How to Choose a CIAM Platform in 2026: Decision Framework
To choose a CIAM platform, decide the architecture before you compare features: who your users are (consumers, business customers or both), whether you need a full platform or an overlay on login you already run, SaaS or self-hosted, and which compliance and residency limits are fixed. Those four answers usually cut the field of CIAM vendors from thirty to three. A CIAM choice is harder to reverse than a workforce IAM one, because your customers feel the migration.
This page is the decision framework. For the tests to run once you have a shortlist, use how to evaluate a CIAM vendor; for the build-or-buy question itself, see build vs buy identity.
Shortlist by situation (November 2026)
| Your situation | CIAM platforms to start with | Ranking to read |
|---|---|---|
| Consumer app at large scale, fraud matters | Auth0 (Okta), Transmit Security, Ping Identity, SAP Customer Data Cloud | Best CIAM for high scale |
| B2B SaaS selling to enterprises | WorkOS, Frontegg, Auth0, Descope | Best CIAM for B2B SaaS |
| Startup, developer-led, needs a free tier | Clerk, Stytch, Kinde, Supabase Auth | Best CIAM for startups |
| Already on a hyperscaler | Microsoft Entra External ID, Amazon Cognito, Google Identity Platform | Best CIAM platforms |
| Regulated: healthcare, finance, public sector | Auth0, Ping Identity, Curity (FAPI, open banking) | Compliant CIAM platforms, healthcare, fintech |
| Must self-host or keep data in your own region | Keycloak, FusionAuth, Zitadel, Ory | Top open-source CIAM platforms |
| Passwordless first | Stytch, Auth0, Transmit Security, Descope | Best passwordless CIAM providers |
Decision 1: B2C, B2B or both
The two shapes need different features. B2C needs sign-up conversion, social login, progressive profiling, consent and bot defence at millions of users. B2B needs organizations (tenants), per-customer SAML and OIDC connections, SCIM provisioning, delegated admin and audit logs your customers can see. Platforms that do both well are rarer than their marketing suggests; B2B vs B2C CIAM covers the split.
Decision 2: overlay or full platform
If your product already has working authentication and the only gap is enterprise SSO and SCIM for procurement, an overlay such as WorkOS or SSOJet adds those features without touching what you have. If you are building or replacing authentication itself, evaluate full platforms such as Auth0 or Frontegg. Getting this fork wrong is the most common reason teams re-platform within a year.
Decision 3: SaaS, self-hosted or library
| Model | You get | You give up | Examples |
|---|---|---|---|
| Managed SaaS | Fastest start, provider runs availability and patching | Data location control, some customization | Auth0, Clerk, Descope, Stytch |
| Self-hosted product | Full control of data and deployment | You run, scale and secure it | Keycloak, FusionAuth, Zitadel |
| Auth library in your code | No vendor, no MAU bill | You own every security fix | Better Auth, Auth.js |
Ownership changes matter here. Vercel acquired Better Auth on 7 July 2026 (the library stays MIT licensed), and Auth.js joined the Better Auth project in September 2025. Stytch has been part of Twilio since 14 November 2025. Auth0 is part of Okta. Ask any vendor what an acquisition would mean for your contract; see identity acquisitions.
Decision 4: compliance and residency
Write down SOC 2, ISO 27001, HIPAA (a signed BAA), PCI DSS and data residency needs, and check each against the exact product and region you will buy. A platform that fits well in general can still fail on one residency constraint. If you will accept government digital ID wallets, check support for OpenID4VP (1.0 Final, July 2025), since EU member states must offer EUDI wallets by the end of 2026.
Decision 5: price at your real volume
CIAM pricing comes in incompatible shapes, so compare at your 24-month numbers. Free tiers verified on 30 October 2026 in the Identity Pricing Transparency Index 2026:
| Platform | Free tier | First paid step |
|---|---|---|
| WorkOS AuthKit | 1,000,000 MAU | SSO and Directory Sync $125 per connection |
| Clerk | 50,000 monthly retained users | Pro $25/month |
| Microsoft Entra External ID | 50,000 MAU | Pay as you go |
| Auth0 | 25,000 MAU | Essentials from $35/month (B2C) or $150/month (B2B) |
| Stytch | 10,000 MAU | Pay as you go; SSO/SCIM $125 per connection beyond 5 |
| Amazon Cognito | 10,000 MAU | Essentials $0.015 per MAU |
| Descope | 7,500 MAU | Pro from $249/month annual |
| Strivacity | None | From $17,000/year |
The median of the 16 MAU-based free tiers is 17,750 MAU. Read each vendor's definition of "active": Clerk counts retained users, Zitadel and Ory count daily actives. For B2B, the per-connection line often outgrows the user line. Model it in the TCO calculator and see CIAM pricing models explained.
Decision 6: the standards you need now and next
Require OpenID Connect and OAuth 2.0 with the RFC 9700 security practices, SAML 2.0 for enterprise customers, and passkeys on WebAuthn Level 3 (W3C Recommendation, 25 August 2026). If AI agents will act on behalf of your users, ask about MCP authorization (revision 2026-07-28) and OAuth 2.1, still an IETF draft.
Decision 7: the failure modes you are buying protection from
- Credential stuffing. 23andMe, Roku and Chick-fil-A (13,322 loyalty accounts in June 2026) all lost customer accounts to reused passwords. Test bot detection, breached-password checks and passkey enrolment (credential stuffing, account takeover prevention).
- Weak recovery. Coinbase customers lost funds through an SMS account recovery flaw. Check what recovery requires once passwords are gone.
- Unauthenticated APIs. Attackers enumerated about 33 million phone numbers tied to Authy accounts through an unauthenticated endpoint. Ask how the vendor protects its own lookup and sign-up APIs.
- The provider's support systems. Okta's 2023 support system breach exposed customer session tokens in uploaded HAR files (session cookie theft).
Shortlist, pilot, decide
Narrow with the vendor selector and capability checker, then pilot the top two against a real enterprise customer's identity provider and a slice of real consumer traffic. As a practitioner estimate, budget two to four weeks per pilot. Before signing, confirm you can export users and password hashes; the CIAM migration guide shows what leaving costs. Head-to-heads worth reading: Auth0 vs Clerk, Auth0 vs Stytch, Descope vs WorkOS, WorkOS vs Frontegg and FusionAuth vs Keycloak. Browse all CIAM platforms, the best CIAM for enterprises and best SSO and SCIM platforms for B2B SaaS.
Frequently asked questions
- How do I choose a CIAM platform?
- Make four architectural decisions before any demo: who your users are (B2C, B2B or both), whether you need a full platform or an overlay on existing login, SaaS or self-hosted, and your compliance and residency limits. Then model price at your 24-month volume, check ownership and portability, and pilot the top two against a real customer's identity provider.
- Who are the leading CIAM vendors?
- Auth0 (Okta), Microsoft Entra External ID, Amazon Cognito, Google Identity Platform, Ping Identity, Transmit Security, SAP Customer Data Cloud and Salesforce Identity for large consumer and enterprise programs; Clerk, Descope, Stytch (Twilio since November 2025), Kinde and FusionAuth for developer-led teams; WorkOS and Frontegg for B2B SaaS; and Keycloak, Zitadel, Ory and Supabase Auth if you want open source.
- What is the difference between a CIAM overlay and a full CIAM platform?
- An overlay such as WorkOS or SSOJet adds enterprise SSO and SCIM to a product that already has working authentication, without touching it. A full platform such as Auth0 or Frontegg runs authentication itself as well as those enterprise features. Pick an overlay when the only gap is enterprise procurement requirements, and a full platform when you are building or replacing login.
- What is the best CIAM for B2B SaaS?
- One with native multi-tenancy (organizations), per-customer SAML and OIDC connections, SCIM provisioning and an admin portal your customers can self-serve. WorkOS, Frontegg, Auth0, Descope and Stytch are common shortlists. Check how each prices enterprise connections, because at a dozen enterprise customers the connection line can exceed the user line.
- Which CIAM platforms have a free tier?
- Most developer-focused ones. Verified on 30 October 2026: WorkOS AuthKit free to 1,000,000 MAU; Clerk to 50,000 monthly retained users; Firebase Authentication, Supabase Auth, Logto and Microsoft Entra External ID to 50,000 MAU; Auth0 to 25,000; Kinde to 10,500; Stytch, Amazon Cognito, PropelAuth and Hanko to 10,000; Descope and Frontegg to 7,500; SuperTokens managed cloud to 5,000.
- How do I compare CIAM pricing across providers?
- Model your own volume over 24 months instead of comparing list prices. CIAM vendors bill per monthly active user, per retained or daily active user, per enterprise connection, or by flat platform tier, so prices are not comparable until you plug in your numbers. Read each vendor's definition of an active user and where retail plans cap enterprise connections.
- Why is switching CIAM platforms riskier than switching workforce IAM?
- Because your customers feel the migration, not just your employees. A failed cutover can lock paying users out or force mass password resets. Before you sign, check the export formats for users and password hashes and how well the platform supports open standards, so you know how you would leave.
- How should I pilot a CIAM platform?
- Narrow the field to two candidates, then pilot both against a real enterprise customer's actual identity provider and a real slice of consumer traffic rather than a vendor demo environment. That exposes federation quirks, attribute mapping, SCIM behaviour and bot defence gaps that demos hide.
Related on Start with Identity
- GuideHow to Choose an IAM Platform in 2026: A Buyer's Checklist
To choose an IAM platform, map your users, applications and their protocols first, then score candidates on lifecycle depth, admin security and honest three-yea
- GuideHow to Choose an IGA Platform in 2026
To choose an IGA platform, decide which governance outcomes you need, prove connectors against your worst applications, check 2026 ownership and get a comparabl
- GuideHow to Choose a PAM Solution in 2026: A Buyer's Checklist
To choose a PAM solution, count your standing privileged access first, decide whether you need vault-first PAM or infrastructure access, then test ownership, pa
- GlossaryCIAM
CIAM (customer identity and access management) is the sign-up, login, profile and consent layer for an application's customers, not the IAM system that manages
- ArticleCIAM Journey Orchestration Explained: No-Code Auth Flows and Their Limits
Identity orchestration lets teams design login, signup, verification, and step-up journeys as configurable flows instead of hard-coded logic. This guide explain
- ArticleCIAM vs IAM: Key Differences and When You Need Each
CIAM and IAM both manage identity, but they solve opposite problems. This guide explains the differences in users, scale, priorities, and architecture, and how