Build vs buy identity: the honest math

For most teams the answer is buy. Building basic login is not hard; operating it at production quality for years, with passkeys, recovery, enterprise SSO, SCIM, audit logs and compliance evidence, takes more engineering than teams predict. Building makes sense only at very high scale, when identity is your product, or when regulation rules out the vendors. This guide gives the decision table, real list prices at three scales, a way to cost the build side honestly, and the failure modes homegrown identity tends to hit.

Decision table

The cost of "buy": real list prices

These are USD list prices per month for user charges only, taken from vendor pricing pages. Clerk and Amazon Cognito were re-read on November 5, 2026; Supabase and WorkOS are from SWI's live check on October 30, 2026 in the Identity Pricing Transparency Index 2026. They exclude SMS, add-ons, enterprise plans and discounts.

How the numbers are built:

• Cognito Essentials: 10,000 free MAU, then $0.015 per MAU, per its pricing page. Users who sign in through SAML or OIDC federation get only 50 free MAU, then $0.015 each.
• Clerk Pro: $25 a month with 50,000 monthly retained users included, then $0.02 each to 100,000 and $0.018 each to 1,000,000, per its pricing page.
• Supabase Pro: from $25 a month with 100,000 MAU, then $0.00325 per MAU.
• WorkOS AuthKit: free to 1,000,000 MAU, then $2,500 a month per additional million. Enterprise SSO and directory sync are $125 per connection (1 to 15).

Two lessons. First, the spread at 1,000,000 users runs from $0 to over $17,000 a month in user charges, so "vendors are too expensive at scale" depends entirely on which vendor and which unit. Second, for B2B products the connection line often matters more than the user line; see the worked example in how to evaluate a CIAM vendor and the SSO tax entry.

Most of the market does not publish prices at all. The Identity Pricing Transparency Index 2026 found that only 28% of 295 identity vendors still on sale (82) publish a price for any paid tier, and 54% are quote-only. CIAM is one of the more transparent categories.

The honest cost of "build"

There is no credible universal number for build cost, so price it from your own inputs. List the work, estimate engineer-months, and multiply by your fully loaded cost per engineer.

Version 1 scope (before you can launch):

• Sign-up, sign-in and secure credential storage, or passwordless with passkeys built on WebAuthn
• MFA and a safe account recovery flow
• Sessions, refresh tokens and revocation; OAuth 2.0 and OpenID Connect if other apps or APIs consume your tokens
• Rate limiting, bot defense and breached-password checks against credential stuffing

Before the first enterprise deal:

• Enterprise SSO over SAML 2.0 and OIDC, per customer, with a self-serve setup flow
• SCIM 2.0 provisioning and deprovisioning
• Organization and role models, admin console, audit log export
• Evidence for SOC 2 access controls

Every year after:

• Security patches, dependency and library upgrades, protocol changes
• On-call for the login path, which is down whenever you are down
• Penetration tests and incident response for the identity tier
• New factor types and standards (passkey changes, new OAuth profiles)

Then add the ongoing share of an engineer, not just the build months. Put both sides into the build vs buy tool and the TCO calculator.

When to actually build

• You are a hyperscale consumer platform where negotiated vendor pricing still breaks your unit economics
• Your product is itself an identity platform (vendors selling to other developers)
• You have a regulatory environment that prohibits the available vendors
• You have an in-house security and platform engineering team that operates production identity systems already

When to buy

• Everyone else
• Especially: anyone who hasn't yet shipped v1
• Especially: anyone whose product is not "identity"
• Especially: anyone planning to chase SOC 2 in the next 18 months

The middle path: open source self-hosted

For teams uncomfortable with vendor lock-in but unable to justify a full custom build, consider self-hosted open-source identity: Keycloak, FusionAuth (Community edition, self-hosted, unlimited) or SuperTokens (unlimited users self-hosted; $0.02 per MAU on its managed cloud). There is no licence fee and the code is portable. The operational cost is real but bounded: you own patching, upgrades, high availability, backups and monitoring. See the top open-source CIAM platforms.

Failure modes of homegrown identity

The common failures are not exotic cryptography. They are recovery paths, missing MFA and unprotected endpoints, which vendors handle by default and in-house teams add late.

Step-by-step: making the call

1. Forecast active users at 12, 24 and 36 months, and the number of enterprise customers needing SSO or SCIM.
2. Price two or three vendors at those points from their pricing pages, including connection fees.
3. List the build scope above and estimate engineer-months for v1 and ongoing work.
4. Multiply by your loaded engineering cost and compare over three years.
5. Add risk: what a takeover incident or login outage would cost you.
6. If you buy, design for exit: confirm password hash export and import limits before signing.

Common pitfalls

• Building because of "vendor lock-in concerns" without quantifying the switching cost
• Underestimating the long tail (account recovery, edge cases, support burden)
• Counting only the visible engineering work, not security/compliance/SDK maintenance
• Comparing free-tier headlines without checking what each vendor counts as an active user
• Building without designing for migration to a vendor later

For the market view, see the best CIAM for startups and best CIAM platforms rankings.