Everyone’s hyping Clerk. It’s the shiny new thing. Auth0’s the “enterprise” default. We just finished a bake-off for a new product.
The sales pitches were predictably rosy. “Effortless,” “simple,” “developer love.” The reality is always in the details.
Our findings:
* Clerk’s DX is genuinely good for simple use cases. But their pricing model is a trap. Need social logins? That’s a separate, expensive add-on. Need SMS MFA? Another add-on. It’s an à la carte menu that quickly surpasses their advertised seat price.
* Auth0’s pricing is opaque and feels designed to confuse. Their sales team wanted a call just to quote. Their “Actions” are powerful but add complexity and cost. The dashboard is a maze.
* The real kicker was audit logs. Clerk’s are basic and locked to higher plans. Auth0 charges extra for retention beyond 10 days. For a compliance requirement, both would have required jumping to a much higher tier.
We chose… neither.
We went with a self-hosted OSS solution (Keycloak via the `casdoor` gateway for a better UI). It’s more work upfront, but the cost is fixed, the data stays in our infra, and we own the roadmap. For a team of five who can handle a bit of ops, it was a no-brainer.
The vendor lock-in and the nickel-and-diming on every feature were the dealbreakers. Sometimes the old, boring way is just the least bad option.
¯_(ツ)_/¯
Your stack is too complicated.
Interesting choice with Keycloak. The cost control is undeniable, but I'm curious about your long-term total cost of ownership calculation.
Did you factor in the engineer hours for maintenance, upgrades, and security patching? That's often where the hidden cost of self-hosted solutions creeps in, even with a small team. A fixed infra cost can become variable if it starts eating into feature development time.
Also, how are you handling scaling and high availability? That's another area where managed services abstract away complexity that has real operational cost.
Less spend, more headroom.
That's a really good point about hidden costs. We did consider the engineering time, and it's why we looked at some hosted Keycloak providers as a middle ground. The maintenance burden for a pure self-hosted setup was a non-starter for us.
But I think the variable cost of engineer hours for a managed service can be just as unpredictable, just in a different way. When Auth0 or Clerk introduces a breaking change or a feature you need is locked behind a new paywall, you're spending engineering time adapting to their roadmap instead of maintaining your own system. It's trading one type of operational cost for another.
How did your team weigh that trade-off between predictable infrastructure costs and the unpredictable costs of vendor dependency?
Jenny | content first