On this page · 11 sections
- What changes before and during 2027
- Clerk: retained users, connections and add-ons
- Amazon Cognito: three tiers, priced per MAU
- Auth0: generous free tier, steep paid bands
- Head-to-head comparison
- Worked cost at 10,000, 100,000 and 1 million users
- Which one to choose
- US and UK considerations
- Migration and implementation checklist
- How eCorpIT can help
- References
Summary. For a consumer-style app, Amazon Cognito and Clerk cost far less than Auth0 past 25,000 users, and Auth0's public calculator stops at 30,000 monthly active users (MAU). Cognito's Lite and Essentials tiers include 10,000 free MAU per account, then Essentials costs $0.015 per MAU; Plus costs $0.020 with no free tier. Clerk's free Hobby plan covers 50,000 monthly retained users (MRU) per app; Pro costs $20 a month billed annually ($25 monthly) with 50,000 MRU included, then $0.02 per extra user, falling to $0.018 above 100,000. Auth0's Free plan covers up to 25,000 MAU; B2C Essentials starts at $35 a month for 500 MAU and reaches $700 at 10,000. At 100,000 users we work out Cognito Lite at $495 a month, Clerk Pro $1,020, Cognito Essentials $1,350 and Auth0 by quote. B2B bills diverge most: Clerk charges $75 a month per extra SSO connection and, from 1 January 2027, per extra Directory Sync (SCIM) connection. Cognito charges federated users $0.015 per MAU after 50 free. Auth0 B2B Essentials is $2,100 a month at 10,000 MAU with three enterprise connections, plus at least $100 a month for each extra one.
About this article. For CTOs, product managers and founders in the US and UK choosing a login provider. We checked every price, plan name, quota and billing basis against each vendor's own pricing page, documentation and announcements on 12 November 2026, and recomputed every total; Auth0's bands come from the plan data behind its calculator. These are US dollar list prices, which change often; negotiated discounts are not shown. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What changes before and during 2027
Four dated changes matter for contracts signed now.
- Clerk starts billing Directory Sync on 1 January 2027. Directory Sync provisions and removes users through SCIM or Google Workspace, and Clerk counts it separately from SSO. Pro and Business include one connection per app; each extra one costs $75 a month, falling to $60 and then $48 at volume. Until then, Clerk's docs say there is no charge. If you switched SCIM on for customers during 2026, January's invoice is the first to show it.
- Auth0's Free plan now carries B2B features. The Free plan, up to 25,000 MAU, lists one Enterprise Connection, Self-Service SSO and SCIM, all marked new. A footnote on the paid B2C plans says you must move to a B2B plan to keep those three, so upgrading from Free to B2C Essentials can remove capabilities.
- Cognito Plus now carries a 99.99% SLA. From 1 November 2026, AWS commits to 99.99% monthly uptime for user pools on Plus, up from 99.9%; Lite and Essentials stay at 99.9%.
- Cognito keeps adding Essentials features. Session management, which lists and revokes a user's sessions, arrived on 11 November 2026 for Essentials and Plus only. The offer to move existing pools to Essentials at the old price ended on 30 November 2025.
If you sell to enterprises, count SSO and SCIM connections, not just users: for many B2B products, connections now cost more than users.
Clerk: retained users, connections and add-ons
Clerk bills on monthly retained users. A user counts only if they come back to your app at least a day after signing up, which Clerk calls First Day Free. Someone who signs up and never returns is not billed, so MRU will usually run below a conventional MAU count.
| Clerk plan | Price | Users included | Key inclusions |
|---|---|---|---|
| Hobby | Free | 50,000 MRU per app | Up to 3 dashboard seats; no MFA, passkeys, SMS codes, SSO or Directory Sync |
| Pro | $20/month billed annually, $25 monthly | 50,000 MRU per app | MFA, passkeys, 1 SSO connection, 1 Directory Sync connection, branding removal |
| Business | $250/month billed annually, $300 monthly | 50,000 MRU per app | 10 dashboard seats, SOC 2 report, priority support, 30-day logs |
| Enterprise | Custom, billed annually only | Custom | 99.99% uptime SLA, HIPAA BAA available |
Extra MRUs on Pro and Business cost $0.02 each from 50,001 to 100,000, $0.018 to 1 million, $0.015 to 10 million and $0.012 above that. SSO connections (SAML, OIDC or EASIE) use the same bands as Directory Sync: $75 a month each from the second to the 15th, $60 to the 100th, $48 to the 250th, and a quote above that. Organisations are free for up to 100 monthly retained organisations per app and 20 members each. The Enhanced B2B add-on costs $100 a month, or $85 billed annually, and adds unlimited members, verified domains, custom roles and the ability to link enterprise connections to organisations. SMS codes cost $0.01 per message in the US and Canada, with international SMS at market rate.
Clerk suits React and Next.js teams that want prebuilt sign-in components and published overage rates. Its limits: no self-hosted option is listed, and every B2B connection after the first carries a monthly fee.
Amazon Cognito: three tiers, priced per MAU
Cognito user pools are priced per MAU. A user counts once in a calendar month if your app performs any identity operation for them, such as a sign-in, token refresh or admin update; later sessions that month are free. There is no minimum fee.
| Cognito tier | Free tier | Price per MAU (direct and social sign-in) | Notable features |
|---|---|---|---|
| Lite | 10,000 MAU | $0.0055 to 100,000; $0.0046 to 1 million | Password, social and SAML or OIDC sign-in, SMS and app MFA, Lambda triggers |
| Essentials (default) | 10,000 MAU | $0.015 | Adds visual login editor, passkeys, email codes, passwordless sign-in, token customisation |
| Plus | None | $0.020 | Adds threat protection, adaptive authentication, compromised-credential checks, 99.99% SLA |
Rates come from the Cognito pricing page and are the same in US East (N. Virginia) and Europe (London); feature splits come from AWS's plan documentation. Users who sign in through SAML or OIDC federation are priced separately on every tier: 50 free MAU, then $0.015 each. The free tiers do not expire after the 12-month AWS Free Tier, but they do not apply in the AWS GovCloud (US) Regions. One exception helps older accounts: Lite user pools created on or before 22 November 2024 keep a 50,000 MAU free tier.
SMS goes through Amazon SNS and email through Amazon SES, both billed separately. Add-ons include multi-Region replication at $0.0045 per MAU on Essentials ($0.006 on Plus), machine-to-machine tokens at $0.00225 per successful token request for the first 250,000 a month, and higher API rate quotas at $20 per extra request per second per month.
Cognito's strengths are unit price at scale and Region choice. Its gaps are developer experience and B2B tooling: the pricing page and FAQ list no directory sync (SCIM) feature, so you build provisioning yourself. The default quota is 300 identity providers per user pool, adjustable on request.
Auth0: generous free tier, steep paid bands
Auth0, owned by Okta, splits pricing into B2C and B2B tracks and shows prices through a MAU slider that tops out at 30,000+. Above about $4,167 a month the calculator shows a contact prompt instead of a number. We read every band on 12 November 2026, monthly billing:
| Auth0 plan (monthly billing) | 500 MAU | 1,000 | 5,000 | 10,000 | 20,000 | 30,000+ |
|---|---|---|---|---|---|---|
| Free | $0 | $0 | $0 | $0 | $0 | Not available above 25,000 |
| B2C Essentials | $35 | $70 | $350 | $700 | $1,400 | $2,100 at 30,000 |
| B2C Professional | $240 | $240 | $1,000 | $1,600 | $3,200 | Contact sales |
| B2B Essentials | $150 | $300 | $1,300 | $2,100 | $3,800 | Contact sales |
| B2B Professional | $800 | $800 | $1,500 | $2,400 | Contact sales | Contact sales |
All bands come from Auth0's pricing page and its calculator data. Yearly billing is priced at 11 months, which Auth0 labels one month free; B2C Essentials at 30,000 MAU is $23,100 a year against $2,100 a month. The page marks B2B Professional as available on yearly plans only. Above these bands, Auth0 sends you to its Enterprise plan, which adds custom user and SSO tiers, a 99.99% SLA, a Private Deployment add-on and, as an add-on, a HIPAA BAA.
The Free plan also includes one custom domain (card verification required), passwordless login, passkeys, unlimited social connections, five organisations and basic attack protection. B2B Essentials includes unlimited organisations and three enterprise SSO connections; B2B Professional includes five. Extra Enterprise SSO Connections are an add-on that starts at $100 a month per active connection ($1,100 a year).
Auth0's strength is breadth: mature B2B organisation features, extensibility and enterprise support. Its weakness is transparency: beyond 20,000 to 30,000 MAU you cannot budget from the public page.
Head-to-head comparison
Sources: the three pricing pages plus the Auth0 and AWS endpoint lists.
| Item | Auth0 | Clerk | Amazon Cognito |
|---|---|---|---|
| Free tier | 25,000 MAU (Free) | 50,000 MRU per app (Hobby) | 10,000 MAU (Lite, Essentials) |
| Billing unit | Monthly active user | Monthly retained user | Monthly active user |
| Entry paid plan | $35/month (500 MAU) | $20/month annual, $25 monthly | Pay per MAU, no minimum |
| Published price at 100,000 users | Not published | $1,020/month | $495 (Lite), $1,350 (Essentials) |
| Enterprise SSO | 1 on Free; 3 on B2B Essentials; add-on from $100/month each | 1 on Pro; then $75 to $48 each | Federated users $0.015/MAU after 50; no connection fee |
| SCIM or directory sync | Free and B2B plans | 1 included; $75 each from 1 January 2027 | Not listed |
| Annual discount | 1 month free | $20 vs $25 (Pro) | None listed |
| UK data region | UK public cloud region listed | Not listed | Europe (London) |
| US government regions | Not listed | Not listed | GovCloud (US), no free tier |
Worked cost at 10,000, 100,000 and 1 million users
Assumptions: a B2C or self-serve SaaS app, all users signing in directly or through social login, monthly billing for Auth0 and Cognito, annual billing for Clerk Pro, and MRU equal to MAU, which is conservative for Clerk. SMS, email and support plans are excluded. Rates as checked on 12 November 2026.
| Monthly cost (USD) | 10,000 users | 100,000 users | 1,000,000 users |
|---|---|---|---|
| Clerk Hobby | $0 | Not available above 50,000 | Not available |
| Clerk Pro | $20 | $1,020 | $17,220 |
| Cognito Lite | $0 | $495 | $4,635 |
| Cognito Essentials | $0 | $1,350 | $14,850 |
| Cognito Plus | $200 | $2,000 | $20,000 |
| Auth0 Free | $0 | Above 25,000 cap | Above cap |
| Auth0 B2C Essentials | $700 | Not published | Not published |
| Auth0 B2C Professional | $1,600 | Not published | Not published |
The arithmetic:
- Clerk Pro at 100,000: $20 + (100,000 - 50,000) × $0.02 = $1,020. At 1 million: $20 + 50,000 × $0.02 + 900,000 × $0.018 = $20 + $1,000 + $16,200 = $17,220. We applied Clerk's bands as graduated tiers, which is how its table reads; confirm on your quote.
- Cognito Essentials: (100,000 - 10,000) × $0.015 = $1,350; (1,000,000 - 10,000) × $0.015 = $14,850.
- Cognito Lite: 90,000 × $0.0055 = $495 at 100,000; add 900,000 × $0.0046 = $4,140 for $4,635 at 1 million.
- Cognito Plus: 10,000 × $0.020 = $200; 100,000 × $0.020 = $2,000; 1,000,000 × $0.020 = $20,000.
- Auth0: read from the calculator; above 30,000 MAU the page shows no number.
At 10,000 users every vendor has a $0 option, so choose on features: Clerk Hobby leaves out MFA and passkeys, Cognito Lite leaves out passkeys, and Auth0 Free includes passkeys but not its Pro MFA factors. At 100,000, Clerk Pro and Cognito Essentials are within $330 a month of each other, and Cognito Lite is cheapest if you can live without passkeys and the visual login editor. At 1 million, Cognito Lite costs about 27% of Clerk Pro, and Cognito Essentials undercuts Clerk by $2,370 a month.
B2B scenario: 20 enterprise customers on SSO
A B2B SaaS product with 10,000 MAU, of whom 4,000 sign in through their employer's SAML identity provider, across 20 enterprise customers. Eight of those customers want SCIM provisioning.
- Clerk Pro, from 1 January 2027: base $20; 10,000 MRU included; SSO connections 2 to 15 at $75 (14 × $75 = $1,050) plus 16 to 20 at $60 (5 × $60 = $300); Directory Sync connections 2 to 8 at $75 (7 × $75 = $525); Enhanced B2B add-on to link connections to organisations, $85 billed annually. Total $1,980 a month, or $1,455 before Directory Sync billing starts.
- Cognito Essentials: 6,000 direct users fall inside the 10,000 free MAU; federated users cost (4,000 - 50) × $0.015 = $59.25. Total about $59 a month, plus the engineering to build SCIM provisioning, per-customer identity provider onboarding and admin screens.
- Auth0 B2B Essentials: $2,100 a month at 10,000 MAU with three enterprise connections and SCIM included; the other 17 connections at the published starting price of $100 each add $1,700. Total from $3,800 a month, since the add-on price is a floor.
The licence gap is large, but so is the build gap: teams choosing Cognito for B2B should put SSO onboarding and SCIM work into the estimate.
Which one to choose
| Choose | If this describes you |
|---|---|
| Clerk | You build in React or Next.js, want prebuilt sign-in screens this sprint, and value published B2B connection prices |
| Amazon Cognito Essentials or Lite | You run on AWS, expect 100,000 to millions of users, and can build your own screens and provisioning |
| Amazon Cognito Plus | You need adaptive authentication, compromised-credential detection or a 99.99% SLA |
| Auth0 Free | You have under 25,000 MAU and one enterprise customer that needs SSO and SCIM |
| Auth0 B2B or Enterprise | You sell to large enterprises, need mature organisation features, and will negotiate a contract |
| Stay where you are | Savings of a few hundred dollars a month rarely pay for re-onboarding every SSO customer |
US and UK considerations
UK data protection. Clerk is based in San Francisco, and its privacy policy says data may be processed in the United States and elsewhere. Auth0 belongs to Okta, Inc. Since 12 October 2023, the UK-US data bridge has let UK organisations send personal data to US companies that participate in the UK Extension to the EU-US Data Privacy Framework without specific authorisation. The instrument is the Data Protection (Adequacy) (United States of America) Regulations 2023. Check each vendor's framework listing and data processing addendum, and follow the ICO's international transfer guidance where a vendor is not certified. Auth0 lists a UK region among its public cloud endpoints, and Cognito user pools run in Europe (London). This is general information, not legal advice.
US public sector and regulated sectors. Cognito user pools run in AWS GovCloud (US-East and US-West), with FIPS endpoints there and in the four US commercial Regions, but the free tier does not apply in GovCloud. Multi-Region replication reached GovCloud on 21 October 2026. Clerk lists a HIPAA BAA only on Enterprise, and Auth0 offers one as an Enterprise add-on; sign it before storing health data in user metadata.
Currency and tax. All three list prices in US dollars. UK buyers should check how VAT is shown on each invoice.
Migration and implementation checklist
- Count users the way each vendor bills (Clerk MRU, Cognito and Auth0 MAU) from 90 days of sign-in logs.
- Count enterprise connections and SCIM directories separately; Clerk bills them separately from 1 January 2027.
- Budget SMS: $0.01 per message in the US and Canada on Clerk; Amazon SNS rates on Cognito.
- Plan password migration with a test import. All three import existing password hashes: Cognito added bcrypt, scrypt, Argon2id and PBKDF2-SHA256 on 15 July 2026, and Auth0 and Clerk document hash imports. Users with unsupported hashes need a reset.
- Expect every enterprise customer to re-test SSO after cut-over.
- On Next.js, keep authorisation checks in server code, not only middleware. Our Next.js middleware advisories matrix explains why.
- For mobile apps, follow the token storage guidance in our mobile application security guide.
- If the backend is Firebase or Supabase, check whether their built-in auth already covers you; see our Firebase vs Supabase comparison.
Hosting is the other big line in the same stack; our Vercel vs Netlify vs Cloudflare pricing comparison works through it.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development services team designs sign-in, SSO and SCIM flows for SaaS and mobile products and models identity costs from your real user counts before you commit. Talk to us at /contact-us/.
Last updated: 12 November 2026.
