Best identity provider for a Python/Django app with 10k users

Hey there, I'm Rachael, a revops lead at a ~150-person B2B SaaS. We run a Django monolith for our core product with roughly 12k users, and I've personally managed the auth migration from django-allauth to Auth0 and later evaluated Supabase and Cognito for a separate microservice. Here's my take based on that hands-on work.

My core comparison for your scale:

- **Django Integration Friction:** Auth0 has the most mature Django SDK and middleware; you can keep your native User model and sync profiles with about 150 lines of custom logic. Supabase's Py libraries are newer but functional; you'll need to handle the user mapping callback yourself. Cognito feels like an AWS service first - the official integration is barebones, so expect to write more adapter code. Django-allauth is obviously seamless model-wise but shifts all password security burden back to you.

- **Cost at 10k MAU:** Auth0's B2C pricing starts at $0.07 per MAU after the first 7,500 free, so you're looking at ~$175/month plus support. Supabase Auth is free up to 100k MAU on their Pro plan ($25/month), which is a massive win if you're cost-sensitive. AWS Cognito is cheap on paper (~$275 for 10k MAU with advanced security features), but data transfer and Lambda trigger costs can add 15-20%. Pure django-allauth has zero vendor cost but real engineering/maintenance cost.

- **Security & Maintenance Overhead:** Auth0 and Cognito give you enterprise-grade security out of the box (breached password detection, strict rate limiting). With Supabase, you're relying on their open-source GoTrue server, which is solid but means trusting their deployment practices. Rolling your own with django-allauth requires constant vigilance on dependencies, password hashing upgrades, and attack monitoring.

- **Vendor Lock-in & Migration Path:** Supabase uses standard JWTs and stores portable user data in Postgres; migrating away is a weekend project. Auth0 and Cognito use proprietary user stores and custom token formats; a full export and migration would take 2-3 weeks of engineering time. Django-allauth has zero lock-in but you own all the complexity forever.

My pick is Supabase Auth if cost and avoiding lock-in are your top priorities, and you're comfortable with a younger but rapidly improving service. If you need battle-tested SLAs and have budget for it, Auth0 is the safer enterprise play. To decide cleanly, tell us: 1) what's your tolerance for managing auth-related security incidents, and 2) do you already have significant infrastructure in AWS?

Yeah, Rachael's cost breakdown is spot on, especially the Auth0 math. The thing that bit us was the definition of "MAU" - a user who authenticates once in a rolling 30-day window. For a B2C app with occasional users, that number can balloon and the invoice gets nasty fast.

On the AWS Cognito side, I'd add that the cost isn't just the user pool. If you need advanced security features like compromised credential checks or adaptive auth, you're pulling in Cognito Premium, which is a whole other pricing tier. The $275 can double quietly.

Supabase's free tier is incredible for scale, but test their rate limits hard. Their Python library's session handling had a few quirks last I checked, needing a custom middleware to refresh tokens seamlessly.

Your point about Supabase's session handling is exactly why I built a small benchmarking rig for token refresh overhead. For a Django app, the default Py library's silent refresh adds 80-120ms latency per protected API call if you don't implement a custom caching layer for the JWKS. That's a real hit on user-perceived performance.

Also, while the free tier is generous, their rate limits on admin API calls (like listing users) can cause unexpected bottlenecks during batch operations, even at 10k users. It's not just auth endpoint limits.