How to choose a free authentication provider
A free authentication provider gives you hosted sign-in up to a usage limit, usually counted in monthly active users, and keeps some features for its paid plans. To compare free tiers, look at how each one counts an active user, which features it holds back and whether you can take your users with you if you leave. The Skycloak Platform's planned free tier covers up to 25,000 monthly active users and is built to export a tenant to a Keycloak realm file.
What a free tier from an authentication provider usually covers
Most free tiers include hosted sign-in pages, user accounts with passwords, the standard OpenID Connect and OAuth flows and a limited number of applications. The main limit is usually a count of monthly active users, and going past it moves you onto a paid plan. Providers often cap other things as well, such as the number of environments, the volume of sign-in emails or the rate of management API calls.
Features that businesses pay for are often left out of a free tier. Enterprise SSO over SAML, SCIM provisioning, custom domains and a longer audit history are common examples, and multi-factor authentication is sometimes held back too. Checking these details before you build saves you from finding a limit after your users already depend on the product.
How to judge a free authentication provider
Start with the definition of an active user, because it decides how your bill grows later. Some providers count every user who has a session or a token refresh in the month, while others count only users who actually sign in, and the difference can be large for a mobile app where people stay signed in. Check also whether test users in a staging environment count against the same limit as your production users.
Then look at lock-in, which here means how hard it is to leave. A provider that speaks standard protocols keeps your application code portable, but your users' password hashes and MFA settings are the harder part to move. Ask whether the provider lets you export users with their password hashes, because without them every user has to reset a password on the day you switch.
The Skycloak Platform's planned free tier
The Skycloak Platform is Skycloak's own multi-tenant sign-in engine, and its free tier is planned to open in 2027 with up to 25,000 monthly active users. An active user is one who completes an interactive sign-in in a calendar month, so token refreshes on their own do not make a user active. The tier has abuse limits against automated sign-ups and other misuse, and paid plans follow on the same Platform, so growing past the limit does not mean moving to another product.
For leaving, the Platform is built to export a tenant to a Keycloak realm file, which a Keycloak server you run can import. The Platform also uses OpenID Connect, OAuth 2.1 and SAML, so your applications talk to it through the same protocols they would use with another provider. Passkeys, multi-factor authentication and a breached password check are on the plan, and a demo is the place to see which of them have shipped.
Frequently asked questions
Does the free tier end after a set period?
No. The planned free tier is a plan of its own, not a time-limited offer: it covers up to 25,000 monthly active users for as long as your product stays within that number and its abuse limits. Paid plans are there for products that grow past it.
What counts as a monthly active user?
A user who completes an interactive sign-in during a calendar month. Each user counts once in that month however often they sign in, and token refreshes alone do not make a user active.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.