Authentication: Build It or Buy It?
Login looks like a week of work and a form with two fields. The week is real; the form is not the part that costs you. Here is what the hosted providers charge, what the libraries give away, and which decision you are actually making.
Quick answer
The decision is not really build versus buy, because nobody sensible writes password hashing from scratch any more. It is library versus service. A library such as Better Auth puts the auth in your codebase and your database, costs nothing, and leaves you owning sessions, resets and the emails that carry them. A service owns all of that for a per-user fee, and the fees differ by more than an order of magnitude: Supabase includes 100,000 monthly active users on its $25 Pro plan and charges $0.00325 per user beyond it, Clerk is free to 50,000 monthly retained users then $0.02 each, Auth0 is free to 25,000 monthly active users with paid plans from $35 a month, and WorkOS AuthKit is free to one million. Choose on the enterprise features you will be asked for, not on the first bill.
Every estimate for a login screen is wrong in the same direction. The form takes an afternoon. Then comes the password reset, and the email that carries it, and the session that has to expire, and the second factor, and the invitation flow, and the day somebody asks whether a user can belong to two organisations.
None of that is hard exactly. All of it is fiddly, security-adjacent, and completely invisible to the people paying for the product. Which is why the question keeps getting asked, and why the framing is usually wrong.
The question is library or service, not build or buy
Nobody credible is proposing you write password hashing. That argument was settled a decade ago and the phrase build your own has moved on without updating its reputation.
Building today means adding something like Better Auth: a framework-agnostic TypeScript library that keeps the auth in your codebase and the users in your database, with two-factor, passkeys, multi-tenancy and single sign-on available through its plugins. You are not implementing the primitives. You are wiring up a maintained implementation of them and taking responsibility for the flows around it.
Buying means a service that owns the user records, hosts the screens, and hands your application a session. What you are really buying is not the login form — it is never the login form — but the ten years of edge cases behind it, and a support contract when one of them bites.
What the services actually charge
Published rates at the time of writing. Read the metering column carefully, because it is where the comparison usually goes wrong.
| Provider | Free tier | Then | Meters |
|---|---|---|---|
| Supabase Auth | 50,000 MAU | $25/month with 100,000 included, $0.00325 per MAU after | Monthly active users |
| Clerk | 50,000 MRU | Pro $25/month ($20 annually), $0.02 per user over | Monthly retained users |
| Auth0 | 25,000 MAU | Essentials from $35/month, B2B from $150 | Monthly active users |
| WorkOS | 1,000,000 MAU | $2,500/month per additional million | Monthly active users |
The spread is not a rounding difference. At a hundred thousand active users, Supabase's overage arithmetic lands in the low hundreds of dollars a year while Clerk's per-user rate puts you an order of magnitude higher — and both are defensible, because they are selling different things to different buyers.
Clerk's metering deserves a note of its own. It bills monthly retained users rather than monthly active users, a narrower unit that excludes people who sign up and never come back. That works in your favour on a consumer product with a leaky funnel, and it means a headline per-user price from one vendor cannot be compared with another's without modelling your own traffic.
Where the real cost sits if you build
Not in the login form. In four places that never appear in the estimate:
- Email deliverability. A password reset that lands in spam is an outage with a support ticket attached. Reset and verification messages are the highest-stakes email your application sends, and getting them delivered is its own piece of work — we went through it in detail in our guide to sending email from your app.
- Session handling. Expiry, refresh, revocation on password change, and logging someone out of every device. Each one is a small decision with a security consequence.
- Account recovery. The path for someone who has lost the phone with their second factor on it. This flow is where most real-world account takeovers actually happen, because it is the one everybody rushes.
- Enterprise features later. SAML, SCIM, audit logs. Cheap to add if you chose a library that has them; a quarter of work if you did not.
Add those up honestly and the free library is not free. It is perhaps two to four weeks of engineering spread over a year, plus a permanent seat in your on-call rotation.
The request that settles it
One day a customer's procurement team sends a list, and on it are SAML single sign-on and SCIM provisioning. They are not negotiable, they have a deadline, and they are attached to the largest contract you have been offered.
This is what the hosted providers are really selling. It is why WorkOS gives away authentication for a million users and charges $125 per enterprise connection for the first fifteen — the consumer part is the free sample, the SSO connection is the product. It is why Auth0 quotes B2B plans at four times its consumer rate, and why Clerk sells B2B features as a $100 add-on with extra SAML connections at $75 each.
If a signed enterprise contract is plausible inside a year, price that outcome now. Retrofitting SAML under a deadline is the most expensive version of this decision, and it is the one most teams end up choosing by accident.
Choosing, in three questions
- Do you already run a database platform that includes auth? If you are on Supabase, its auth is included on the plan you are paying for and the argument is largely over. Use it.
- Will you be asked for SAML or SCIM within a year? If yes, buy — and price WorkOS against Auth0 on connections rather than on users. If no, a library keeps your users in your own database with no per-user fee at all.
- Is your funnel leaky? Large numbers of signups who never return are cheap under retained-user metering and expensive under active-user metering. That difference alone can move the annual bill by a factor of ten.
Whichever way it goes, ask one question before signing: will you export password hashes if we leave? A provider who will not is quietly making every future migration a forced password reset for your entire user base.
What we would do
For a product that has not found its shape yet, use the library and keep the users in your own database, because that decision stays reversible. For anything selling to businesses with a procurement process, buy from the start and treat the bill as the price of not writing SAML.
Then instrument the thing. Failed logins, reset requests and sudden spikes in either are the earliest signal you get that something is wrong, and they belong wherever the rest of your alerts already live — our notes on error tracking for small teams cover setting that up without drowning in noise.
Pros and cons
Pros
- A hosted provider removes an entire class of security work from your roadmap
- SAML and SCIM arrive as configuration rather than a quarter of engineering
- Modern libraries ship passkeys, two-factor and organisations without a subscription
- Keeping users in your own database means joins, exports and no migration later
Cons
- Per-user pricing punishes exactly the growth you were hoping for
- Metering differs between vendors, so quoted prices are not directly comparable
- Moving off a provider means migrating password hashes, which not all of them export
- A library leaves you owning session handling, resets and deliverability
Alternatives worth considering
Free to 50,000 monthly retained users. Pro $25 a month, $20 annually; overage $0.02 per user, falling to $0.018 above 100,000.
Free plan includes 50,000 monthly active users; Pro is $25 a month with 100,000 included and $0.00325 per user after.
Free to 25,000 monthly active users. Essentials from $35 a month for consumer apps, $150 for B2B, both quoted at 500 users.
AuthKit is free to one million monthly active users. The money is in enterprise connections: $125 each for the first fifteen.
Frequently asked questions
Is writing my own authentication irresponsible?
Writing the cryptography yourself would be. Assembling authentication from a maintained library is not, and it is what most teams shipping today actually do. The distinction matters because the phrase build your own has quietly changed meaning. It used to imply choosing a hashing algorithm and getting it wrong. Now it means installing something like Better Auth, which handles password storage, sessions, two-factor and passkeys, and keeps the user table in your own database. What you still own is the boring, error-prone part: reset flows, session expiry, and email that arrives.
Why do the quoted prices differ so wildly?
Partly because the products differ, and partly because the unit does. Clerk bills monthly retained users, a deliberately narrower measure than the monthly active users that Auth0, Supabase and most others meter, so a signup who never returns may not count. Beyond that, the products are aimed at different buyers: Supabase prices auth as one feature of a database platform you are already paying for, WorkOS gives away consumer-scale authentication and charges for the enterprise connections, and Auth0 prices for organisations with a compliance department. Compare by modelling your own numbers against each pricing page, not by reading a per-user figure out of a table.
When does the decision get made for me?
The first time a customer's procurement team asks for SAML single sign-on and SCIM user provisioning. That request is not really a feature request; it is a requirement with a contract behind it, and it arrives with a deadline. Building SAML properly is weeks of work against a specification most people only meet once. This is what the providers are actually selling, and it is why WorkOS structures its pricing the way it does — free to a million users, then $125 per enterprise connection. If that request is plausible within a year, weigh it now rather than in the quarter it lands.
How hard is it to move off a provider later?
Harder than moving most other dependencies, because the data is deliberately sensitive. You need the user records, and you need the password hashes in a form another system can verify — if a provider will not export hashes, every one of your users has to reset their password during the migration, which is a support event and a churn event at once. Ask about hash export before you sign up, not when you leave. Social and passkey logins move more cleanly, since the credential lives with the identity provider rather than with you.
Sources
Everything factual in this article traces back to one of these. Vendors change pricing and limits without changing the URL, so each entry records the date we last read it.
- Clerk pricing
Clerkchecked September 7, 2026
- Supabase pricing
Supabasechecked September 7, 2026
- Auth0 pricing
Oktachecked September 7, 2026
- WorkOS pricing
WorkOSchecked September 7, 2026
- Better Auth documentation
Better Authchecked September 7, 2026
Written by
ToolNest Editorial
Editorial team
ToolNest's editorial byline. Our articles summarise and compare software using vendor documentation, changelogs, pricing pages and published reporting, and are drafted with AI assistance under human review. Where we have not used a tool ourselves, we say so rather than implying otherwise.