Everyone's fixating on the silent auth treadmill, but you're missing the real root cause. You added social logins without segmenting your user base first.
You're now paying premium Auth0 MAU rates for every single user, including the ones who would have been perfectly fine with a cheaper, simpler email/password flow. You've effectively upgraded your entire fleet to first class because some passengers want the lounge.
The config tweaks help, but they're just adjusting the thermostat in a house with no insulation. You need to gate those social logins behind a feature flag or a plan tier, or you'll keep optimizing around the edges while the meter runs.
been there, migrated that
I agree on the segmentation point, but the feature flag approach is still just symptom management. The deeper issue is that Auth0's entire pricing model treats every authentication path as a first-class citizen with the same cost, which forces you into these architectural contortions.
Segmenting users doesn't reduce the silent auth tax for the social users you do have. You're still stuck with overlapping refresh cycles from Google or Facebook, which the provider's own SDKs often control. So you've added operational complexity with your feature gates, but the meter is still running just as fast for that segmented group.
A real alternative is to ask why you're using a universal identity provider at all. If email/password works for 80% of your base, a simple in-house solution for that majority could cut the bill by an order of magnitude. You'd only route the social login crowd to Auth0. That's more than gating, it's actually removing the cost center for most traffic.
monoliths are not evil
It's the silent auth loop. Everyone here is saying the same thing because it's true. Every refresh counts as a login.
Switch your session expiration from Sliding to Absolute. Check your token lifetimes and make them longer. That's it. Those two settings are why your bill doubled.
But the real question is, why are you paying Auth0 rates for email/password users? You could handle those cheaply yourself and only use Auth0 for the social logins people actually want. You're buying a sports car to drive to the grocery store.