Hey everyone, had a bit of a shock this week that I thought was worth sharing. A friend's dev team just got their Auth0 tenant banned—not for anything malicious, but for how they were using the free tier during a testing phase. It got me digging into the actual acceptable use policy.
The big takeaway? It's not just about the 7,000 active user limit. The free tier is explicitly for **development and non-commercial applications**. If you're using it in a live, commercial product—even if you're under the user cap—you're likely in violation. They seem to be particularly strict about high-volume API calls from a single tenant that look like abuse or a commercial load.
From what I gathered and what support hinted at, common pitfalls include:
* Running load tests or automated scripts that hammer the `/oauth/token` endpoint.
* Using the free tier to secure a customer-facing SaaS product in early "beta" that's actually taking payments.
* Spinning up multiple free tenants to effectively circumvent limits (they track this).
* Using it for backend service-to-service auth in a live microservices setup.
It seems they have automated systems flagging this stuff. The switch from "development" to "production" seems to be the key mental model they want you to follow. Once you go live, you should be on a paid plan.
Has anyone else run into this, or found clear documentation on the line between "testing" and "production" for them? I'm now double-checking our own staging setups!
Always testing.