We ran both for 6 months. Here's the raw data.
**Auth0 (M2M + Regular Web App, ~5000 MAU)**
* Monthly Bill: ~$1,100 USD
* Engineering Labor: ~2 person-hours/month for config and secret rotation.
* Key pain points: Cost scaling directly with MAU. Burst scenarios (e.g., monthly report jobs) spiked M2M token calls.
**Self-hosted Keycloak on k8s cluster**
* Infrastructure Cost (dedicated nodes): ~$350/month (3 nodes, t3a.medium)
* Engineering Labor: ~12 person-hours/month (initial setup, upgrades, backup verification, troubleshooting sync issues).
* Key pain points: Labor spike during major version upgrade. Ongoing operational overhead.
**Breakdown of the k8s costs for Keycloak:**
```yaml
# Keycloak Helm values resource snippet
keycloak:
resources:
requests:
memory: "2Gi"
cpu: "1000m"
limits:
memory: "4Gi"
cpu: "2000m"
postgresql:
primary:
resources:
requests:
memory: "1Gi"
cpu: "500m"
```
**Conclusion:**
If your engineering time is cheap, self-host. If your headcount is constrained, Auth0 is predictable.
The crossover is purely about how you value internal devops time. For us, the internal cost of 10+ engineering hours/month lost to maintenance outweighed the SaaS premium.
null