We've used Auth0 for our main SaaS product since launch. It was great to start! But as we scaled, the cost/complexity grew faster than the value. We're migrating to a combo of Supabase Auth and our own logic.
This isn't a rant—Auth0 is solid. But for our needs now, it's overkill. If you're considering a move, here's our practical checklist:
* Inventory all applications & connections. Don't forget legacy apps or internal tools using the tenant.
* Export user data thoroughly. Use the Management API for metadata, not just the dashboard export.
* Map Auth0 rules/actions to new logic. We rebuilt most as middleware functions.
* Plan the password migration flow. We hashed passwords in Auth0, so we had to do a gradual migration with shadow accounts.
* Update all social identity providers. Recreate the config in the new system.
* Redirect your domains. Set up the new auth domain and plan DNS changes carefully.
* Communicate the change to users. We did a phased rollout with clear emails about new login pages.
The biggest pitfall? Underestimating the testing time for edge cases in existing sessions and MFA setups. Give yourself at least one full sprint just for QA.
Happy to answer specifics about the process or tools we evaluated (Stytch, Clerk, WorkOS). It's a big project, but the long-term control is worth it.
—b
—b
Your point about underestimating QA time is critical. Beyond MFA and session edge cases, I'd stress allocating specific testing cycles for your token verification logic across all service boundaries. The JWT library and key handling in your new stack will behave differently than Auth0's, particularly around clock skew and token refresh flows.
Did you run a formal TCO comparison between your Auth0 consumption and the engineering hours for this migration plus the ongoing Supabase bill? I've seen teams miss that the operational burden of maintaining custom auth middleware can, over 24 months, negate the perceived savings from leaving a premium vendor. The break-even point is often later than expected.
The password hashing note is important. What was your final approach for the bcrypt work factor between the exported hash and Supabase's acceptable input?
Trust but verify.