CIAM costs in 2026: what a passkey-ready customer login runs from 10,000 to 950,000 users

Summary. The FIDO Alliance estimates 5 billion passkeys are now in use worldwide, and its State of Passkeys 2026 report, published on World Passkey Day on 6 May 2026, found that 90% of people are aware of passkeys, 75% have enabled one on at least one account and 49% use them regularly when available. The performance case is stronger than the awareness case: across nine large deployments including Amazon, Google, Microsoft, PayPal and TikTok, the FIDO Passkey Index recorded a 93% sign-in success rate for passkeys against 63% for other methods, an average sign-in time of 8.5 seconds against 31.2 seconds, and an 81% reduction in login-related help desk incidents. The cost side is where product teams get surprised. Amazon Cognito bills 10,000 monthly active users free on its Essentials tier and $0.015 per MAU after that, which is $14,100 a month at 950,000 users, rising to $19,000 on the Plus tier where there is no free tier at all. Auth0's free plan has covered 7,500 MAU since 1 November 2023, with B2C Essentials starting at $35 a month for 500 MAU. This article works through what a passkey-ready login actually costs at three scales, what the free tiers hide, when self-hosting is the cheaper answer, and what the Digital Personal Data Protection Act 2023 adds for Indian product teams.

Why this became a real decision in 2026

Login used to be a two-week task. It is now a platform choice with a five-figure annual bill attached, and the reason is that the requirements grew.

The FIDO Alliance's State of Passkeys 2026 research, conducted by Sapio Research in April 2026 across 11,000 consumers and 1,400 workforce decision-makers in ten countries including India, puts the consumer side beyond argument. Awareness is at 90%. Three quarters of people have a passkey somewhere. Just under half use them whenever a service offers them.

The commercial cost of the old way is measurable in the same dataset. One in three people, 33%, had an account compromise or a breach notification in the past year. And 47% of consumers say they are likely to abandon a purchase or a sign-in when they cannot remember a password, with 17% saying they are highly likely to. That second number is a revenue line, not a security line.

Andrew Shikiar, Executive Director and CEO of the FIDO Alliance, framed the shift in the accompanying release: "Passkeys are moving into the mainstream because they deliver something the industry has struggled to achieve for decades: authentication that is both more secure and easier to use."

The enterprise picture is less finished. 68% of organisations have deployed or are actively deploying passkeys for employee sign-ins, but 57% still rely on phishable methods for day-to-day primary sign-in. Among those not yet passwordless, 16% believe passwords plus multi-factor authentication are sufficient and 24% are waiting for standards to mature further. The gap between consumer expectation and enterprise delivery is where most of the work sits.

What the deployment data actually shows

Adoption surveys tell you what people say. The FIDO Passkey Index, launched on 14 October 2025 with Liminal, tells you what happened inside nine companies that had run passkeys for one to three years: Amazon, Google, LY Corporation, Mercari, Microsoft, NTT DOCOMO, PayPal, Target and TikTok.

Two rows in that table are the ones to plan against. Eligibility at 93% with enrolment at 36% and passkey sign-ins at 26% means the technical rollout is the easy part and the enrolment prompt is the hard part. If you ship passkey support and do nothing else, roughly a third of eligible accounts will take it up over one to three years.

The Liminal study alongside it, covering 200 organisations, suggests that prompting works: 89% said more than half of their users are expected to opt in after being prompted, and 49% of current implementers report adoption above 75%. The design of the enrolment moment matters more than the WebAuthn code.

What CIAM actually costs

Every major platform bills on monthly active users, which sounds simple and is not. A MAU is triggered by more than a login. On Amazon Cognito, a user counts as active if your application generates any identity operation for them in the calendar month, including administrative creation or update, sign-up, sign-in, sign-out, token refresh, password change, an attribute update, or an attribute query through the AdminGetUser API. A background job that refreshes tokens for dormant users will bill you for dormant users.

The table below uses published rates for direct and social sign-in, in US dollars, as of the pricing pages current in 2026.

The Cognito figures are worked examples published by AWS, so they are exact rather than modelled. The three that matter most:

Cognito Essentials is the default tier for new user pools, and it is the tier that includes passkey sign-in with biometrics and hardware keys, passwordless one-time codes, email one-time-code MFA, refresh token rotation and password reuse prevention. Lite does not include passkeys. So the honest comparison for a passkey-ready login is Essentials at $0.015 per MAU, not Lite at $0.0055.

Plus costs a third more than Essentials and removes the free tier entirely, but it is the tier with risk-based adaptive authentication, compromised credentials detection and exportable threat profiles. AWS notes that customers currently using the older advanced security features can save up to 60% by moving to Plus, and the Lite-plus-ASF example at $25,655 against Plus at $19,000 shows why.

The advanced security add-on on the old model is more expensive than the entire base service. In AWS's own example, a 100,000-MAU pool pays $495 for base active users and $4,250 for advanced security features, a total of $4,745. Security features, not scale, are what move a CIAM bill.

Two costs sit outside every table above. SMS for multi-factor authentication, user registration, password recovery and phone verification is billed separately, through Amazon SNS in Cognito's case, at carrier rates that vary by country. Email verification is billed separately as well. For an Indian consumer app sending OTPs at scale, that separate SMS line is frequently larger than the identity platform bill itself, which is the strongest financial argument for passkeys that nobody puts in a pricing table.

When building your own is the right answer

The instinct to write your own authentication is usually wrong, and there is a narrow band where it is right.

Buy when your login is a commodity. Social sign-in, email and password with a passkey upgrade path, standard MFA, a hosted login page you restyle. The vendors have solved this, the per-MAU rate at low volume is trivial, and every hour you spend on it is an hour not spent on the product.

Consider self-hosting, typically on an open-source identity server, when three things are simultaneously true: your MAU count is large enough that the per-MAU rate exceeds the fully loaded cost of running the service, your data residency requirements make a vendor's regional footprint awkward, and you have engineers who will still be here in three years to patch it. At $0.015 per MAU, one million monthly active users is roughly $180,000 a year, which buys a meaningful amount of engineering time. At 50,000 monthly active users it is $7,200 a year, which buys almost none.

The trap is the middle. Teams self-host to save a bill they have not yet incurred, then discover that the real cost of an identity service is not the software. It is session management, token rotation, account recovery, breach response, WebAuthn attestation handling, device migration when a user changes phones, and the on-call rotation that covers all of it at 02:00. The bill is visible. The operational load is not.

The same reasoning appears in our note on DPDP compliance cost for Indian startups ahead of the 2027 deadline: the cheap-looking option is usually the one whose costs arrive later and in a different budget line.

A passkey rollout that actually gets adopted

Shipping WebAuthn is a sprint. Getting to the Passkey Index numbers is a programme. The sequence below reflects what the deployment data implies rather than what a vendor quickstart suggests.

Start by making every account eligible rather than making passkeys mandatory. The Index companies reached 93% eligibility and 36% enrolment, which means eligibility was never the constraint. Ship passkeys as an available factor alongside your existing methods first.

Then design the enrolment prompt as a product surface, not a settings toggle. The Liminal data showing 89% of organisations expecting more than half of prompted users to opt in only applies to users who were actually prompted. Prompt after a successful sign-in, when the user has already proved who they are and has no task in flight.

Keep a recovery path that does not reintroduce the weakness. A passkey deployment with SMS-based account recovery is still phishable through the recovery route, which is the single most common way a passkey rollout fails its own threat model. Our comparison of passkeys against SMS OTP for Indian WebAuthn migrations covers the recovery design in detail.

Instrument three numbers from day one: enrolment rate among eligible accounts, share of sign-ins completed with a passkey, and sign-in success rate by method. Without the third number you cannot tell whether your passkey path is genuinely better than your password path in your own product, and the Index averages are not a substitute for your own data.

Plan for device migration before your first support ticket. A user replacing a phone is the most common real-world passkey event after enrolment, and the experience differs across platform providers and password managers.

India-specific considerations

India was one of the ten countries in the FIDO consumer survey, which makes the adoption numbers directly relevant rather than an import from another market. Three things shape the decision here.

The Digital Personal Data Protection Act 2023 changes what an identity store is. Authentication data is personal data, and a CIAM platform is a processor. That makes the vendor's regional hosting, sub-processor list and deletion behaviour part of the technical evaluation rather than a legal afterthought. Our DPDP engineering playbook for Indian startups sets out how to structure that evaluation before you sign.

The SMS OTP bill is the hidden variable. Every platform above charges separately for SMS, and Indian consumer apps at scale send a lot of it. A passkey rollout that moves even a third of sign-ins away from OTP has a measurable effect on that line, and it is the effect that gets a CFO's attention faster than a phishing-resistance argument does.

Device diversity is a real engineering constraint, not a footnote. A consumer base spread across recent flagship Android devices, older budget Android devices and iOS needs a passkey path that degrades gracefully rather than one that assumes synced passkeys and platform authenticators everywhere. Test on the devices your users actually hold, not the ones on your team's desks.

What a sensible engagement looks like

If you are building this rather than buying a finished product, the work divides into four blocks, and they are worth scoping separately.

An evaluation block: current sign-in inventory, MAU projection against each platform's rate card, data residency and DPDP position, and a build-versus-buy recommendation with the arithmetic shown. This is usually the shortest block and the one that changes the most decisions.

An implementation block: the identity platform configuration, WebAuthn integration in web and mobile clients, session and token strategy, account recovery design, and migration of existing user records without forcing a mass password reset.

An adoption block: the enrolment prompt, its placement, the copy, and the measurement. This is the block most teams skip and the one the Passkey Index data says determines whether you get 36% enrolment or better.

An operations block: monitoring by sign-in method, alerting on success-rate regressions, device-migration support runbooks, and a review cadence against the per-MAU bill.

eCorpIT works across all four, most often with product teams who have already shipped a login and now need it to be passkey-ready, cheaper per user, and defensible under DPDP. We design applications aligned with DPDP Act 2023 requirements, and we build on AWS, Microsoft and Google platforms as a partner of all three. Related capability sits in our custom web application development and DPDP-ready app development work.

FAQ

How eCorpIT can help

eCorpIT is a Gurugram-based technology consultancy founded in 2021, with CMMI Level 5, MSME and ISO 27001:2022 certification, and partnerships with AWS, Microsoft and Google. Our senior-led engineering teams take customer identity work end to end: the build-versus-buy arithmetic against your own MAU projection, the WebAuthn implementation across web and mobile, the enrolment programme that decides whether adoption lands, and applications designed aligned with DPDP Act 2023 requirements. If you want the numbers run against your own user base before committing to a platform, talk to us.

References

1. FIDO Alliance reports accelerating global passkey adoption on World Passkey Day 2026, Business Wire, 6 May 2026.

1. FIDO Alliance launches Passkey Index, revealing significant passkey uptake and business benefits, FIDO Alliance, 14 October 2025.

1. The state of passkeys 2026: global consumer and workforce report, FIDO Alliance.

1. Amazon Cognito pricing, Amazon Web Services.

1. User pool feature plans, Amazon Cognito developer guide.

1. Announcing new feature tiers: Essentials and Plus for Amazon Cognito, AWS What's New.

1. Monitoring and managing costs, Amazon Cognito developer guide.

1. Pricing structure and billing model for Microsoft Entra External ID, Microsoft Learn, updated 24 February 2026.

1. Pricing changes for Auth0 by Okta, Abbie Carlson, Auth0, effective 1 November 2023.

1. Auth0 pricing, Okta.

1. Amazon SNS SMS pricing, Amazon Web Services.

1. Passkey Index 2025, FIDO Alliance.

1. Microsoft Entra External ID pricing, Microsoft Security.

1. FIDO Alliance to develop standards for trusted AI agent interactions, Business Wire, 27 April 2026.

Last updated: 3 August 2026.