits outside that calculation, with a separate free plan at $0 that includes 1,000 credits a month and unlimited flows.
Before you plan to retire any code, check that the events and actions you rely on're covered, because Activepieces' Auth0 connection's modest.
Its source sits in the packages/integrations/community folder of the open source monorepo on GitHub, so you can read the listed triggers and actions before committing.
If your real concern's lock-in, moving user sync into workflows doesn't move your users out of Auth0. It only makes your surrounding logic easier to rewire when you do.
Frequently asked questions
Free tier and dormant users
These're the billing edges that decide whether the number on the pricing page survives contact with your invoice. Confirm each against Auth0's current terms before you commit.
Yes, you can use the free tier for a commercial product, but it caps the unit being metered, monthly active users, and leaves out many features.
So the question isn't whether you may charge customers, but whether you can ship without SSO, extra MFA options, or a custom domain.
Dormant signups cost nothing on the meter, because Auth0 doesn't charge for inactive users by the metered unit.
The meter counts users who authenticate in a billing period, not accounts sitting in your database. A usage spike from one campaign still lands in that month's count.
Limits and plan changes
If you exceed your plan's MAU limit, what happens depends on how you buy. On self-serve plans, crossing the limit pushes you toward a higher tier. On a contract, overage follows the terms you signed.
Either way, the jump's a pricing event, so watch your count before the month ends rather than after the invoice arrives.
You can generally switch plans mid-month, but check how the change's prorated. The practical risk's a downgrade: features you rely on, like enterprise connections or a custom domain, may stop working the moment the plan no longer includes them.
Startup discounts
Auth0's run startup programs in the past, but eligibility and terms change. Ask sales directly, since discounts typically arrive through the same quote process that replaces the public price list.
Steps to check your Auth0 bill
Start by finding out how many monthly active users you actually have. Then check that count against the quote you'll be negotiating, because every other number in your Auth0 bill's derived from it.
The list below turns the earlier argument into a routine you can finish in a few days. Each step feeds the next, so the order matters: a wrong user count makes every later comparison wrong.
- Export your current MAU from the dashboard. Use the metered unit Auth0 bills on, not signups or total accounts, so you're pricing the same thing the invoice will.
- Map the features you use to tiers. List SSO connections, MFA methods, and custom domains, then note which tier each requires. One feature that sits a tier higher can set your price regardless of user count.
- Rerun your cost table against the live pricing page. Published rates change, so a table built from last quarter's figures can quietly mislead you.
- Request quotes if you're near the ceiling of a self-serve tier. Once growth will push you past it, the public price list stops applying, and you want a quote in hand before renewal, not after.
- Set a MAU alert below that ceiling. The alert gives you lead time to negotiate instead of absorbing a surprise tier jump on the next invoice.
Related reading
References
Running the numbers
See what the same workload costs here.
Free forever plan, and every paid plan self-hosts at no extra cost.
See pricing Talk to sales
