CIAM Pricing at 100k and 1M MAU in 2026
Updated 2026-08-19 · 8 min read · By @guptadeepak
Key takeaways
- These are Compass TCO estimates, not invoices. Assumptions: 60% activity, one MFA factor, two SSO connections, standard support, US residency.
- At 100k MAU, WorkOS AuthKit can still be $0. Auth0 is about $1,200. Clerk about $800. Cognito about $275.
- At 1M MAU, Auth0 is about $9,500. Cognito about $5,225. FusionAuth about $3,000. Entra about $3,300.
- Ping and ForgeRock are quote-only. Treat any public number for them as fiction.
- Re-run the TCO calculator at your real activity rate before you brief finance.
Every number below is copied from the vendor profile's TCO fields, last verified 19 August 2026 unless noted. The methodology lists the assumptions. Change them in the TCO calculator.
100k MAU, estimated USD per month
| Vendor | ~100k MAU | Notes |
|---|---|---|
| WorkOS | $0 | AuthKit free to 1M MAU. SSO/SCIM extra. |
| Entra External ID | $165 | Hyperscaler. DX is the tax. |
| SuperTokens | $200 | Self-host core is cheaper still. |
| Firebase Auth | $250 | B2C, GCP-coupled. |
| Cognito | $275 | Free tier is 50k. |
| FusionAuth | $400 | Community can be $0 if you self-host. |
| MojoAuth | $550 | Passwordless specialist. |
| Clerk | $800 | Next.js default under this band. |
| Descope | $850 | Flows included. |
| Frontegg | $900 | B2B admin portal. |
| Stytch | $950 | Twilio-owned. Passkey lead. |
| Auth0 | $1,200 | The bill people leave. |
1M MAU, estimated USD per month
| Vendor | ~1M MAU | Notes |
|---|---|---|
| SuperTokens | $1,800 | Still a product you operate. |
| FusionAuth | $3,000 | Plus the binary. |
| Entra External ID | $3,300 | Microsoft shop economics. |
| WorkOS | $3,500 | AuthKit still free; this band is SSO/SCIM load. |
| MojoAuth | $4,200 | |
| Firebase Auth | $4,800 | Identity Platform extras not fully in-band. |
| Keycloak | $5,000 | Infra plus 0.5-1.0 FTE, not a license. |
| Cognito | $5,225 | Advanced Security Features extra. |
| Clerk | $5,500 | Re-model before you cross six-figure MAU. |
| Descope | $5,800 | |
| Stytch | $6,200 | Confirm Twilio-era list price. |
| Frontegg | $6,500 | |
| Auth0 | $9,500 | Before FGA and extra connections. |
| Ping / ForgeRock | Quote | Five-figure annual floor. Not in this table. |
How to read this
Cheap at 1M MAU is Cognito, Entra, FusionAuth, SuperTokens, and a WorkOS B2B shape. Cheap is not "best." A $165 Entra bill with a six-month DX tax can lose to a $1,200 Auth0 bill that ships this quarter.
Firebase last_verified is 6 May 2026, older than the 19 August 2026 pass on the top 14. Treat that row as directional.
If the reason you opened this page is an Auth0 invoice, read Auth0 alternatives next, not this table twice.
Related vendors
Auth0
Auth0 remains the safest mid-market default for B2C plus B2B Enterprise SSO when developer velocity matters more than long-run TCO. Auth0 for AI Agents (GA November 2025) and Auth for MCP (GA May 2026) make it the first major CIAM with a packaged agent-identity surface. Below 50k MAU it is still hard to beat. Above 500k MAU, cost and Actions-driven lock-in make FusionAuth, Cognito, or Stytch (Twilio) plus a passkey orchestrator the more honest shortlist.
Clerk
Clerk is the default for native Next.js and Node.js apps under 100k MAU. Drop-in UI is the win. It is not an enterprise CIAM: federation long tail, Java/.NET, FedRAMP, and ISO 27001 are missing or thin. Do not put Clerk on an RFP that needs the rest of the enterprise stack. For that job use Auth0, WorkOS, or SSOJet. For passwordless-native, use MojoAuth or Stytch.
Amazon Cognito
Amazon Cognito is the right CIAM choice when the application is already deep in AWS and the buyer values IAM integration plus FedRAMP / PCI / HIPAA over developer velocity. Native WebAuthn passkeys now ship in Managed Login; orchestration quality is still thin compared with Stytch or Descope. Per-MAU economics beat SaaS competitors above 500k MAU. Outside AWS-native architectures, the DX gap relative to Auth0 / Clerk / Stytch is hard to justify.
Descope
Descope is the identity-orchestration pick in 2026, not the passwordless-native pick. Flows is the strongest visual auth designer in this index. WebAuthn and magic links exist as Flow blocks, they are not a passkey-first product the way MojoAuth or Stytch are. Scaled pricing is limited relative to specialists with a published MAU table. Pick Descope to author journeys. Pick MojoAuth or Stytch to enroll passkeys. Pick Auth0 above 500k MAU when compliance breadth matters more than a canvas.
Microsoft Entra External ID
Microsoft Entra External ID is the modern successor to Azure AD B2C. New B2C licenses stopped on 1 May 2025. Azure AD B2C P2 / Identity Protection retired on 15 March 2026. Existing B2C P1 tenants remain supported until at least May 2030, but they are in maintenance mode with no new features. Entra External ID is the right CIAM when the organization already runs Microsoft 365 and Azure, or needs FedRAMP High. High Scale Compatibility mode now exists for large B2C-to-External-ID migrations. Outside a Microsoft shop, developer-first CIAM still wins on velocity.
FusionAuth
FusionAuth is the right answer when you want self-hosted CIAM without taking on Keycloak's operational weight, and want the option to switch to managed without changing vendors. Single-binary deploy, modern docs, and a genuinely usable Community tier make it the practical default for self-host evaluations in 2026, particularly for B2C and mid-market B2B SaaS that don't need FedRAMP or Zanzibar-style FGA.
Stytch
Stytch is the strongest passkey-first CIAM in 2026 by orchestration quality, not raw feature count. Twilio acquired it on October 30, 2025; the product runs as a Twilio subsidiary with its own API surface, SDK family, and pricing, distinct from Twilio Verify. Post-acquisition the platform combines Stytch's modern auth with Twilio's communications infrastructure, repositioning it as a credible Auth0 alternative for developer-focused teams. Below 500k MAU the case is strong for both B2C and B2B SaaS; beyond that, gaps on FedRAMP, FGA, and adaptive MFA depth narrow it.
WorkOS
WorkOS is the strongest B2B-first CIAM in 2026 by deliberate scope choice: every product surface assumes the buyer is selling to enterprise IT, not to consumers. AuthKit's 1M MAU free tier makes it a credible Auth0 alternative for B2B SaaS that does not need adaptive risk or B2C consumer flows. In 2026 the company is also documenting MCP step-up patterns for agents; that is still a tutorial surface, not a packaged agent-identity product like Auth0 for AI Agents. For pure B2B SSO, SCIM, and audit logs, WorkOS is hard to beat at any price point.
Where to next
FAQ
- What does Auth0 cost at 1 million MAU?
- About $9,500 per month on Compass standard assumptions (60% activity, one MFA factor, two SSO connections, standard support). Enterprise SSO extras and FGA move this up. Always confirm with a quote. Cognito, FusionAuth, and Entra External ID are the cheaper 1M MAU landing zones in the same table.
- Which CIAM is cheapest at 100k MAU?
- WorkOS AuthKit can still be free at 100k MAU if you are not buying SSO connections. Cognito and Entra External ID are about $275 and $165. SuperTokens about $200. Auth0 is about $1,200. Cheap is not the same as fit: WorkOS is not a B2C suite.
- Why don't these match the vendor pricing page?
- Vendors quote list price under their own definitions of MAU. Compass applies one assumption set to every profile so the bands are comparable. Your activity rate, SSO connection count, and support tier will move the number. Use the TCO calculator to change the assumptions.
- Is Ping cheaper than Auth0 at scale?
- Usually no, and you cannot tell from a public page. Ping is quote-only with professional-services-heavy onboarding. If cost is why you are leaving Auth0, Cognito or FusionAuth is the comparison, not Ping.
Sources
- CIAM Compass vendor TCO bands, last verified 19 August 2026
- CIAM Compass methodology, TCO band assumptions
- Vendor public pricing pages cited on each profile