Updated October 26, 2026
· ~3 min read
Customer identity is the one piece of infrastructure every product needs and almost nobody wants to build, and the market for it changed shape in the last two years. Amazon Cognito was rebuilt into Lite, Essentials and Plus tiers with managed login and passkeys, then spent 2026 adding the features teams used to leave it for: multi-Region replication, password-hash import, client-secret rotation. Twilio announced its acquisition of Stytch in October 2025. Auth.js, the most-used open-source auth library for JavaScript, is now maintained by the Better Auth team. Auth0 added an "Auth0 for AI Agents" tier for products whose users are increasingly software.
Free tiers also moved dramatically: from 10,000 monthly active users on Cognito to a million on WorkOS AuthKit. Pricing per user now differs by more than an order of magnitude between providers — which matters less at launch than at the scale where you can no longer easily move.
At 100,000 monthly active users on email and social sign-in, list prices land roughly here: Cognito Essentials about $1,350 a month; Cognito Lite about $500; Clerk Pro about $1,025 (counting retained users, which is usually fewer than active ones); Supabase Pro the $25 base; WorkOS AuthKit nothing; Auth0 a negotiated enterprise price. The spread is large enough to matter, and it is the wrong first criterion. What costs real money is migrating later — and the cost of migration is set by two things you control from day one: whether you can export password hashes, and whether your application's user IDs belong to you rather than to the provider.
Every hosted provider makes leaving possible and none make it pleasant. The parts that bind you are password hashes (can you export them, and in which algorithm?), MFA enrolments and passkeys (which generally cannot move — users re-enrol), hosted login customisations, and provider-specific hooks your business logic grew into. Cognito's July 2026 support for importing bcrypt, scrypt, Argon2id and PBKDF2-SHA256 hashes made arriving on Cognito much easier; check the export side of whatever you choose with the same care. Store your own user ID as the primary key and the provider's as an attribute, and a future migration becomes a data job instead of a rewrite.
Question 1 of 2
Do you sell to businesses that will ask for SSO and SCIM?
On AWS with a consumer or prosumer product, Cognito Essentials is the default: 10,000 MAUs free, $0.015 per MAU after, passkeys and managed login, IAM-native, and now multi-Region. Choose WorkOS when you sell to businesses and need enterprise SSO and SCIM early — its free million MAUs make consumer-scale sign-in effectively free and its per-connection SSO pricing is predictable. Choose Clerk for the fastest polished developer experience in React and Next.js, with a generous free tier counted on retained users. Choose Auth0 when you need its breadth — rules, extensibility, enterprise features, AI-agent token vaulting — and can absorb the price at scale. Choose Entra External ID if you are a Microsoft shop, and Supabase Auth if you are already on Supabase. Whatever you choose, keep password hashes exportable and user IDs your own, so leaving remains possible.
Multi-Tenant SaaS Platform Architecture
Production-ready SaaS architecture supporting secure multi-tenant isolation and rapid scaling.
Identity for AI Agents and MCP Authorization
Make your product safe for AI agents to use and your own agents safe to run: an OAuth resource server and MCP authorization that follow the current spec, on-behalf-of tokens from a vault, human approval for consequential actions, and an audit trail that names both the person and the agent.
SOC 2 Accelerator on AWS
Production-ready AWS architecture and controls designed to pass SOC 2 quickly and safely.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.