Stack guides / Login

Free login and auth services

Sign-up, login, password resets and social logins. Never build these from scratch: use your database’s auth, a hosted service, or an open-source library.

11 options. Free tiers, catches and prices checked by hand on 2026-10-27; each one links to its sources.

Where we’d start: Supabase Auth. Free for a large number of users, and its security rules use the logged-in user directly.

Supabase AuthMITOur pick

Sign-up, login, social login and MFA built into every Supabase project.

Best for: Apps already on Supabase Postgres that want auth wired to row-level security. Skip it if: You need ready-made organizations/teams (you’d model them yourself in Postgres), SAML SSO or phone MFA for free.

Comes with Lovable Cloud (built on Supabase) and Bolt’s Supabase integration; managed via the Supabase MCP server.

Free

  • 50,000 MAU (plus 50,000 third-party MAU)
  • Social OAuth providers and anonymous sign-ins included
  • Basic MFA included; phone MFA not included
  • No SAML SSO; 1-hour auth audit logs

It lives inside a Free Supabase project, so it pauses with the project after a week of inactivity.

Supabase Pro, $25/mo per org (100,000 MAU, then $0.00325/MAU)

Checked 2026-10-27: supabase.com, docs.lovable.dev

Auth.js (NextAuth.js)ISC

Open-source auth library for Next.js and other JavaScript frameworks, now looked after by Better Auth.

Best for: Existing Next.js apps already on NextAuth, or apps that need stateless sessions without a database. Skip it if: You’re starting a new project and want MFA, organizations or active feature development.

Open source (ISC)

  • No MAU limits; runs in your app
  • Many OAuth providers, email magic links and credentials
  • Stateless JWT or database sessions
  • No built-in MFA or organizations

Now maintained by Better Auth mainly for security and urgent fixes, with Better Auth recommended for new projects.

No paid plan

Checked 2026-10-27: authjs.dev, github.com, better-auth.com

Auth0Service

Okta-owned hosted identity platform for logins, social and enterprise sign-in.

Best for: Apps that expect enterprise customers and want a mature, standards-heavy identity platform. Skip it if: You need MFA for free or expect to outgrow the free tier on a tight budget.

Official Auth0 MCP server (`npx @auth0/auth0-mcp-server init`, beta) manages a tenant from AI tools.

Free

  • 25,000 MAU
  • Unlimited social connections, passkeys and passwordless
  • 5 organizations
  • 1 enterprise connection, 1 custom domain (needs card verification)
  • No MFA

MFA is not included on Free, and the first paid tier covers only 500 MAU.

Essentials B2C, $35/mo for 500 MAU (B2B from $150/mo)

Checked 2026-10-27: auth0.com, auth0.com

Better AuthMIT

Free open-source TypeScript auth library with plugins for social login, 2FA and organizations.

Best for: TypeScript apps that want full-featured auth with no per-user fees and data in their own database. Skip it if: You want a fully managed service with hosted login pages and no auth code to maintain.

llms.txt docs, a docs MCP server (mcp.better-auth.com/mcp), agent skills (`npx skills add better-auth/skills`) and an MCP-auth package.

Open source (MIT)

  • No MAU limits; users live in your own database
  • Social providers, 2FA (TOTP, OTP, backup codes) and organizations (teams, roles, invitations) via plugins
  • Optional hosted dashboard Starter: $0, 1 seat, 10,000 audit logs and 1,000 security detections per month

It runs inside your app and database, so email/SMS delivery, scaling and security updates are on you.

Infrastructure Pro (optional dashboard, audit logs, security), $20/mo

Checked 2026-10-27: better-auth.com, better-auth.com, github.com

ClerkService

Hosted sign-in, user management and organizations with prebuilt UI components.

Best for: React/Next.js apps that want drop-in sign-in UI and B2B organizations with minimal code. Skip it if: You need MFA on the free plan or want to keep user data in your own database.

Official remote MCP server (mcp.clerk.com/mcp) manages apps and users and serves SDK snippets; `clerk mcp install` sets it up in common clients.

Hobby

  • 50,000 monthly retained users per app (users who return at least a day after sign-up)
  • Up to 3 social connections
  • Organizations: 100 monthly retained orgs per app, up to 20 members each
  • No MFA, passkeys or SMS codes
  • Custom domain; up to 3 dashboard seats

Hobby has no MFA or passkeys, keeps Clerk branding and fixes sessions at 7 days.

Pro, $25/mo ($20/mo billed annually), 50,000 MRU included then $0.02/MRU

Checked 2026-10-27: clerk.com, clerk.com

Firebase AuthenticationService

Google’s hosted sign-in for email, phone and social logins.

Best for: Firebase/Firestore apps, especially mobile, that want Google-managed sign-in. Skip it if: You need organizations/teams, or SMS sign-in without a billing account.

Covered by the official Firebase MCP server’s Auth tools.

Spark

  • 50,000 MAU with Identity Platform
  • 50 SAML/OIDC MAU
  • Spark caps Identity Platform at 3,000 daily active users
  • Social providers included; phone auth needs Blaze
  • MFA requires the Identity Platform upgrade

On Spark, daily actives are capped at 3,000 and anything SMS-based (phone sign-in, SMS MFA) needs the Blaze plan.

Blaze, pay-as-you-go (no-cost up to 50,000 MAU; SMS billed per message)

Checked 2026-10-27: firebase.google.com, firebase.google.com, firebase.google.com

Hexclave (formerly Stack Auth)AGPL-3.0

Open-source user platform (auth, teams, permissions, emails, payments), formerly called Stack Auth.

Best for: Next.js/React apps that want open-source auth with teams, permissions, emails and payments in one product. Skip it if: You expect more than 10,000 sign-ups on the free plan or can’t accept AGPL (server) when self-hosting.

Official hosted MCP server (mcp.hexclave.com/mcp) and agent skill docs (skill.hexclave.com).

Free

  • 10,000 auth users (all accounts, inactive ones included)
  • 1,000 emails per month
  • 1 dashboard admin
  • Social login, passkeys, teams and RBAC are listed features; MFA is not listed

The cap counts every user account, not monthly actives, so old sign-ups keep using it up.

Team, $49/mo (50,000 auth users)

Checked 2026-10-27: hexclave.com, github.com, docs.hexclave.com

LogtoMPL-2.0

Open-source auth and identity platform (OIDC) available as a cloud service or self-hosted.

Best for: Teams that want open-source OIDC auth they can self-host for free or run on Logto Cloud. Skip it if: You need MFA or organizations on a hosted free plan.

Official remote MCP server (mcp.logto.io) for Logto Cloud that can add auth to a project.

Free (Logto Cloud)

  • 50,000 MAU
  • 3 social connectors
  • 3 applications (1 machine-to-machine)
  • 1 custom domain
  • No MFA, organizations or RBAC on Cloud Free

On Cloud, MFA and organizations are paid add-ons ($48 each on Pro), so the free tier is basic login only.

Pro, from $24/mo (unlimited MAU, usage-based beyond 50K tokens; add-ons extra)

Checked 2026-10-27: logto.io, docs.logto.io, docs.logto.io

Neon AuthService

Managed Better Auth that stores users and sessions inside your Neon Postgres database.

Best for: Neon Postgres apps that want auth data in the same database, with a separate auth environment per branch. Skip it if: You need MFA today or don’t use Neon.

Part of Neon, which has an official hosted MCP server (mcp.neon.tech/mcp).

Neon Free

  • Up to 60,000 MAU per project
  • Email/password, email OTP, magic links and social OAuth (Google, GitHub, Vercel)
  • Users and sessions stored in your Neon database (neon_auth schema)
  • Organizations only partly supported; MFA not yet available

MFA is still marked coming soon and organizations are only partly supported.

Included with Neon Launch (pay-as-you-go), up to 1M MAU

Checked 2026-10-27: neon.com, neon.com, neon.com

WorkOS AuthKitService

Hosted user management and sign-in from WorkOS, built around organizations and enterprise SSO.

Best for: B2B SaaS that wants free auth at scale now and paid enterprise SSO later. Skip it if: You need a custom auth domain or SSO without paying for add-ons.

`npx workos@latest integrate` AI installer, llms.txt docs, and AuthKit can be the OAuth server for your own MCP server.

Free up to 1M MAU

  • 1,000,000 MAU free, then $2,500/mo per extra 1M
  • Social login, passkeys, MFA and magic auth included
  • Organizations and RBAC included
  • Staging environments never billed
  • Radar bot protection: first 1,000 checks free

Enterprise SSO and directory sync cost $125 per connection per month, and a custom auth domain is $99/mo.

No plan tiers; add-ons such as custom domain $99/mo and SSO $125/connection/mo

Checked 2026-10-27: workos.com, workos.com, workos.com

KindeService

Hosted auth with organizations, roles and built-in subscription billing.

Best for: Small B2B apps that want auth, organizations and simple subscription billing from one vendor. Skip it if: You expect more than 10,500 monthly users soon or need unbranded login for free.

Official Kinde Management MCP server for users, organizations, roles and permissions.

Free

  • 10,500 MAU
  • 5 monthly active organizations (single-user orgs not counted)
  • Social sign-in; email and authenticator-app MFA (10 SMS included)
  • 1 enterprise SSO connection and a custom domain
  • 2 custom roles, 10 permissions

Kinde branding can’t be removed on Free, which Kinde positions for hobby and personal projects.

Pro, $25/mo (10,500 MAU; 50 orgs, then $0.50 per extra org)

Checked 2026-10-27: kinde.com, docs.kinde.com

Not sure what you need? Describe your app and the Build Kit picks a whole free stack, with starters and a plan.

More guides