Auth0 → Cerbos

Auth0 folds fine-grained authorization directly into its identity platform: the relationship-based access checks it markets under Auth0 FGA are built on a Zanzibar-style model and priced as part of the same plans that cover login, SSO, and MFA. Teams evaluating access control often only encounter it as a feature of their identity provider rather than as a separable piece of infrastructure. Cerbos takes the opposite approach. Authorization is the entire product, distributed as an open-source policy decision point that runs independently of whichever identity provider issues the tokens.

The functional swap is narrower than a typical vendor migration. With Auth0, role and permission checks are usually written as rules or Actions inside the Auth0 dashboard and evaluated during login or token issuance. Cerbos moves those checks out of the login path entirely: policies are written in YAML, version-controlled like application code, and evaluated at request time by a Cerbos PDP that the application or API gateway calls over gRPC or REST. Auth0, or any other identity provider, still handles authentication; Cerbos only answers whether a given principal is allowed to take a given action on a given resource. The two systems run side by side rather than one replacing the other.

Pricing follows two different logics. Auth0’s official pricing page lists a Free plan covering up to 25,000 monthly active users at no cost, then Essentials starting at $35 per month and Professional at $240 per month, both priced from a 500 monthly-active-user baseline that scales up on a usage slider, with Enterprise available by quote. Cerbos prices its two halves separately, per its own pricing page. The open-source PDP is free forever regardless of scale, whether self-hosted or run in a team’s own cloud. The optional hosted Cerbos Hub control plane adds a Proof of Concept tier at $0 per month (up to 100 monthly active principals), a Development tier from $25 per month, and a Production tier from $933 per month once usage passes 5,000 monthly active principals, with Enterprise custom-priced. A team that only needs the free PDP pays nothing at any traffic level; a team that wants Cerbos Hub’s hosted policy testing, audit logs, and uptime SLA pays for that layer on top.

Because Cerbos does not replace Auth0, there is no user-data migration in the usual sense. The work is rewriting existing role and permission logic as Cerbos policies, then adding a Cerbos client call at each point in the application where an authorization decision currently happens inside Auth0 rules or Actions. Cerbos’s own Playground can validate new policies against test cases before anything ships to production. There is no official importer from Auth0’s rule format, so a team with a handful of roles can expect a few days of policy-writing and testing, while a multi-tenant application with dozens of resource types and custom permission combinations should plan for a few weeks of running both checks in parallel before cutting the authorization path over for good.

The honest recommendation splits by how complex the access rules already are. Teams whose permissions amount to a handful of roles get little from adding a second moving part and should stay on Auth0’s built-in authorization. Teams whose permission logic has outgrown what fits comfortably in dashboard rules, or who want that logic version-controlled, tested, and audited independently of identity-provider changes, are the ones this swap is built for. Because the Cerbos PDP itself stays free at any scale, piloting it alongside an existing Auth0 setup costs engineering time rather than a new subscription, which makes it a low-risk trial even for teams not ready to commit to Cerbos Hub’s paid tiers.