Auth0 → Ory

Auth0 is a hosted identity platform. Its documentation describes password and social login, single sign-on, multi-factor authentication and OAuth 2.0 protection for APIs. Ory is a set of identity building blocks: Kratos handles identities and login flows, Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider, Keto handles permissions on the Zanzibar model, and Oathkeeper is an identity and access proxy. Each project is licensed under Apache-2.0 on GitHub, and Ory also sells the hosted Ory Network.

What Auth0 costs today

The Auth0 pricing page lists a Free plan for up to 25,000 monthly active users at $0. Paid B2C plans start at $35 per month for Essentials and $240 per month for Professional, each at a starting point of 500 users. Yearly billing is listed at eleven times the monthly price. B2B plans start at $150 and $800 per month. Enterprise pricing is custom.

What Ory costs

Ory Network has four tiers. Developer is free, with two development environments and community support. Production is $770 per year and Growth is $9,350 per year, and both add usage charges beyond an included monthly credit ($21 and $255). Usage is billed per average daily active user, not per monthly active user, at $0.14 and $0.12 per month respectively, with separate rates for machine-to-machine tokens and permission checks. Enterprise is custom. Because the metric differs, a direct per-user comparison with Auth0 needs the actual traffic pattern of the application.

The open-source stack can also be run without paying Ory. The licence is free, but servers, upgrades, monitoring and security patching become the team’s work. Ory lists a separate commercial Enterprise License for self-hosted production that adds features such as SCIM, SAML and SSO.

What the switch changes

Ory is API-first. Kratos exposes login, registration, recovery, verification and profile flows through APIs, so the application renders its own screens. That gives full control over the interface, but it means more integration work and fewer prebuilt widgets than Auth0’s hosted login. OAuth 2.0 and OpenID Connect move to Hydra, and permission checks move to Keto, so a deployment usually involves several components rather than one tenant. Ory Network lets Production and Growth projects choose the data storage region.

Trade-offs

• Interface flows must be built and maintained by the application team.
• Self-hosting adds operational cost that a flat licence price does not show.
• Auth0 includes features such as attack protection and enterprise connections as managed settings; the Ory equivalents may need configuration or a commercial licence.
• The open-source code can be audited and run on infrastructure the team controls.

Migration checklist

• Confirm the Auth0 setup uses a database connection with email and password. Ory’s Auth0 guide covers only that case.
• Export users with the Management API. The bulk export is newline-delimited JSON.
• Password hashes are not part of that export. Auth0 requires a support ticket, and the export is not available on the Free tier.
• Kratos can import hashes in these formats: BCrypt, Argon2, MD5, SHA, SSHA variants, PBKDF2, SCrypt, Firebase SCrypt, crypt(3) and HMAC. The Ory guide shows bcrypt hashes in its Auth0 example.
• Without hashes, import the accounts anyway and have users reset passwords at first sign-in, with account recovery enabled.
• Hash passwords before batch import; Ory advises this when importing more than 20 clear-text passwords.
• Rebuild the login and registration screens, move OAuth clients to Hydra, then test sign-in before cutover.

Keycloak and Zitadel are other open-source identity options and are not reviewed here.