What is a cheaper alternative to Clerk?

Clerk gets you from nothing to a working sign-in quickly, with ready-made components and a dashboard. The questions come later: when more people come back to your app every month, or when you need a feature from a paid plan. Cheaper options exist, but each one trades money for work or for features, so it helps to know which trade you are making.

What does Clerk do well?#

Clerk is a hosted service for authentication and user management, and it is good at both. To be fair to it:

• Prebuilt UI components. <SignIn />, <SignUp />, <UserButton />, <UserProfile /> and <OrganizationSwitcher /> drop into your pages, and billing components like <PricingTable /> sit next to them.
• SDKs for many frameworks, including Next.js, React, Expo, Astro, Vue and Nuxt. In Next.js, @clerk/nextjs gives you clerkMiddleware(), auth() and <ClerkProvider>.
• User management. A dashboard for your users, and organizations for B2B apps.
• Fair counting. Clerk bills by monthly retained users (MRU): people who visit your app at least one day after they signed up. Someone who signs up and never comes back doesn’t count.
• A free start. The Hobby plan needs no credit card.

Why do people look for a cheaper alternative to Clerk?#

• Cost as retained users grow. The bill follows retained users, and B2B apps also pay per monthly retained organization. A growing app grows its bill, even when the price per user is fair.
• Plan-gated features. The Hobby plan has no passkeys, no MFA and no satellite domains, and the “Secured by Clerk” branding stays on the components. Those come with the Pro and Business plans. Enterprise SSO connections also start on Pro, and custom organization roles need the Enhanced organizations add-on.
• Satellite domains. Satellite domains are Clerk’s way to share one session across different domains, like example.com and example-admin.com. Sign-in happens on the primary domain, and each satellite reads the session from it. Satellites are free in development but need a paid plan in production, and each one is billed on top of the plan. Clerk’s docs describe the setup.
• Wanting standard protocols. Your app talks to Clerk through its SDKs: middleware, server helpers and components. Leaving means replacing those calls across your code. Clerk can also act as an OAuth 2.0 and OpenID Connect provider for third-party clients, but its quickstarts add Clerk to your own app through the SDKs.

What are the cheaper alternatives to Clerk?#

There are four cheaper paths: a library in your app, a server you host, the sign-in that comes with your platform, or another hosted provider. The table shows what each one gives up compared with Clerk.

OIDC here is OpenID Connect, the standard layer on top of OAuth 2.0 that tells your app who signed in.

Open-source libraries: Auth.js and Better Auth#

Auth.js and Better Auth are free, and they keep your users in your own database, so the running cost is your app and its database. In exchange, you build the sign-in and account pages, send the emails for verification and password resets, and own the security of all of it. Better Auth plugins cover passkeys, two-factor authentication and organizations. Auth.js connects to more than 80 preconfigured providers, and the Better Auth team, which now maintains it, recommends Better Auth for new projects. For the Next.js view, see the best authentication for Next.js.

Self-hosted identity servers#

Keycloak, Zitadel, Logto, authentik and SuperTokens have no license fee for their open-source editions. Zitadel and Logto include organizations, and Logto and SuperTokens ship prebuilt sign-in screens. The cost moves from the invoice to your team: servers, a database, upgrades, backups and monitoring. Zitadel Cloud and Logto Cloud run the same software for you, and both have free plans.

Sign-in bundled with your platform#

If your app already runs on Supabase, Firebase or AWS, its sign-in service is the shortest path, and each one has a free tier. What you give up is portability: if you leave the platform later, sign-in moves too. For screens, Firebase offers the drop-in FirebaseUI, and Cognito offers managed login pages.

Where loginos fits#

loginos is a hosted OpenID Connect provider, and it works differently from Clerk. loginos doesn’t put components in your pages: people sign in on loginos.io and come back to your app with a one-time code, as with any OIDC provider. In Chrome and Edge, an optional “Continue as” prompt signs people in without leaving your page.

loginos fits when:

• You run several domains. A platform has no limit on domains, and all of them share one pool of people. There is no primary domain and no satellite setup: every domain runs the same sign-in, and people already signed in to loginos come straight back. See Domains.
• You want passkeys from day one. Passkeys live on loginos.io and work on all your domains, and passwords still work.
• You want standard OIDC. Auth.js, openid-client, Passport and other OIDC libraries work with the discovery URL, so you can leave without rewriting your app.
• You need roles in tokens. Roles and permissions come in every token, and account linking connects the users you already have.
• Cost matters. loginos has no paid plans today, and you can start without a card.

loginos doesn’t fit when you need components like <UserButton /> and <UserProfile /> inside your pages, social logins, organizations with their own roles, SMS or authenticator codes, SAML, self-hosting, or a login page on your own domain. Email verification isn’t there yet either: email_verified is false, and loginos sends no email.

With Auth.js, loginos is one provider entry. Auth.js keeps your app’s session, and loginos keeps the accounts and passkeys:

import NextAuth from "next-auth";

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    {
      id: "loginos",
      name: "loginos",
      type: "oidc",
      issuer: "https://loginos.io",
      clientId: process.env.LOGINOS_APP_KEY,
      clientSecret: process.env.LOGINOS_APP_SECRET,
      checks: ["pkce", "state"],
    },
  ],
});

Auth.js sends people back to /api/auth/callback/loginos, so set that as the Callback path in the console’s Domains tab. The path is the same on every domain. If one deployment serves several domains, also read NextAuth on multiple domains. The quickstart covers creating the platform and its keys.

Frequently asked questions#

Is Clerk free?#

Clerk’s Hobby plan is free, needs no credit card, and covers a set number of monthly retained users per app. Passkeys, MFA, satellite domains and removing the Clerk branding need a paid plan. Clerk’s pricing page has the current limits.

Does Clerk work across multiple domains?#

Subdomains of one domain share a Clerk session by default. Different domains need satellite domains: the primary domain handles sign-in, and the satellites read the session from it. Satellite domains need a paid plan in production and are billed per domain. Sharing a login session across domains explains the general approach.

Is Better Auth a good replacement for Clerk?#

It is if you want to own your auth code. Better Auth is an MIT-licensed TypeScript library that keeps users and sessions in your database, with plugins for passkeys, two-factor authentication, organizations and SSO. In exchange, you build the screens, send the emails and run the database.

What is a monthly retained user in Clerk?#

A monthly retained user is someone who visits your app in a given month at least one day after signing up. People who sign up and never return don’t count, so one-day visitors stay off the bill. Clerk counts organizations separately, as monthly retained organizations.