Bastionary vs Auth0.
You should own your auth.
Auth0 was the right answer in 2015 when you had 500 users and needed to move fast. At scale, Auth0's pricing increases meaningfully as MAU counts, enterprise connections, and feature tiers compound. For many teams at 50K+ users, it becomes a significant line item — check current public pricing at auth0.com to validate your situation.
What you're actually paying.
Auth0 pricing is tiered and changes over time. Costs scale with MAU volume, plan tier, and which enterprise features you enable. Verify current numbers at auth0.com — the gap between "free tier" and "enterprise plan" is significant for most scaling teams. Pricing comparison last verified April 2026.
Auth0
- Free tier covers basic use at low volume
- Paid tiers increase materially with scale
- Enterprise SSO, custom domains, MFA: paid add-ons
- Enterprise tier: contact sales, no public pricing
- Verify current plan pricing at auth0.com
Bastionary Cloud Pro
- Up to 100K MAUs flat
- MFA, SAML, SCIM included
- Custom domain included
- No "call sales" for enterprise features
- Self-hosted: ELv2 licensed, free to self-host, zero per-user fee
What's actually included.
| Feature | Auth0 | Bastionary |
|---|---|---|
| OIDC / OAuth 2.0 | ✓ Full | ✓ Full, RFC compliant |
| SAML 2.0 SSO | ~ Enterprise plan only | ✓ All plans |
| SCIM 2.0 provisioning | ~ Enterprise only, expensive | ✓ All plans |
| MFA (TOTP, passkeys, SMS) | ~ Base features, add-ons cost extra | ✓ All included |
| Custom domain | ~ Paid add-on (verify pricing at auth0.com) | ✓ Included |
| Stripe / billing integration | ✗ Not in scope | ✓ Built-in |
| Software licensing | ✗ Not in scope | ✓ Built-in |
| Feature flags | ✗ Not in scope | ✓ Built-in |
| Tamper-evident audit log | ~ Logs exist, no chain integrity | ✓ SHA-256 chained |
| HIBP breach detection | ~ Breached Password Detection (higher-tier plans) | ✓ Every password, k-anonymity |
| DPoP tokens (RFC 9449) | ✗ | ✓ |
| Self-hosted option | ✗ SaaS only (acquired by Okta) | ✓ First-class, air-gap supported |
| Data residency guarantee | ~ Shared cloud (private cloud option on Enterprise) | ✓ Your VPC, your rules |
| Per-MAU pricing | ✗ Yes, scales painfully | ✓ None. Ever. |
| Fine-grained authorization | ~ Basic roles + FGA add-on | ✓ Zanzibar-style ReBAC built-in |
Moving from Auth0 to Bastionary.
The typical migration takes one engineer about a week. Your users don't reset passwords.
Export users from Auth0
Auth0 can export user records including password hashes — though hash export requires a support-assisted process and may not be available on all plan tiers. Bastionary imports them directly — no password resets required for users whose hashes are exportable.
Provision Bastionary
Deploy Bastionary in your infrastructure (or use Cloud Pro) and run the import. User IDs are preserved; your database foreign keys stay valid.
Update OIDC client config
Change the issuer URL and JWKS endpoint in your application from Auth0's domain to your Bastionary instance. Logout URLs, callback URIs — all updated in one config change.
Swap the SDK
Replace auth0-js or auth0-react with Bastionary's SDK or direct OIDC calls. The token structure is standard OIDC — most of your code doesn't change.
Cutover and cancel
Flip DNS/config, verify tokens work end-to-end, cancel your Auth0 subscription. You're done. The migration guide covers every edge case including Rules migration, social connection mapping, and MFA enrollment transfer.
Full step-by-step guide: Migrating from Auth0 to self-hosted auth: a complete playbook →
When Auth0 is still the right answer.
If you have fewer than 25,000 MAUs, are pre-revenue, and genuinely have no ops capacity, Auth0's free tier is fine. You're paying with future pricing pain. If you have a team of one and zero infrastructure budget, that tradeoff makes sense.
Bastionary is better for: anyone past early MVP, anyone with data residency requirements, anyone building B2B SaaS that needs SAML/SCIM, anyone who wants billing and licensing in the same system, and anyone who's received an Auth0 renewal invoice and done the math.
14-day free trial. Import your Auth0 users on day one.
No credit card. Full Cloud Pro access. We'll help you import your users and verify the migration before you cancel Auth0.