Authentication has two prices and most comparisons only show one. There is the invoice a vendor sends you, which is easy to look up, and there is the maintenance you take on when nobody sends you an invoice, which nobody prices because it does not arrive as a number.
Here is the short version, with both sides.
Managed authentication is free or nearly free for a long time. Clerk, the most common comparison for a Next.js project, is free to 50,000 monthly retained users and 25 dollars a month on Pro, checked on their pricing page on 10 August 2026. Self-hosting has no invoice at all, and costs you somewhere between two and six hours a quarter in maintenance plus the obligation to apply security updates the week they land.
The decision is not which number is smaller. It is this: your vendor bill follows the shape of your product, and your maintenance bill follows your appetite for owning things. The rest of this is both ledgers, itemised.
What the invoice actually says
Fairness first, because the popular version of this is out of date. All figures below are from Clerk's own pricing page and pricing explainer, read on 10 August 2026. Prices change, so check them yourself before making a decision on them.
- Hobby: free, up to 50,000 monthly retained users and three dashboard seats.
- Pro: 25 dollars a month (20 billed annually), which includes one enterprise SSO connection, unlimited social logins and MFA.
- Business: 300 dollars a month (250 billed annually).
- Overage above the included users, in bands: 2 cents per user from 50,001 to 100,000, then 1.8 cents to a million, then 1.5 cents, then 1.2 cents.
The billing unit deserves credit rather than suspicion. A monthly retained user, as they define it, is someone who comes back at least one day after signing up. A person who signs up and never returns is never counted and never billed, which means your top-of-funnel churn is free. That is a friendlier definition than the monthly active user metric most vendors bill on, and anyone telling you that hosted auth is a scalping operation has not read it.
So where does the money actually go? Not per user. Into what your product is.
- Organization-scoped authentication, the thing every B2B product needs on day one, is a 100 dollar a month add-on.
- Administration, which covers unlimited impersonation, is another 100 dollars a month.
- Enterprise SSO connections beyond the first are 75 dollars a month each.
- Billing is 0.7 percent of billing volume, and satellite domains are 10 dollars a month each.
Put that together and the counterintuitive result falls out on its own. A consumer app with 40,000 returning users pays 25 dollars a month. A B2B SaaS with 200 users across 30 companies, needing organizations and a second SSO connection, pays 200 dollars a month before a single one of those users is billed. The invoice tracks your product's shape, not its size.
The bill with no invoice
This is the half those comparison pages cannot write, because pricing aggregators have no product to maintain. Here is what self-hosting authentication actually asks of you, taken from the code of a kit that runs it in production.
Password storage. Hashing with bcrypt at cost 12, roughly 100ms per verification, comfortably above the minimum work factor of 10 that the OWASP password storage guidance recommends. Plus the detail everyone meets eventually: bcrypt only reads the first 72 bytes, so longer input must be rejected rather than quietly truncated. Cost: an afternoon once, then nothing.
Not leaking which emails exist. Every sign-in failure has to return the same answer. Unknown address, OAuth-only account, wrong password: one identical response, so the form cannot be used to enumerate your users. Cost: an hour, and the discipline to keep it that way.
Rate limiting. A fixed-window limiter, five attempts per fifteen minutes. On serverless each instance has its own memory, so an in-process limiter is a speed bump rather than a wall, and bcrypt's cost is the real brake. A shared store is the upgrade when you need a guarantee. Cost: an afternoon, or a Redis bill later.
Email deliverability. Magic links, verification and password resets are transactional email. If they land in spam your login is broken for that user, and you now own a sending domain's reputation. Cost: ongoing attention, and this is the one people underestimate.
Session revocation. With JWT sessions there is no row to delete, so revoking one takes a version number on the user and a check in the token callback, throttled to once a minute because the check runs on nearly every request. Cost: half a day, plus a design decision you have to make on purpose.
Security updates, and this is the honest one. On 3 August 2026 a critical advisory landed in @auth/core: a malformed Authorization: Bearer header made getToken() throw an uncaught exception. We patched it the same day. That is the deal in one sentence: when you self-host, an advisory in your auth library is your pager rather than somebody else's. It is cheap if you have dependency updates and a test suite, and genuinely expensive if you do not.
Add it up honestly and it is a few hours a quarter for a system already built, plus a standing obligation to be reachable when something needs patching. The important property is not that it is small. It is that it stays roughly flat while your user count does not.
The break-even is not a number of users
Every calculator on this subject asks how many users you have. That is the wrong input, and it is why they all produce a curve that says self-hosting wins eventually. What actually decides is what you are building.
| Your product | The invoice | The maintenance | Which wins |
|---|---|---|---|
| Consumer app, no companies involved | free below 50,000 retained users, then cents each | flat, a few hours a quarter | the free tier, comfortably. Decide on ownership, not price |
| Small B2B SaaS with teams | organizations add-on from day one, plus the plan | flat, plus the work of building teams yourself | closer than it looks, and it arrives early rather than at scale |
| Selling to enterprise | SSO priced per connection, plus the plan | SAML and SCIM are a real project, not a weekend | buying, almost always |
| Internal tool, few users, strict data rules | cheap on paper | flat, and the data never leaves | self-hosting, for reasons that were never about money |
The pattern: the vendor bill steps up when your product changes category, and the maintenance bill does not. If you never change category, you may never pay either of them much.
Three products, both columns
The arithmetic, so you can check it rather than trust it. Vendor figures are the ones above, read on 10 August 2026.
A consumer app with 40,000 returning users. Invoice: 25 dollars a month on Pro, or nothing at all on the free tier if you do not need the production features. Self-hosted: nothing, on a database you were already paying for, plus your maintenance hours. At this size the money is a rounding error either way, and anyone choosing on price is answering the wrong question.
A B2B SaaS with 200 users across 30 companies. Invoice: 25 for the plan, 100 for organization-scoped authentication, 75 for a second enterprise connection, so 200 dollars a month, 2,400 a year, with 200 users who are all inside the free allowance. Self-hosted: nothing on the invoice, and you build organizations, roles and invitations yourself, which is weeks rather than hours. This is the row where the honest answer is least comfortable for us, and we say so below.
A consumer app that worked, at 250,000 retained users. 50,000 are included, the next 50,000 cost 2 cents each, the following 150,000 cost 1.8 cents each. That is 1,000 plus 2,700, so 3,725 dollars a month with the plan, about 44,700 a year. Self-hosted: the same few hours a quarter it cost at 40,000 users, on a slightly larger database. This is the crossover everybody imagines when they picture expensive auth, and it is real, but notice how far along it sits.
Two things fall out of those three rows. The bill people fear arrives at a scale most products never reach, and the bill that actually bites arrives early, is small in absolute terms, and is triggered by selling to companies rather than by growth.
Where paying is simply the right answer
A comparison written by someone with a horse in the race is worth reading only if it admits where it loses. Here is where.
SAML and SCIM. Enterprise single sign-on and directory provisioning are months of work, they are the part vendors charge the most for, and they are the most common reason a team keeps its own auth for everything else and buys federation separately. If a large customer is asking for it this quarter, buy it.
Compliance you do not want to own. Some audits go faster when identity sits with a certified subprocessor. That is a legitimate reason on its own.
Nobody on call. Self-hosting assumes someone applies updates. If that person does not exist, a vendor's security team is a real advantage and no amount of saved subscription justifies the gap.
Features you will not build. Passkeys, device fingerprinting, bot detection and risk scoring arrive for free from a good provider, and they are not weekend projects.
What we charge, and what we do not have
Our side of this is easy to state because there is no invoice to explain. The kit is MIT licensed and free: self-hosted authentication with OAuth, magic links, email and password, password reset with session revocation, roles, and a Stripe integration next to it. There is no per-user fee because there is nobody to pay, and no gated auth tier because charging for the login of a kit whose whole argument is ownership would be absurd.
The honest gaps, so you can price them yourself. We do not ship SAML or SCIM, and if you need them this year, this is not the tool for that part. Two-factor authentication is on the roadmap, not in your hands today. And organizations and team billing are not in the free kit: they are the paid tier we are building, which means that for the B2B case above we are describing a problem we have not finished solving either. Anyone claiming otherwise is selling you something.
Frequently asked questions
Is managed authentication expensive?
For most projects, no. Clerk's free tier covers 50,000 monthly retained users and Pro is 25 dollars a month, checked on their pricing page on 10 August 2026. The reputation for expensive auth comes from per-seat models and from add-ons, not from the base price. If you are a consumer app under fifty thousand users, the cost argument for self-hosting is close to zero and you should decide on other grounds.
What is a monthly retained user?
It is Clerk's billing unit, and it is narrower than the monthly active user metric most vendors use. A user counts only if they come back to your app at least one day after signing up, so someone who signs up and never returns is never billed. It is a genuinely customer-friendly definition and it means your top-of-funnel churn is free.
So when does managed authentication get expensive?
When your product needs the features that sit outside the base plan rather than when you get more users. Organization-scoped authentication for B2B is an add-on, extra enterprise SSO connections are priced per connection, and a few of those together cost more than the plan itself. The bill follows the shape of your product, not your user count.
What does self-hosting cost if there is no invoice?
Maintenance, and it is real: password storage, rate limiting, email deliverability, session revocation and security updates. The honest way to price it is in hours per quarter rather than dollars per user, and the important property is that it stays roughly flat as you grow while a per-user bill does not.
How do I decide?
Ask what your product is, not how many users it has. A consumer app that will never sell to companies rarely outgrows a free tier, so pick on ownership and lock-in. A B2B product pays for organizations and enterprise sign-on from early on, and that is where the two curves cross. If you need SAML and SCIM within the year, buying them is almost always the right call.
Read the code before you price it
The maintenance ledger above is not an estimate, it is a list of files. They are in a free, MIT licensed starter kit running on Next.js 16 and Auth.js v5: password hashing, the rate limiter with its honest caveat, the revocation check with its throttle, and the proxy that never pretends to be the only gate.
If you want the argument rather than the numbers, self-hosted authentication in Next.js covers what you own and what it costs to keep. If you want the implementation detail, the authentication setup guide has every provider and the environment variables behind it.