How to evaluate a CIAM vendor without falling for the demo

The fastest way to evaluate a CIAM vendor is to ignore the demo and test four things on a trial tenant: what you will pay at two and ten times today's active users, how you get every user (with password hashes) back out, how the recovery and account takeover paths behave under attack, and what the contract says when it breaks. For a shortlist first, see how to choose a CIAM platform.

What the demo will not tell you

Demos show the happy path. They skip pricing above 1M MAU, data export, the cost of custom auth flows, and how the vendor responds to a production failure at 3 AM.

The eight questions to actually ask

1. What is the per-MAU cost at 10K, 100K, 1M, and 10M MAU? Get this in writing, with the vendor's definition of an active user.
2. What is the data export format and how do I get my users out? Test it on the trial account, including password hashes and MFA enrollments.
3. What is the SLA, and what's the historical uptime? Ask for the last 12 months of status page data and the credit terms.
4. How long has the current SDK version been the recommended one? SDK churn signals broader product instability.
5. What does support response look like at our tier? Not the marketing answer, the contractual one.
6. Show me an audit log entry and the API to query it. Real screen, real data, and the retention period.
7. What's the migration story if I move to you, and what if I move away? Both directions matter.
8. Who else in our segment is using you, and can I talk to them? Two reference calls minimum.

Scorecard

Weight the criteria to your product; B2C and B2B buyers should not score vendors the same way.

Pricing: read the unit, not the headline

Every row in SWI's Identity Pricing Transparency Index 2026 was read from the vendor's own pricing page on October 30, 2026, and the CIAM rows show why the headline free tier misleads.

• "Active" differs. Clerk bills monthly retained users, meaning a user who returns at least a day after signing up, per its pricing page. Zitadel and Ory count daily actives, Logto bills tokens, and Stytch counts AI agents alongside users.
• Bands round up. The index notes that on Auth0's published plans, usage between MAU bands is billed at the next band up.
• Federated users cost differently. Amazon Cognito gives 10,000 free MAU for direct sign-in on Lite and Essentials, but only 50 free MAU for users who sign in through SAML or OIDC federation, then $0.015 each, per its pricing page.
• B2B costs come from connections. WorkOS lists $125 per SSO or directory connection (1 to 15), Clerk lists one connection included on paid plans and $75 each for 2 to 15, and SSOJet lists $59 per connection per month on annual billing.

Worked example (list prices, USD per month, before add-ons): a B2B app with 100,000 active users, all signing in directly, and 10 enterprise SSO customers.

The products are not equivalent; the cheapest line depends on whether your cost driver is users or connections. Rerun the numbers at your two-year forecast in the TCO calculator, and read CIAM pricing models explained and the SSO tax entry before you negotiate.

Test portability before you sign

Exit is where lock-in shows. Two concrete examples from Auth0's documentation:

• Auth0 says all tenant data is available through the Management API except the password hashes of its database users and private keys, which you request through a support ticket. The option is not available on the Free tier, and Auth0 does not guarantee a specific date.
• Coming in, Auth0's bulk user import accepts existing password hashes in supported algorithms, but files are capped at 500KB (roughly 1,000 users with light metadata), a tenant can run two import jobs at once, and jobs time out after 2 hours. Users with unsupported hash algorithms must reset at first login.

Ask every finalist in writing how hashes and MFA enrollments come out, and what the import limits are. See the CIAM migration guide for lazy (on-login) migration patterns.

What to test in trial

• Performance under burst load (sign-in spikes at 9 AM)
• The recovery flow when an authenticator is lost, and whether it falls back to SMS alone
• An email change
• Passkey enrollment and sign-in across platforms; compare factor support in the MFA matrix and the Phishing-Resistant MFA Matrix 2026
• A scripted credential stuffing run against your own trial tenant, to see rate limits and bot detection fire
• The audit log for a sequence of normal user actions

Failure modes real breaches exposed

See CIAM account takeover prevention.

Step-by-step evaluation plan

1. Write one scope sheet (peak actives, B2B customers, SMS volume by country, regions, test tenants) and send it to every vendor.
2. Shortlist three to four vendors from the CIAM rankings or the segment rankings for startups and B2B SaaS.
3. Get unit prices and overage rules in writing at current, 2x and 10x volume.
4. Run the trial tests, a hash export and a 1,000-user import on each tenant.
5. Hold the reference calls, including one you found yourself.
6. Score with the table above, then negotiate renewal caps and true-up terms.

Common pitfalls

• Buying based on developer experience alone, ignoring operational fit
• Underestimating the cost of customer SSO support requests
• Choosing a vendor that won't scale to where you'll be in 24 months
• Skipping data export evaluation until lock-in is already happening
• Trusting the vendor's reference customers without finding your own

Useful internal links

For the universe of options, see our vendor profiles and head-to-head comparisons, including Auth0 vs Clerk, Auth0 vs Stytch and Auth0 vs WorkOS. If you are still deciding whether to buy at all, read build vs buy identity.