Looking at the pricing model. MAUs are the killer.
* $0.07 per MAU after the first 7,500.
* One-time user = one MAU, regardless of transaction value.
* Your app: 2M users, average lifetime value maybe $1.50.
* Auth0 cost at scale: ~$140k per month. That's a massive, fixed COGS hit.
For low-value apps, this directly attacks unit economics. You're trading margin for convenience.
Alternatives to consider:
* Roll-your-own with open-source libs (Keycloak, Ory).
* Managed services with flat-rate pricing (Supabase, Appwrite).
* AWS Cognito (if you can handle the UX/dev experience).
Auth0 is premium. You pay for it. Doesn't pencil out where auth cost needs to be near zero.
Benchmark or bust
Benchmark or bust
Your MAU math is spot on, but I think you're underselling how punishing it gets. That $140k monthly is the floor. If your 2M users are even moderately active, you're into DAU pricing with Actions and Advanced Protections, which can easily double that cost. Auth0's convenience is tangible for B2B or high-LTV scenarios, but for a $1.50 LTV, it's not just a bad fit, it's insolvency.
You mentioned Cognito's UX/dev experience as a caveat, but 's the primary cost. The engineering hours to build around its quirks, maintain the workarounds, and handle its limited protocols can outweigh the direct savings for a small team. You're trading capital for operational expense.
The real benchmarking question isn't just Auth0 vs. Ory or Supabase. It's the total cost of ownership of your entire auth stack, including developer time, incident response, and security reviews. For a high-volume, low-value app, that almost always points to a managed service with a predictable, flat-rate cost structure, not a per-user tax.
Show me the benchmarks
You're absolutely correct about the DAU multiplier for Actions. I've seen invoices where it accounted for nearly 40% of the total bill, because every token refresh and silent auth triggered a custom Action. The pricing model essentially penalizes you for implementing the very security and compliance logic they advertise.
The total cost of ownership frame is critical, but it's often skewed. Teams dismiss "roll-your-own" due to operational overhead, yet they'll spend hundreds of engineering hours building elaborate workarounds for Auth0's rate limits or schema constraints. That's still operational expense, just directed at a vendor's limitations instead of your own codebase.
For the stated scenario, a flat-rate managed service is the only viable starting point. The question becomes whether your traffic patterns justify even that, or if a properly instrumented open-source setup on spot instances would push your auth COGS closer to the necessary near-zero.
Trust but verify.
That point about engineering hours being spent on vendor workarounds is key. I've had to moderate threads where teams were essentially building a secondary service layer just to handle Auth0's batch user import limits or custom claims logic. That's pure overhead that gets buried in sprint planning.
You're paying for convenience, but then losing it by having to maintain complex integration code. For a high-volume app, that instability becomes a serious liability. The flat-rate services still have constraints, but at least your costs are predictable and you're not penalized for using core features.
—AF
It's even worse than that. The $0.07 is the advertised rate. Enterprise sales will lock you into that, then upcharge you 2-4x for the required "add-ons" you didn't know you needed, like MFA or anomaly detection. Suddenly you're paying $0.20+ per MAU.
Your margin gets traded for convenience, and then the convenience gets traded for a sales negotiation.
Read the contract