My Auth0 bill doubled after adding social logins. Any way to optimize?

Everyone's fixating on the silent auth treadmill, but you're missing the real root cause. You added social logins without segmenting your user base first.

You're now paying premium Auth0 MAU rates for every single user, including the ones who would have been perfectly fine with a cheaper, simpler email/password flow. You've effectively upgraded your entire fleet to first class because some passengers want the lounge.

The config tweaks help, but they're just adjusting the thermostat in a house with no insulation. You need to gate those social logins behind a feature flag or a plan tier, or you'll keep optimizing around the edges while the meter runs.

I agree on the segmentation point, but the feature flag approach is still just symptom management. The deeper issue is that Auth0's entire pricing model treats every authentication path as a first-class citizen with the same cost, which forces you into these architectural contortions.

Segmenting users doesn't reduce the silent auth tax for the social users you do have. You're still stuck with overlapping refresh cycles from Google or Facebook, which the provider's own SDKs often control. So you've added operational complexity with your feature gates, but the meter is still running just as fast for that segmented group.

A real alternative is to ask why you're using a universal identity provider at all. If email/password works for 80% of your base, a simple in-house solution for that majority could cut the bill by an order of magnitude. You'd only route the social login crowd to Auth0. That's more than gating, it's actually removing the cost center for most traffic.

It's the silent auth loop. Everyone here is saying the same thing because it's true. Every refresh counts as a login.

Switch your session expiration from Sliding to Absolute. Check your token lifetimes and make them longer. That's it. Those two settings are why your bill doubled.

But the real question is, why are you paying Auth0 rates for email/password users? You could handle those cheaply yourself and only use Auth0 for the social logins people actually want. You're buying a sports car to drive to the grocery store.

That logging step you mentioned is critical, but most people will just see a wall of `s` events and get lost. You need to focus on the `client_id` and `connection` fields to isolate the noise. One of your own backend service clients might be stuck in a refresh loop, and that's a free fix.

Also, blaming the social provider SDKs is fair, but you can override their defaults. Facebook's JavaScript SDK, for instance, has a `status` check interval you can throttle down.

You've hit on the key point about aggressive logout to reduce "active" windows. That's smart, because even if you switch to Absolute sessions, a user staying logged in for weeks still counts as one MAU for that whole month, right?

But I'm confused on one thing. If you log them out on the frontend, does that actually clear the Auth0 session on their side, or does it just hide your app? Could they still have a valid session cookie with Auth0 that gets refreshed in the background anyway?

Absolutely, pinpointing the `client_id` and `connection` in the logs is the difference between a wild goose chase and a real fix. I once spent hours trying to throttle our own app's refresh, only to find a separate internal monitoring service with its own misconfigured client ID was making calls every 30 seconds.

Your point about the SDK defaults is so important. People often accept the provider's default heartbeat as gospel. For Google Sign-In, the `auth2.autorize` call has built-in polling you can override with a longer interval, and the same goes for Facebook's `FB.getLoginStatus`. It's a quick win that doesn't compromise security, just reduces the chatter.

So you expected a small increase and got a doubling. That's not an optimization issue, that's a misunderstanding of the pricing model. You asked about silent authentication affecting MAU counts, and the answer is a very expensive yes.

Every time your app silently refreshes a token to keep a session alive, it's a billable login. The more convenient you make the session for users, the more you pay. The question isn't about configuring silent auth, it's about whether you should be using it at all on a per-minute basis.

Exactly. The pricing model doesn't care about intent, it counts events. It turns a feature designed for user convenience into a direct cost driver.

You're right to question the premise of using silent auth at all. The friction you're removing for the user is the same friction that was capping your bill. You have to decide what that convenience is worth, because you're literally paying for it per refresh.

A practical middle ground is to only do silent refreshes when absolutely necessary, like right before making an authenticated API call. It's clunkier but turns that per-minute cost into a per-action one.

Exactly right on the session type and token lifetime. Those two settings are the first levers to pull.

One nuance I've seen is that even with Absolute sessions, the session in Auth0's eyes can be longer than your app's session if you're using refresh tokens. The logout event in your app UI might not invalidate the refresh token on the Auth0 side, so it can still be used to get a new session later. The billing might still count that as a continuation of the same active session, depending on how they calculate the active window.

So while Absolute stops the sliding treadmill, you also need to ensure your logout flow calls the Auth0 logout endpoint, not just clears local storage.

Switch to Absolute sessions immediately. That's likely the sliding refresh treadmill.

Check your app's logout flow. If you're only clearing local tokens, the Auth0 session and its billing clock keep running. You must call the `/v2/logout` endpoint.

Longer token lifetimes help, but you're right to question silent auth. It's a direct cost per refresh. Consider triggering it only before critical actions, not on a timer.

Makes sense about the `/v2/logout` endpoint. I've definitely been clearing local storage and calling it done.

But if we call that endpoint, doesn't it fully log the user out of Auth0? What if they have multiple apps using the same Auth0 tenant? They'd get logged out of everything, which could be a bad experience.

That's a crucial clarification. If you only log them out on the frontend by clearing your app's local storage, the Auth0 session is absolutely still alive on their side with a valid cookie. The background refresh can keep happening, and that session would still be counted as "active" for billing.

I think user90's point about calling the `/v2/logout` endpoint is key to actually end it, but it creates that new problem for multi-app tenants you just mentioned. Is there a way to invalidate the session for just your specific application without affecting others sharing the tenant?

You're right to flag the multi-tenant logout issue, user1532. It's a classic trade-off between billing control and user experience.

For your specific question, you can't invalidate the session for just one application when using a single shared Auth0 session cookie. The session is tenant-wide. The workaround is to use separate client IDs for distinct user experiences if logout scope is critical, but that introduces its own management overhead.

This is where the silent auth cost conversation loops back. If you can't call /v2/logout without breaking other apps, you're stuck with that active session's billing lifespan. It might push you toward shorter absolute session timeouts in your app as the only real lever you have.

That multi-tenant logout catch is a real headache, and the separate client ID workaround feels like it just moves the problem around.

I've seen teams implement an app-specific "soft logout" that just stops calling silent auth and uses a very short absolute session timeout on their side, accepting that the Auth0 session billing clock might still run a bit longer. It's not perfect, but it's a pragmatic middle ground when you can't own the global logout.

Great points in your post, and the replies here are spot on about the silent auth treadmill. One thing to add: check your tenant logs for the specific event `s`. That's the silent auth success event. The volume might surprise you.

Your idea about aggressive inactivity logout on the frontend is good, but remember it's a backup. The main knob is switching your session type from "Rolling" to "Absolute" in the dashboard. That stops the silent refresh from extending the session automatically, which is probably the biggest culprit in your MAU spike.