Costs and pricing

How the money moves

The app pays almost everyone, and the bill grows with the number of enterprise customers faster than with the number of users.

The SSO tax is a chain. A list at sso.tax, kept by a developer, counts about 150 SaaS vendors that put SSO behind a higher plan, with published increases from 15% to 9,900%, many at three to ten times the base price. Those apps pay their identity vendor $60-125 a month per connection and keep the rest: one charging $800 a month extra for SSO against a $100 identity cost keeps $700. The identity vendors that campaign loudest against the tax charge app builders per connection, and CISA's voluntary Secure by Design pledge asks for SSO at no extra cost, with nothing binding behind it.

Here's the project app at list prices as of October 2026: 100,000 monthly active users, 90,000 signing in directly and 10,000 through 20 enterprise SSO connections of 500 each, billed annually, no discounts, no SMS.

Stytch charges $125 per connection after five and doesn't publish its per-user rate, Descope and Frontegg quote, and Microsoft's paid rate for Entra External ID above 50,000 free users wasn't on the pages I read.

The spread is about a hundredfold, and it comes from the meter. Supabase, Google and Cognito charge per SSO user, so 10,000 SSO users cost about $150 a month, while WorkOS, Clerk and Stytch charge per connection, so SSO is most of their bill. Flip the business and the order flips: 100 enterprise customers of 20 users each would cost about $99,000 a year in connection fees at WorkOS's list prices, against $30-60 a month on a per-user meter.

Building is front-loaded. By my rough estimate, login, organizations, roles, SSO, SCIM and an audit log take 10-23 engineer-months in year one, then half an engineer to more than one a year for certificates, directory quirks and fixes. The inputs come from vendors who sell the alternative, and I found no independent study. Each enterprise connection also costs 10-20 hours of setup and support, about what a vendor charges for a year of that connection.

Machine tokens are the meter that catches people out. Cognito charges about $0.002 per token request: 1,000 services caching a token for an hour cost about $1,600 a month, and fetching one per API call would cost close to a million dollars (my arithmetic). Permission checks are cheaper: Amazon Verified Permissions would cost the project app roughly $100-1,000 a month.

How companies of different sizes use it

Nobody publishes identity spend by company size, so the figures below are my rough estimates from list prices, engineer pay and a few vendor-written guides. From mid-market up, customer login and employee login are separate budgets with separate owners.

A startup (under 50 people, up to about 50,000 monthly users) wires in a library or hosted service in a week or two: Supabase Auth or Firebase with the backend, Clerk, Better Auth or Auth0's free tier, often chosen by an AI app builder that generated the code. The founder or a founding engineer owns it, and my rough estimate is $0-6,000 a year. It moves on when an enterprise prospect asks for SSO, customers want teams and roles, a buyer asks for a SOC 2 report, or someone notices nobody reviewed the AI-written login code (Veracode, which sells code scanning, found AI-generated code passed its security tests 56% of the time in 2026).

A scale-up (about 50 to 500 people, 10,000 to a million monthly users) buys a hosted layer with organizations, SSO and SCIM (WorkOS, Clerk, Auth0, Stytch, Descope, Frontegg) or builds on Cognito, with 5-30 enterprise connections and permissions scattered through the code. A platform or security lead owns it, and around 200 employees a PM for identity or "enterprise readiness" appears; the project app is this size. My rough estimate is $15,000-150,000 a year in vendor fees, plus one to three engineers part-time. Compounding connection fees (about $60,000 a year at 50 connections on WorkOS's list), requests for custom roles and data residency, or a Fortune 500 questionnaire push it on, and the build question reopens here.

A mid-market company (about 500 to 2,000 people) runs two systems: Entra (often inside Microsoft 365) or Okta for employees, and Auth0, Ping, Cognito, Entra External ID or a home-grown service for customers, owned by IT or the CISO and by a product group respectively. My rough estimate is $200,000-700,000 a year with an identity team of three to eight. Acquisitions that leave several login systems, auditors, sprawling service accounts and board questions after a peer's breach push it on.

An enterprise (about 2,000 to 10,000 people) runs Okta or Entra for employees with governance and privileged-access tools on top (SailPoint, CyberArk), and serves customers on Auth0, Ping, Entra External ID or its own platform, sometimes built on Keycloak. A head of identity under the CISO owns the employee side; product leaders own customer login. My rough estimate is $1.5-5 million a year and eight to 15 identity staff. Merging many brands' logins, sector rules, service accounts and agents with no owner, and bundle offers from security platforms push it on.

A Fortune 500 company (revenue above about $7.5 billion) runs several identity systems at once, often Entra plus Okta plus an older Ping or ForgeRock install; Okta's roughly 500 customers paying it over $1 million a year are the closest public proxy. The CISO and CIO share ownership, and business units own customer login. My rough estimate is $5-30 million a year and 15-30 or more identity staff. There's no next size up; the pressure comes from vendor consolidation, machine and agent identities, and data-residency demands.

What changes as a company grows (spend is my rough estimate):