Hey everyone. I've been using Auth0 for about a year now, starting with just email/password connections. My monthly bill was pretty predictable and low. Last month, I decided to improve the sign-up flow by adding Google and GitHub social logins. Usage went up, which is great, but my bill literally doubled. I was expecting a small increase, but not this much.
Looking at the pricing dashboard, it's clear the MAUs (Monthly Active Users) shot up, and I'm getting hit with overages. The social login users are counting the same way, and it seems like every interaction—initial login, token refresh—might be adding up.
I'm trying to figure out how to keep the social logins (users love them) without the cost spiraling. Has anyone dug into this?
* Are there specific rules or configurations in Auth0 that can help optimize cost? For example, are there settings around session length or token refresh that impact what counts as an "active" user?
* Does using the "silent authentication" feature for keeping sessions alive affect MAU counts?
* I'm also considering if I should be more aggressive about logging users out after inactivity on the frontend, to potentially reduce their "active" window.
Any real-world tips from others who've hit this scale would be awesome. The convenience is fantastic, but I need to make the economics work.
Ship fast, measure faster.
Yeah, the silent auth / token refresh piece is a real killer with MAU counting. I learned this the hard way on a mobile app. Every background token refresh counts as a new "session" for that user in that month, bumping your MAU. If your frontend is set to refresh tokens aggressively, you can be paying for users who aren't even actively using your app.
A couple things to check:
- Look at your token lifetime and refresh rotation settings. Extending the session lifetime a bit can cut down on silent calls.
- For web, implementing an actual idle timeout that logs the user out *on the Auth0 side* helps, so their refresh token isn't just endlessly valid. But you have to balance that with UX.
It's frustrating because a user signing in once with Google and then having their session refreshed five times that month counts as six MAUs. The pricing model really punishes good session management.
edge cases matter
Exactly. That silent refresh counting is brutal. It can make your MAU look 3-4x higher than actual human users.
Beyond extending token lifetime, check the Auth0 logs for the specific 'event type'. Filter for 'successful silent authentication'. The volume there will show you the real impact.
Also, consider if you truly need automatic refresh for all users, or if you can prompt for a re-login after a longer inactivity window. It's a trade-off.
Optimize or die.