Solution Landscape 2026

The CIAM Market in 2026

The CIAM market has matured over the past three years. What was once a niche dominated by a few enterprise players is now a crowded field, with solutions for every stage from early-stage startups to global enterprises serving hundreds of millions of users.

MarketsandMarkets sizes the market at $14.12 billion in 2025, growing to $22.47 billion by 2030 (a 9.7% CAGR). Other research firms define the market differently and publish different numbers, so treat any single figure as directional. Chapter 7 covers what the market's growth and consolidation mean for buyers.

Three structural shifts are reshaping the landscape:

1. Consolidation keeps changing the vendor list. Okta has owned Auth0 since 2021. Twilio announced its acquisition of Stytch on October 30, 2025, and Stytch's changelog confirms the deal closed on November 14, 2025. Microsoft stopped selling Azure AD B2C to new customers on May 1, 2025 (Microsoft Learn), and Akamai is shutting down Identity Cloud at the end of 2027.

2. Passwordless-first architectures are no longer experimental. Passkeys (FIDO2/WebAuthn) are supported across all major browsers and operating systems. In the FIDO Alliance's October 2026 Passkey Index, 36% of successful sign-ins at participating services used a passkey, up from 26% a year earlier. Vendors built around passwordless, like MojoAuth, have an architectural head start over those that retrofitted it.

3. Authentication-as-infrastructure. Companies like WorkOS, SSOJet, and Clerk focus on narrow, high-quality slices of the identity problem rather than trying to be all-in-one platforms. WorkOS and SSOJet center on enterprise SSO; Clerk centers on developer-friendly auth with prebuilt UI.

Market Categories

The CIAM market breaks down into five categories:

Full-Platform CIAM

Comprehensive solutions covering authentication, authorization, user management, consent, and compliance. Best for mid-market and enterprise with complex requirements.

Players: Auth0 (Okta), Ping Identity (which absorbed ForgeRock in 2023), SAP Customer Data Cloud

Developer-First Auth

Authentication services designed primarily for developer experience, with clean APIs, modern SDKs, and fast integration. Best for startups and product-led growth companies.

Players: Clerk, Stytch (now part of Twilio). Passage by 1Password was retired on January 16, 2026.

Cloud Provider Auth

Authentication services bundled with major cloud platforms. Best for teams heavily invested in a single cloud ecosystem.

Players: Amazon Cognito, Firebase Authentication and Google Cloud Identity Platform, Microsoft Entra External ID. (Azure AD B2C is closed to new customers; Entra External ID is its successor.)

Passwordless-First Vendors

Solutions built from the ground up around passwordless authentication: passkeys, magic links, biometrics, and OTP. Best for consumer-facing applications where login friction directly affects conversion.

Players: MojoAuth, with Stytch as a passwordless-strong developer platform. Hanko and Corbado are passkey specialists (open-source server and adoption layer, respectively).

Enterprise SSO Specialists

Focused on enterprise authentication: SAML, OIDC federation, directory sync. Best for B2B SaaS companies whose primary identity need is supporting customer SSO.

Players: WorkOS, SSOJet

For a directory of CIAM providers and how they compare, see my CIAM providers directory and the vendor profiles on CIAM Compass. For a second, independent view, Start with Identity, the non-profit identity community I run, publishes CIAM rankings by use case and head-to-head comparisons.

Ten Solutions Compared

Every price below was checked against the vendor's own pricing page in early November 2026. Pricing in this market changes often, and vendors count users differently, so confirm current terms before you sign.

Auth0 (Okta)

Best for: Mid-market and enterprise companies needing a full-featured CIAM platform with strong documentation.

Auth0 remains the most recognized name in developer-focused CIAM. Okta completed its acquisition in May 2021. The platform covers authentication, authorization (including Fine-Grained Authorization, based on Google's Zanzibar model), user management, and customization through Actions (serverless hooks).

Strengths: Mature platform with a broad feature set. Strong documentation and developer community. Actions allow deep customization. Large marketplace of prebuilt integrations and social connections. Passkeys are included on the Free plan.

Weaknesses: Cost rises steeply past the free tier, and features like enterprise SSO, log streaming, and advanced MFA sit on higher tiers. Since the acquisition, the roadmap has leaned toward Okta's enterprise focus, which some developer-first customers dislike.

Pricing: Per the Auth0 pricing page, the Free plan covers 25,000 MAU on both B2C and B2B. Paid B2C plans start at $35 per month (Essentials) and $240 per month (Professional). Enterprise pricing is custom.

Okta: One Vendor for Workforce and Customer Identity

Best for: Large enterprises already using Okta for workforce identity who want one vendor for employees and customers.

Okta sells customer identity using the Auth0 technology. From 2022 it also marketed it as Customer Identity Cloud, so you will see both names. The pitch is managing employee and customer identity from a single vendor.

Strengths: Single vendor for workforce and customer identity. Broad compliance coverage. Large enterprise sales team and partner ecosystem.

Weaknesses: Workforce Identity and Auth0 remain separate products under one vendor relationship, so "unified" mostly means one contract. The sales process is enterprise-heavy even for smaller deals.

Pricing: Customer identity follows Auth0 pricing above; large deals are custom. Okta's workforce suites are priced separately, per user per month.

Amazon Cognito

Best for: AWS-native teams wanting managed auth with minimal vendor management.

Cognito provides user pools (authentication) and identity pools (authorization for AWS resources). It integrates natively with API Gateway, Lambda, AppSync, and other AWS services.

Strengths: Deep AWS integration. Pay-as-you-go pricing. Supports SAML and OIDC federation. Passkey sign-in and passwordless one-time codes on the Essentials and Plus tiers. Managed service with AWS SLAs.

Weaknesses: The developer experience is rough. Documentation is dense and assumes AWS expertise. Polished, branded login UX takes real work. User migration requires Lambda triggers, because Cognito does not import password hashes. No built-in consent management.

Pricing: Per the Cognito pricing page, user pools have three tiers. Lite and Essentials are free to 10,000 MAU. Above that, Lite costs $0.0055 per MAU for the next 90,000 and $0.0046 after. Essentials costs $0.015 per MAU, and Plus costs $0.020 per MAU with no free tier. SAML/OIDC federated users get 50 free MAU, then $0.015 per MAU. Lite pools created before November 22, 2024 keep an older 50,000 MAU free tier.

Cognito MAU (direct sign-in)	Lite	Essentials	Plus
10,000	$0	$0	$200
100,000	$495	$1,350	$2,000
500,000	$2,335	$7,350	$10,000
1,000,000	$4,635	$14,850	$20,000

These are my calculations from the published rates; check the AWS calculator for volume tiers above 1 million MAU.

For a head-to-head, see Auth0 vs Cognito on CIAM Compass.

Firebase Authentication

Best for: Mobile-first applications and early-stage projects on Google Cloud.

Firebase Auth provides straightforward authentication with excellent mobile SDKs. It's tightly integrated with the Firebase ecosystem (Firestore, Cloud Functions, Hosting). Upgrading to Firebase Authentication with Identity Platform adds enterprise features.

Strengths: Strong mobile SDKs for iOS and Android. Anonymous authentication for guest users. Phone number authentication built in. Tight integration with Google Cloud.

Weaknesses: Limited enterprise features. SAML and OIDC federation and multi-tenancy require the Identity Platform upgrade. User management is basic, with no RBAC beyond custom claims. No consent management. Not well suited to complex B2B or heavily regulated use cases.

Pricing: Per the Firebase pricing page, authentication with Identity Platform is free up to 50,000 MAU for standard sign-in and 50 MAU for SAML/OIDC. Above that, Google Cloud Identity Platform rates apply. Phone auth is billed per SMS, at rates that vary by country. On the no-cost Spark plan, Firebase's limits page caps Identity Platform projects at 3,000 daily active users.

See Cognito vs Firebase Auth for the two cloud options side by side.

WorkOS

Best for: B2B SaaS companies that need enterprise SSO and directory sync above all else.

WorkOS focuses on enterprise authentication infrastructure rather than trying to be a full CIAM platform. Its core products are SSO (SAML/OIDC federation), Directory Sync (SCIM), and an Admin Portal for self-service SSO setup. AuthKit adds complete user authentication on top.

Strengths: Well-regarded enterprise SSO implementation. The Admin Portal lets your customers configure their own SSO without involving your support team. Clean, well-documented API. Directory sync with the major providers (Okta, Microsoft Entra ID, Google Workspace, and others).

Weaknesses: Historically SSO-first, so the broader AuthKit features have a shorter track record. Less suited to consumer (B2C) authentication than to B2B.

Pricing: Per the WorkOS pricing page, AuthKit is free for the first 1 million MAU, then $2,500 per month for each additional million. SSO and Directory Sync each cost $125 per connection for connections 1 to 15, with volume discounts above that.

See WorkOS vs SSOJet for the closest alternative.

Clerk

Best for: Next.js and React developers building modern web applications who want auth that "just works."

Clerk emerged from the React ecosystem and offers one of the strongest developer experiences in the market. Its prebuilt components, hooks, and middleware feel native to modern JavaScript frameworks.

Strengths: Well-designed prebuilt React/Next.js components (user button, user profile, sign-in) that you can customize or use as-is. Organizations support for multi-tenant apps. Fast integration. Passkey autofill support in its sign-in API.

Weaknesses: Most at home in the JavaScript/TypeScript ecosystem; backend SDKs for other languages exist but get less attention. Costs climb at consumer scale. Passkeys and MFA are not on the free plan.

Pricing: Clerk counts monthly retained users (MRU), not MAU. Per the Clerk pricing page, the Hobby plan is free up to 50,000 MRU per app. Pro costs $25 per month ($20 billed annually), with $0.02 per MRU from 50,001 to 100,000 and lower rates above. Business costs $300 per month ($250 billed annually). Passkeys and MFA start on Pro, which includes one enterprise SSO connection per app.

Clerk MRU	Monthly cost (Pro, monthly billing)
50,000	$25
100,000	$1,025
Above 100,000	Tiered lower rates; use Clerk's calculator

See Clerk vs Stytch for a head-to-head.

Stytch (Twilio)

Best for: Companies that want passwordless-strong, API-first authentication, especially teams already building on Twilio.

Stytch started around passwordless authentication (magic links, OTPs, and biometrics) and expanded into passwords, OAuth, session management, and a B2B product. Twilio announced the acquisition on October 30, 2025, and it closed on November 14, 2025. For context on the deal, see my analysis of the Twilio and Stytch acquisition and the CIAM Compass changelog entry.

Strengths: Strong passwordless and passkey implementation, with device-bound and synced passkeys. Device fingerprinting and fraud detection. Flexible API-first design: use its frontend SDKs or build fully custom UIs. B2B product with organizations, SSO, SCIM, and RBAC.

Weaknesses: Roadmap and contract terms after the Twilio deal are still settling, so ask directly. Per-MAU rates above the free tier are not listed publicly.

Pricing: Per the Stytch pricing page, Consumer and B2B are each free for 10,000 monthly active users and AI agents, then pay-as-you-go. Additional SSO or SCIM connections cost $125 each after five included.

FusionAuth

Best for: Teams that want full control over their identity infrastructure, self-hosted or cloud-hosted.

FusionAuth is a full-featured CIAM you can self-host for free. Its commercial revenue comes from paid editions with premium features, support, and managed hosting.

Strengths: Free self-hosted Community edition with no per-user fees. Full control over data and infrastructure. Broad feature set including theming, consent management, SAML, and OIDC. Entity management for complex authorization models.

Weaknesses: Self-hosting means you own the ops burden: upgrades, scaling, monitoring, security patching. Several advanced features sit in paid editions. Not as "plug and play" as Clerk or Stytch.

Pricing: Per the FusionAuth pricing page, Community is free and self-hosted. Paid plans include hosting and start with Starter at $162 per month billed annually; Essentials and Enterprise are listed at $2,970 per month billed annually.

MojoAuth

Best for: Consumer-facing applications where login friction directly affects conversion, and teams that want to go passwordless from day one.

MojoAuth is a passwordless-first CIAM. Its documentation lists magic links, email OTP, SMS OTP, passkeys, WebAuthn, and social login through one API. It can act as an OIDC or SAML identity provider for your apps, and as a service provider to enterprise identity providers such as Okta and Azure AD.

Strengths: Passwordless is the default path, not a feature added to a password system. Passkeys are a primary factor. Step-up authentication with risk-based, transaction-based, time-based, and location-based triggers. Password login exists on Business Pro, but only to support migrations.

Weaknesses: Smaller ecosystem and narrower feature set than full platforms like Auth0. If password-based login is a core requirement rather than a migration bridge, it's not the right fit. Less public track record with very large deployments.

Pricing: Per the MojoAuth pricing page, the Free plan covers core passwordless features (magic links and email OTP) for up to 25,000 MAU. Passkeys and phone OTP start on Business Pro, at $150 per month for 2,500 MAU up to $4,800 per month for 100,000 MAU. Enterprise (private cloud) is custom.

For head-to-heads, see MojoAuth vs Auth0 and MojoAuth vs Stytch.

SSOJet

Best for: B2B SaaS companies that need enterprise SSO without per-user pricing.

SSOJet focuses on the problem most B2B SaaS companies face: enterprise customers demand SAML/OIDC SSO, but building and maintaining it is expensive. It offers SSO and SCIM connections, team management widgets, and self-serve SSO configuration so your customers can set up their own connections.

Strengths: Works with Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping Identity, JumpCloud, Duo, and any SAML 2.0 or OIDC provider. Self-serve setup reduces support load. SAML, OIDC, and SCIM support. Unlimited users and MAU on every plan, so costs follow connections, not user growth.

Weaknesses: Narrower than full-platform CIAM. If you need advanced consumer features (progressive profiling, consent management), you'll pair it with something else. Newer entrant with a smaller customer base and ecosystem.

Pricing: Per the SSOJet pricing page, the Free plan has unlimited users and includes passkeys, social login, magic links, and MFA, but no SSO or SCIM connections. Business costs $59 per connection per month billed annually ($79 monthly) for 2 to 4 connections, with lower per-connection rates at volume. Enterprise is custom.

Pricing Model Comparison

How each vendor charges determines what you pay at scale. This table summarizes the published models as of early November 2026.

Vendor	Model	Free tier	Passkeys	Enterprise SSO
Auth0	Per MAU, tiered plans	25,000 MAU	Included on Free	Higher tiers
Amazon Cognito	Per MAU, three tiers	10,000 MAU (Lite, Essentials)	Essentials and Plus	$0.015 per federated MAU after 50
Firebase / Identity Platform	Per MAU above free tier	50,000 MAU	Check current docs	Identity Platform, 50 MAU free
WorkOS	Per connection; AuthKit per MAU block	1M MAU (AuthKit)	Check current docs	$125 per connection (1 to 15)
Clerk	Per MRU (retained users)	50,000 MRU per app	Pro and above	1 connection on Pro, then $75 each
Stytch	Per MAU, pay-as-you-go	10,000 MAU and AI agents	Native	5 included, then $125 each
FusionAuth	Free self-hosted; paid editions	Community (self-hosted)	Check current docs	Check edition
MojoAuth	Per MAU tiers	25,000 MAU	Business Pro and above	SAML/OIDC federation; confirm tier
SSOJet	Per connection	Unlimited users	Included on Free	From $59 per connection (annual)

"Check current docs" means the pricing page did not settle it when I looked. Ask the vendor.

When to Choose Each: By Company Stage

These recommendations are my judgment, not a ranking. Use them to build a shortlist, then test.

Seed to Series A (0-50,000 users, 1-15 engineers)

Recommended: Clerk, Firebase Auth, or MojoAuth

At this stage, speed matters most. You need auth working in hours, not weeks. Clerk gives you the fastest path for React/Next.js apps. Firebase is the usual choice for mobile-first apps. MojoAuth is the right call if you want passwordless from the start, and its 25,000 MAU free tier means you're not paying for auth before you have revenue.

Don't over-engineer identity at this stage. You can migrate later. Pick the solution that gets you to market fastest.

Series A to Series B (50,000-500,000 users, 15-50 engineers)

Recommended: Auth0, Stytch, WorkOS with AuthKit, SSOJet, or FusionAuth

You're starting to meet enterprise requirements. Prospects ask for SSO. Your compliance team asks about SOC 2. You need MFA that actually works. WorkOS fits if SSO is your primary need. SSOJet is a strong alternative if you want connection-based pricing with unlimited users. Auth0 is the safe, full-featured choice. Stytch suits teams on Twilio or with heavy B2B needs. FusionAuth fits if you want to control your infrastructure.

Series C and Beyond (500,000+ users, 50+ engineers)

Recommended: Auth0 Enterprise, FusionAuth (self-hosted), or Okta for combined workforce and customer identity

At this scale, you need a vendor that has proven it can handle your throughput, holds the certifications your customers require, and has an enterprise support team that responds in hours. FusionAuth self-hosted becomes more attractive here because per-MAU pricing starts to hurt.

Enterprise / Regulated Industries

Recommended: Auth0 Enterprise, Okta, FusionAuth Enterprise, or Ping Identity

Compliance certifications are non-negotiable. FedRAMP (for US federal), HIPAA BAA, SOC 2 Type II: you need the ones your customers require, and a vendor with a track record of passing customer security reviews. Premium enterprise pricing buys compliance infrastructure and dedicated support.

The Passwordless-First Vendors

Passwordless authentication has crossed the chasm. Apple, Google, and Microsoft all support passkeys natively. In the FIDO Alliance's October 2026 Passkey Index, passkey sign-ins succeeded 93% of the time versus 78% for traditional MFA. For new applications, starting with passwordless is increasingly the right default.

MojoAuth: Built around passwordless. Magic links, email OTP, SMS OTP, WebAuthn, and passkeys are the sign-in methods, with passwords offered on Business Pro only as a migration bridge. Standards-based OIDC and SAML make it straightforward to plug into existing infrastructure.

Stytch: Passwordless-strong from the start. Magic links, email/SMS OTP, passkeys, biometrics, and device fingerprinting are core to its architecture, not add-ons.

Hanko: Open-source, passkey-first authentication server; self-hosting is free under AGPL-3.0.

Corbado: A passkey adoption layer that runs on top of your existing identity provider, for brands whose passkey usage has stalled.

Clerk: Strong passkey support in its prebuilt components, on paid plans. Not passwordless-first, but passwordless-capable with little configuration.

Passage (by 1Password): Retired on January 16, 2026, so not an option for new projects. If you are still on it, migrate the passkey layer to another provider.

For Auth0 and Cognito, passwordless is available but takes more configuration to get a polished experience than with vendors built around it. For a deeper vendor-by-vendor passkey comparison, see the recommended passwordless vendors chapter of my Passwordless Playbook for Brands.

Open-Source vs. Commercial Trade-Offs

The open-source CIAM market has matured considerably. Here's a framework for deciding:

Choose Open-Source When:

• You have DevOps/infrastructure expertise to manage self-hosted services
• Per-MAU pricing at your scale makes commercial vendors prohibitively expensive
• You need full control over the source code (regulated industries, government)
• Data sovereignty requirements mean data can't leave your infrastructure
• You want to avoid vendor lock-in entirely

Open-source options: Keycloak (Apache 2.0), Ory (Apache 2.0), ZITADEL (AGPL-3.0 since v3), Authentik (MIT core). FusionAuth Community is free but not open source; it ships under FusionAuth's own license.

Choose Commercial When:

• You want managed infrastructure and don't want to own auth ops
• You need enterprise support with SLAs
• Compliance certifications (SOC 2, HIPAA, FedRAMP) are required; self-hosting means you own the compliance burden
• Your team's time is more expensive than the vendor's pricing
• You need a vendor to point to during customer security reviews

The Hybrid Path

Some vendors offer both: self-host for development and testing, use the managed service for production. FusionAuth, Ory, and ZITADEL all support this model. It gives you the flexibility of self-hosting with the operational simplicity of a managed service where it matters most.

Making the Decision

The CIAM market in 2026 offers more options than ever. That's good for buyers but makes selection harder. Here's how to cut through the noise:

1. Start with your constraints: Compliance requirements, budget ceiling, and tech stack eliminate a large share of options immediately.
2. Match vendor maturity to your stage: Don't buy an enterprise CIAM platform for a seed-stage startup, and don't use a developer tool for an enterprise deployment.
3. Test with your engineers, not your procurement team: The evaluation framework from Chapter 2 only works if engineers actually build a proof of concept.
4. Model pricing at 3-5x your current scale: The vendor that's cheapest today might be the most expensive in two years.
5. Check the vendor's trajectory: Is the company growing? Is the product actively developed? Has it been acquired? A great product from a struggling company is a migration waiting to happen.

For more on authentication technologies, see my articles on passwordless authentication and OAuth 2.0 and OpenID Connect security.