Is Auth0 free? What it actually costs in 2026

What the free tier actually includes

• —25,000 monthly active users
• —5 organizations
• —1 enterprise connection
• —1 custom domain (credit card verification required)
• —Basic attack protection only
• —Community support — no SLA
• —No separate production and development environments

Where the wall is

Not the user count — the feature you suddenly need. Free is generous at 25,000 users, but the moment you want role-based access control per organization, audit-log streaming, pro MFA or a development environment separate from production, you move to Essentials, which covers 500 monthly active users. Teams read that as a price rise; it is a re-pricing of the same product at 2% of the scale.

After that: Essentials at $35 a month for up to 500 monthly active users; Professional at $240 a month for 500, adding your own user database, enterprise MFA and enhanced attack protection. Enterprise is quoted and adds a 99.99% SLA and private deployment.

Can you self-host Auth0? Paid plans only

Private deployment is an Enterprise add-on, so self-hosting Auth0 is a contract rather than a download. Keycloak, Authentik, Ory and Zitadel are the self-hosted routes, and all four speak the same OAuth2, OIDC and SAML that make leaving possible.

What it actually takes to run one yourself

Real RAM against the documented minimum, monthly cost, setup time, and the one thing that catches people out.

When paying is still the right call

If your team doesn't want to run or patch an identity server, or you need Auth0/Okta's compliance certifications (SOC 2, HIPAA BAAs, ISO 27001) and enterprise support SLAs out of the box, the managed service is genuinely the right call — self-hosting authentication is one of the few places where an operational mistake (a misconfigured SSO connection, an unpatched CVE) has outsized security consequences, and Auth0's team absorbs that risk for you.

What you are locked into

User accounts, sessions, and social/enterprise connection configs live in Auth0's cloud tenant. Auth0 supports standard protocols (OAuth2, OIDC, SAML) and offers user-data export, but migrating a live user base to a different auth system still requires a password-reset flow for most users (since password hashes are not portable) and reconfiguring every connected SSO/social provider — a real, if manageable, migration cost.

If you would rather not pay: Keycloak