Auth0 → Zitadel

Auth0 bills on monthly active users. Zitadel measures differently, by daily active users, and is available both as a managed cloud and as software you run yourself. That makes direct price comparison awkward, so it helps to look at each plan’s unit before the numbers.

Auth0 tiers

Auth0’s pricing page separates B2C from B2B. Free is $0 per month with up to 25,000 MAUs on both. B2C Essentials starts at $35 per month at 500 MAUs and climbs to $3,500 at 50,000 MAUs. B2C Professional starts at $240 per month at 500 MAUs. B2B Essentials starts at $150 per month at 500 MAUs and B2B Professional at $800 per month at 500 MAUs. Enterprise is priced by sales, and yearly billing is 11 times the monthly price.

Zitadel plans and licence

• Free: US$0 per month with 100 daily active users, unlimited stored users and organizations, three identity providers and custom workflows.
• Pro: US$100 per month with 25,000 daily active users included, a custom domain, and a 99.5% uptime guarantee as listed.
• Enterprise: custom pricing, cloud or your own infrastructure, a commercial licence and a technical account manager.

The source is on GitHub under AGPL-3.0, with Apache 2.0 and MIT exceptions for specific directories. The repository states that Zitadel Cloud and self-hosted Zitadel run the same codebase, and it lists OIDC certification and SAML 2.0 support. AGPL obligations matter if you modify and offer the software over a network, so legal review is sensible before embedding it in a product.

What migration involves

Zitadel documents an Auth0 migration guide. You export profiles through the Auth0 Management API as JSON. Passwords are not in that export, and the guide says you must create a support ticket to get bcrypt hashes. Auth0’s own page on the topic describes an eligibility review, written authorization and a time-limited encrypted download, so plan for delay and for the possibility that a request is refused.

A migration tool then merges profile and hash data into a Zitadel import file. You authenticate with a service account and call the Admin API import endpoint. The guide says there is no hard limit on users per batch, but Zitadel Cloud has a five-minute timeout, which it puts at around 5,000 users per batch. Success can be checked through user.human.added events.

Zitadel’s migration introduction lists three strategies: batch migration, just-in-time migration where Zitadel retrieves user data from the old system at login, and orchestration where the legacy system creates Zitadel accounts on login. Just-in-time is the fallback when hashes are not available.

Applications using OIDC or SAML need new endpoints and client registrations. Auth0 Actions do not carry over. Zitadel has its own Actions feature, which runs code on events such as user creation or login, so the logic must be rewritten against a different API. The Auth0 guide does not cover external identity providers or Actions, so those parts are left to your own testing.

The trade-offs

Pricing by daily active users can be favorable for apps where users sign in rarely, and less so for apps with daily habits. The Free plan’s 100 daily users is far below Auth0’s 25,000 MAUs. Self-hosting requires a PostgreSQL database and your own operations, per the repository.

Zitadel is younger than Auth0 and has a smaller ecosystem of tutorials and prebuilt SDK wrappers. Teams that rely on Auth0’s wide integration catalog should check each connection before committing.