# Auth without the bill

Self-host SuperTokens, PocketBase auth, or Tinyauth and stop paying Clerk, Auth0, or WorkOS as the user count climbs.

**Replaces:** Clerk / Auth0 / WorkOS

**Tier:** Easy

## Problem

Hosted auth looks cheap until Monthly Active Users (or Clerk's Monthly Retained Users) leave the free bucket. Auth0 B2C Essentials is $8,400 / year at 10,000 MAU and $42,000 / year at 50,000 MAU; it publishes no list price at 100,000 MAU. Clerk Pro is $300 / year through 50,000 MRU, then $12,300 / year at 100,000 MRU. WorkOS AuthKit is $0 through 1,000,000 MAU and bills SSO at $1,500 / year per connection. SuperTokens (self-hosted OSS), PocketBase built-in auth, and Tinyauth (forward-auth for apps you already run) charge $0 for the license at every tier. Prices checked 14 Oct 2026.

## Stack

- [SuperTokens](https://supertokens.com/) — Self-hosted auth core and SDKs — email, social, passwordless, sessions (OSS self-host is $0 at any scale; their cloud is a different bill)
- [PocketBase](https://pocketbase.io/) — Built-in users, sessions, OAuth, and admin in one binary (Dave stack — the c17.io path)
- [Tinyauth](https://tinyauth.app/) — Forward-auth / OIDC in front of self-hosted apps (Traefik, Nginx, Caddy, Envoy)

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| Clerk Pro (10,000 MRU) | $300 | SuperTokens / PocketBase / Tinyauth — $0 license |
| Clerk Pro (50,000 MRU) | $300 | SuperTokens / PocketBase / Tinyauth — $0 license |
| Clerk Pro (100,000 MRU) | $12,300 | SuperTokens / PocketBase / Tinyauth — $0 license |
| Auth0 B2C Essentials (10,000 MAU) | $8,400 | SuperTokens / PocketBase / Tinyauth — $0 license |
| Auth0 B2C Essentials (50,000 MAU) | $42,000 | SuperTokens / PocketBase / Tinyauth — $0 license |
| WorkOS AuthKit (10,000 MAU) | $0 | AuthKit already free to 1,000,000 MAU; self-host if you want no vendor |
| WorkOS AuthKit (50,000 MAU) | $0 | AuthKit already free to 1,000,000 MAU; self-host if you want no vendor |
| WorkOS AuthKit (100,000 MAU) | $0 | AuthKit already free to 1,000,000 MAU; self-host if you want no vendor |
| WorkOS SSO (1 connection) | $1,500 | SuperTokens or Tinyauth — $0 license |

**About $8,400 / year** on a small team, before you count lock-in.

## Deploy on Railway

PocketBase: one service and a /data volume. SuperTokens: core + Postgres. Tinyauth: a tiny binary in front of the apps you already host.

## AGENT_PROMPT

```
You are replacing hosted auth (Clerk, Auth0, or WorkOS) with a self-hosted stack. Pick ONE primary, then document why the other two lost.

Options:
1) SuperTokens (https://supertokens.com/) — self-host the open-source core. Email-password, social, passwordless, session management. Pair with Postgres. OSS features stay $0 at 10,000 / 50,000 / 100,000 MAU; do not turn on their cloud ($0.02/MAU, $100/mo minimum) unless the operator asks.
2) PocketBase (https://pocketbase.io/) — built-in auth, OAuth, users, and admin in one binary. Best when the app is new and can live on SQLite + a volume (the c17.io shape).
3) Tinyauth (https://tinyauth.app/) — forward-auth / OIDC for self-hosted apps already sitting behind Traefik, Nginx, Caddy, or Envoy. This is a gate in front of apps, not an application user database.

Requirements:
- Persist sessions and user records on a volume or Postgres. Bind HTTP to 0.0.0.0:$PORT.
- Turn off public signup on admin UIs. Put the first operator behind a strong password or SSO.
- Write AGENT_PROMPT.md plus a cost table at 10,000, 50,000, and 100,000 MAU versus Clerk Pro, Auth0 B2C Essentials, and WorkOS AuthKit. Use commas in numbers 1,000 and above.
- Cite https://clerk.com/pricing, https://auth0.com/pricing, https://workos.com/pricing, https://supertokens.com/pricing, https://pocketbase.io/, and https://tinyauth.app/. Note the date you checked.
- Clerk bills Monthly Retained Users, not MAU. Auth0 has no public list price at 100,000 MAU. WorkOS AuthKit is free through 1,000,000 MAU; SSO is $125/connection/month.

Start by asking which apps need login. Do not add a second auth vendor.
```

## FAQ

### When to pick which?

PocketBase when you are starting a new app and want users, sessions, and admin in one binary. SuperTokens when an existing product needs a real auth SDK (email, social, passwordless, sessions) you can host yourself. Tinyauth when the job is forward-auth in front of apps you already run. Clerk when you want hosted React components and will stay inside Hobby (50,000 MRU) or accept Pro overage. Auth0 when you need their IdP catalog and will either stay under the Free 25,000 MAU cap or pay the Essentials cliff. WorkOS when AuthKit's free 1,000,000 MAU is enough, or you want hosted SSO and will pay $125 per connection per month.

### Where do these prices come from?

Published list prices checked 14 Oct 2026. Clerk Pro $25/month with 50,000 MRU included, then $0.02/MRU from 50,001–100,000 (https://clerk.com/pricing) — Clerk bills MRU, not MAU; Hobby is $0 through 50,000 MRU per app. Auth0 B2C Essentials $700/month at 10,000 MAU and $3,500/month at 50,000 MAU; 100,000 MAU is unpublished (https://auth0.com/pricing). WorkOS AuthKit is free for the first 1,000,000 MAU, then $2,500/month per extra 1,000,000; SSO is $125/connection/month (https://workos.com/pricing). SuperTokens self-host OSS is $0 at any scale; their cloud is $0.02/MAU with a $100/month minimum (https://supertokens.com/pricing). PocketBase (https://pocketbase.io/) and Tinyauth (https://tinyauth.app/) have no license fee. Annual figures are monthly list × 12. Railway/Postgres is extra on every self-host row.

### Why is WorkOS AuthKit $0 in the table?

Their published AuthKit tier is free through 1,000,000 MAU, so 10,000 / 50,000 / 100,000 MAU do not meter. The bill shows up as SSO or Directory Sync at $125 per connection per month ($1,500 / year for one connection). Self-host if you want no vendor, an air gap, or SSO without that meter.

### Can I stay on Clerk Hobby or Auth0 Free?

Yes, until you cannot. Clerk Hobby caps at 50,000 MRU per app. Auth0 Free caps at 25,000 MAU. The table uses Clerk Pro and Auth0 Essentials because that is the published paid path once you need MFA, branding, or more users — and it is the path that creates the bill this stack removes.

Source: https://c17.io/stacks/auth-without-the-bill