Free Auth Providers in 2026: 10 Free Tiers for Indie Apps

The ten free auth providers checked here all publish a free plan in 2026. Clerk's Hobby plan has a "50,000 MRU limit per app" (Clerk pricing), Auth0's Free plan covers "Up to 25,000 monthly active users" (Auth0 pricing), Supabase's Free plan lists "50,000 monthly active users" (Supabase pricing) and WorkOS AuthKit is free for "Up to 1 million users" (WorkOS pricing). Those are different counting rules, not sizes of the same thing. Every figure here comes from the ZeroRaised auth tiers dataset, built from each vendor's own pages and checked on 22 Oct 2026.

Disclosure: ZeroRaised publishes this guide and the auth tiers dataset it draws on, and appears in the final section. Every limit, price and quote below comes from that dataset or the vendor pages it cites, and the dataset was built only from each vendor's own pricing and docs pages, and each vendor fact links to the page it came from. Where the dataset says a value is not stated, so does this guide. ZeroRaised has no affiliate deal with any company named here.

TL;DR#

Free login plans for indie apps, from each vendor's own pages, checked 22 Oct 2026:

For a side project, the differences that bite early are rarely the headline limits. They are whether MFA is on the free plan, whether you can use your own domain, what happens to an idle project, and how far the first paid step is.

What the auth tiers dataset found, checked 22 Oct 2026#

On 22 October 2026, ZeroRaised checked the free plans of 10 authentication and login services that indie developers often use and published the results as the auth tiers dataset. It records the free monthly user limit, whether social logins, multi-factor authentication (MFA) and a custom domain are on the free plan, and the overage or next paid plan as the vendor shows it. All 19 cited vendor URLs returned HTTP 200. Every dataset quote was still on its page when re-fetched for this guide.

Three findings matter most if you are about to wire up sign-in:

• Nobody is missing a free plan. All ten candidate vendors publish a free plan or free tier, so none was dropped.
• The user units do not match. Retained users, active users, users plus AI agents, per app or per account. Nothing is converted.
• MFA and custom domains are where free plans split. Six vendors put MFA on free; four do not, or do not say. Four include a custom domain, two mark it absent, one sells it as an add-on and three do not state it.

The dated event is mainly the check itself. The pricing pages fetched on 22 Oct showed no dated plan or price change.

Free auth providers compared: all 10 vendors#

The full dataset in one table, with values as each vendor writes them. "Yes" or "No" appears only where the vendor's page marks the feature for the free plan. "not stated" means the pages checked did not state the value; it does not mean "included" or "not included".

Three cells need care, and the dataset flags each one:

• Auth0's MFA is not stated, not "No". The comparison table marks "Pro MFA Factors" as "Not included" on Free and has no other MFA row for Free, and the docs say "Available factors are dependent on your subscription plan." (Auth0 MFA docs). Whether a basic factor is on Free is left open.
• Stytch's next price is not stated. The table gives "Volume discounts" for extra users. An FAQ example mentions "either $0.00 or $0.05 after your plan's free MAU allotment" (Stytch pricing), but that is an example, not a price list.
• Cognito's custom domain was looked for and not found. The dataset checked the Cognito custom domain docs for a plan or price rule and found none.

The last column shows the size of the next step as each vendor presents it. It is not a like-for-like comparison: some figures are a monthly base plan, some a per-user rate, and the units differ row by row.

MRU, MAU, users and AI agents: why the limits do not line up#

The headline numbers look like they sit on one scale. They do not: each vendor decides what a "user" is.

Clerk's retained users. Clerk states that "Clerk pricing is based on Monthly Retained Users (MRU), not traditional MAU." (Clerk pricing). Someone who signs up and does not come back 24 or more hours later is not counted as retained. For a launch that brings many curious one-time sign-ups, that is a real difference from an active-user count. The limit is also "per app", while the page's own title reads "Free Up to 50K Users", so you will see both wordings on one page.

Kinde's paying users. Kinde excludes users on paid subscriptions, and its Pro overage reads "$0.0175 per extra MAU ($0 for billed users)" (Kinde pricing). The page ties this to Kinde's own billing ("Free MAU when you use billing"), which on Free costs "0.7% per transaction". If you take payments elsewhere, check how those users are treated.

Cognito's account scope. The free tier is per AWS account or organisation, so several small products in one account share it. Users who sign in through SAML or OIDC federation have their own allowance: "Amazon Cognito user pools has a free tier of 50 MAUs per month per account or per AWS organization regardless of your user pool pricing tier configuration." (Cognito pricing).

Logto adds a second meter, with Pro at "50K free tokens, then billed by usage" (Logto pricing). A 50,000 MRU limit and a 50,000 monthly active user limit are not the same size, and nothing on these pages lets you convert one into the other.

Clerk vs Auth0 free tier#

Clerk vs Auth0 free tier is one of the searches that sits next to this one, so here are the two side by side, in each vendor's words.

Clerk. The Hobby card lists "Custom domain" and a "Fixed, 7 day session lifetime", so users are signed out on a schedule you cannot change on Hobby (Clerk pricing). Social sign-in is capped at three connections. MFA is the gap: the comparison row for "Multifactor authentication (MFA)", covering authenticator apps, SMS codes and backup codes, reads "Not included Included Included", so it is a paid feature. Clerk's prebuilt screens also carry its mark on Hobby. Above the included MRU, the page lists 50,001 to 100,000 retained users at "$0.02/mo each".

Auth0. The Free plan "Includes 1 Custom Domain*", and the footnote reads "*credit card verification required for custom domains. **subject to system limitations." (Auth0 pricing). The custom domain is free, but you hand over a card to turn it on. The Essentials price of "$ 35 / month" is for the slider's default of 500 users, not for 25,000; the static page does not show the price at your own count, so move the slider on the live page.

Supabase Auth and Firebase Authentication: auth inside a platform#

Supabase and Firebase do not sell auth on its own. Their auth limits sit inside a wider platform plan, so the platform's free rules apply to your login too.

Supabase Auth. The Free plan is "Perfect for passion projects & simple websites" and includes "50,000 monthly active users" (Supabase pricing). "Social OAuth providers" and "Basic Multi-Factor Auth" are included in free; "Advanced Multi-Factor Auth - Phone" and "Custom Domains" are not. The rule that catches side projects is not an auth rule: "Free projects are paused after 1 week of inactivity. Limit of 2 active projects." If the app goes quiet for a week, sign-in pauses with it. Pro is "From $ 25 / month", with "100,000 monthly active users then $0.00325 per MAU".

Firebase Authentication. The no-cost Spark plan says "No payment method needed", and the auth figure sits under "With Identity Platform": "No-cost up to 50K MAUs Then Google Cloud pricing" (Firebase pricing). A MAU limit for Firebase Authentication without Identity Platform is not stated on that page. The Identity Platform comparison page shows "Multi-factor authentication Yes No" for Identity Platform against plain Firebase Authentication, and Firebase's MFA guide begins "If you've upgraded to Firebase Authentication with Identity Platform". So MFA needs the upgrade, which the comparison page says is "available without a billing instrument" up to per day limits.

Those limits are on the Firebase Auth limits page: 3000 active users per day for Tier 1 providers on the no-cost Spark plan with Identity Platform. Tier 1 covers "Email Phone Anonymous Social" (Identity Platform pricing). On launch day, that per day figure is the one to plan around. Social sign-in is supported through "popular federated identity providers like Google, Facebook and Twitter, and more" (Firebase Auth docs), while phone sign-in is "Billed per SMS sent" (Firebase pricing).

WorkOS and Stytch: free plans built around B2B features#

Both put features that business customers ask for, like SSO, in the same product as everyday sign-in.

WorkOS (AuthKit). AuthKit is "User management with social auth, MFA, RBAC, and more", and the price card reads "Up to 1 million users Free Per additional 1M users $2,500 / mo" (WorkOS pricing). Social Auth and MFA ("Additional authentication with TOTP and SMS") are both marked "Available for all accounts". No card is needed at first: "WorkOS is free to get started and you don't need to add a credit card until you are ready to move to production." Plan for that step before launch. The custom domain, which covers "AuthKit, Admin Portal, and email sender address", is $99 / mo. Enterprise SSO is priced per connection, at $125 / ea for 1 to 15 connections (WorkOS pricing).

Stytch. The page leads with "No feature gating" and "Always free: 10,000 monthly active users and AI agents" (Stytch pricing). The static page shows the B2B plan, which lists "Full suite of authn and authz features -- OAuth, SSO, Sessions, and RBAC", "Per organization MFA controls" and "5 SSO or SCIM Connections", then "$125/connection". The Stytch OAuth docs name identity providers "like Google, Apple, and GitHub". Brand removal is extra: "Full email customization and Stytch brand removal ($ 99 )". The page also says "Our pricing does not include any hard caps or pricing cliffs.", but it gives no rate for users past 10,000, so if you expect to pass that quickly, ask Stytch for the number in writing.

Kinde, Descope, Logto and Amazon Cognito#

Kinde. Free is "Perfect for hobbyists and personal projects": "$0 forever 10,500 monthly active users (MAU) No credit card required" (Kinde pricing). The list of what Free includes covers "Email, SMS and social login", "Multi-Factor Authentication (MFA)" and "Use your own custom domain", so all three features in the dataset are on Free. Pro is "$25 USD per month" and adds "Uncapped MAU" and "Remove Kinde branding".

Descope. Free is "Free Forever $0 For hobbyists, tinkerers, and solo builders." with 7,500 monthly active users (Descope pricing). It includes "All auth methods" and "MFA / step-up authentication", and the comparison table marks Social Login present and Custom Domain absent on Free; the custom domain sits under Pro, whose list opens "Everything in Free Forever, plus:". The rule to know is the hard stop: "No overages. Upgrade required to exceed limits." On the plus side, Free has "No Descope watermark". Pro "Starts at $249 /mo", billed annually.

Logto. The cloud Free plan reads "For starting out and trying Logto, no credit card required." with "Up to 50,000 MAU" (Logto pricing). It includes three social connectors and one custom domain. MFA is an add-on covering "Passkeys, authenticator app TOTP, SMS, email and backup codes", at "$48 All factors" on Pro. Pro is "From $24/mo For production and teams" and lets you "Bring your UI and hide Logto branding". Self-hosting is separate ("Running Logto on your own infrastructure? See self-hosted plans").

Amazon Cognito. The free tier is a rule, not a plan card, and it applies only to the Lite and Essentials tiers: "There is no free tier for the Plus tier." (Cognito pricing). It does not end with the 12-month AWS Free Tier term: "The free tier does not automatically expire". The Cognito feature plans page lists social sign-in and "MFA with authenticator apps and SMS one-time codes" under "Lite + Essentials + Plus", and email codes under "Essentials + Plus". The pricing page adds that "Separate pricing applies for sending SMS messages for Multi-Factor Authentication (MFA)", so SMS codes are priced apart from the MAU free tier.

The small print on free auth plans#

The headline limit is rarely what moves a small app to a paid plan. Three patterns from the dataset matter more.

Branding on the sign-in screen. Clerk, Kinde and Logto keep their mark on free prebuilt screens or remove it only on paid plans, and Stytch charges to remove its brand (Stytch pricing). Descope's Free has "No Descope watermark" (Descope pricing). If the sign-in page is the first thing a paying customer sees, decide whether a vendor's name there is acceptable.

Hard limits versus spill-over. Descope stops at the limit and asks you to upgrade. Logto's Free is "Up to 50,000 MAU" while Pro is "Unlimited MAU" (Logto pricing). Stytch says its pricing has no "hard caps or pricing cliffs". Know which kind you are on before a spike: one blocks sign-ups, the other bills for them.

Costs outside the user count. SMS is the usual one. Firebase bills phone auth per SMS (Firebase pricing), Cognito prices MFA text messages separately (Cognito pricing), and Supabase keeps phone MFA off Free (Supabase pricing). If you plan to use SMS codes, the free user allowance is not the whole bill. Passkeys and authenticator apps avoid per message costs; passkeys vs passwords for SaaS covers what changes for users when you go passwordless, so it is not repeated here.

How to choose among free auth providers for a small app#

The dataset does not rank vendors. These questions sort the options for a particular product.

How will you count your users? Estimate sign-ups and returning users per month, then read each vendor's unit against that. A launch that brings many one-time sign-ups looks different under a retained-user count, a per-account count or a count that includes AI agents. The units table above gives each vendor's own definition where it states one.

What must the sign-in screen have on day one? List the methods: email and password, magic link, Google, GitHub, an authenticator app. Then check the free plan's social cap (three at Clerk and Logto) and MFA position (paid at Clerk and Logto, an upgrade at Firebase, not stated at Auth0).

Do you need your own domain? Clerk, Auth0, Kinde and Logto include one on free; Supabase and Descope do not; WorkOS charges $99 / mo (WorkOS pricing).

What happens when the app is quiet, or very busy? A paused Supabase project, a per day cap on Firebase's Spark plan and a hard stop at Descope are three different failure modes. Before a launch, read how to handle traffic spikes alongside the limits; auth is one of the third-party services worth checking.

What does the next step cost? Know the paid step as the vendor shows it before you need it. If you have not set a price yet, how to price a SaaS product covers that side.

How hard is it to leave? Every vendor here holds your users' identities. Check whether you can export users and password hashes before you commit; the dataset does not cover export terms, so this is a question for each vendor's docs.

Are your keys safe? Auth secrets and service keys can act as your app. Keep them out of client-side code and the repo; the vibe coded app security checklist covers exposed secrets and other common gaps.

Where ZeroRaised fits#

Sign-in is the first thing every user touches. ZeroRaised keeps the auth tiers dataset for that reason: the free plans of 10 auth and login services, every figure linked to the vendor's own page, with a visible check date and a CSV download. The ZeroRaised data hub lists it with the other datasets, including the free hosting and database tiers. If a vendor's page has changed since 22 Oct 2026, the vendor's page wins.

ZeroRaised is a free launch site for bootstrapped makers whose products have no institutional VC or accelerator equity. Once your sign-in works and your users can get back in, you can submit your product for review. The maker perks page lists separate offers for eligible makers, some of which cut running costs.

So, free auth providers in one line: all ten vendors checked publish a free plan, but they count users in different units, put MFA and custom domains in different places and handle the limit in different ways, so match the small print to your sign-in page before you match the headline number.