Short answer
As of October 2026, Clerk is the cheaper pick for a new Next.js or React SaaS: 50,000 free retained users per app, MFA on the $25-a-month Pro plan, and free workspaces up to 100 organizations. Auth0 costs more as you grow (MFA starts at $35 a month for 500 users and $700 at 10,000) but offers data regions outside the US, ISO 27001, and Token Vault for agents that act in other apps on a user's behalf. Both can act as the OAuth server for an MCP server.
Key takeaways
- Clerk's free plan counts retained users (50,000 per app); Auth0's counts monthly active users (25,000).
- Neither free plan includes MFA: Clerk Pro is $25 a month, Auth0 B2C Essentials is $35 a month at 500 users and $700 at 10,000.
- Clerk includes 100 free workspaces; Auth0 needs a B2B plan, from $150 a month, for unlimited organizations.
- Both handle MCP server auth; Auth0 adds Token Vault and async approval for agents acting in other apps, as a 50% add-on.
- Clerk exports password hashes from the dashboard; Auth0 requires a support ticket and a signed form.
If you're building a SaaS app in Next.js that needs sign-in, workspaces with owners and members, and AI agents that connect to it, this post is for you. Cosmic runs custom production apps on Clerk, and we compared it with Auth0 on the things that decide the bill and the build: what the free plan counts, what workspaces and SSO cost, how each handles agents, and how hard it is to leave.
Written in October 2026. Prices and features are taken from each vendor's pricing page and docs that month. Both companies changed their plans this year, so check the pricing pages before you commit.
| Clerk | Auth0 | |
|---|---|---|
| Free plan | 50,000 retained users per app | 25,000 active users |
| MFA on the free plan | No (Pro, $25/month) | No (Essentials, from $35/month) |
| First paid plan | Pro, $25/month, then $0.02 per user past 50,000 | B2C Essentials, $35/month at 500 users, $700 at 10,000 |
| Workspaces (organizations) | 100 free; custom roles in a $100/month add-on | 5 free, 10 on B2C paid plans, unlimited on B2B plans from $150/month |
| Enterprise SSO | 1 connection on paid plans, then $75/month each | 1 on Free, 3 to 5 on B2B plans, then $100/month each |
| Sign-in UI | Components inside your app | Hosted Universal Login page |
| MCP server auth | OAuth server for MCP, documented for Next.js | Auth for MCP, generally available since May 2026 |
| Agents calling other APIs for a user | Build it yourself | Token Vault and async approval, in a 50% add-on |
| Data regions | US only | US, EU, UK, Japan, Australia, Canada |
| Export with password hashes | Self-serve CSV from the dashboard | Support ticket with a signed form |
Clerk is cheaper at startup scale
The free plans count users differently. Clerk's 50,000 retained users per app (since February 2026) skips anyone who signs up and never returns. Auth0's 25,000 active users counts every sign-in that month.
Neither free plan includes MFA. On Clerk, Pro is $25 a month ($20 billed annually) and adds MFA, passkeys and branding removal. On Auth0, MFA starts with B2C Essentials at $35 a month for 500 users, rising to $700 a month at 10,000 users.
For an app with 10,000 users that needs MFA, that's $25 a month on Clerk against $700 on Auth0.
Workspaces and SSO cost more on Auth0
Most B2B apps need workspaces with an owner, members and invitations. Clerk Organizations are on every plan, including free, up to 100 retained organizations with 20 members each. Custom roles, unlimited members and verified domains need the B2B Authentication add-on at $100 a month. We built secure workspace invites on Clerk with the built-in Admin and Member roles alone.
Auth0 gives the free plan 5 organizations and B2C paid plans 10. Unlimited organizations come with the B2B plans, which start at $150 a month for 500 users (Essentials) and $800 (Professional).
Enterprise SSO follows the same pattern. Clerk includes one SAML or OIDC connection on paid plans and charges $75 a month for each one after that. Auth0 includes one on Free and three or five on B2B plans, then $100 a month each. Clerk's Directory Sync (SCIM) went generally available in April 2026, and Auth0 includes inbound SCIM on its free plan.
AI agents: Clerk covers MCP, Auth0 goes further
Both can now act as the OAuth server for an MCP server, so an agent like Claude or ChatGPT gets its own scoped token to your app. Clerk documents this for Next.js and added client ID metadata documents (CIMD) and the OAuth device flow in September 2026. Auth0's Auth for MCP went generally available in May 2026 and is included on all plans.
Auth0 goes further when your agent acts in other apps for a user. Token Vault stores and refreshes each user's Google, GitHub or Slack tokens for the agent, and async authorization asks the user to approve a risky action on their phone. Clerk has neither, so you'd build that part yourself. Auth0's pricing page lists these as the "Auth0 for AI Agents" add-on at 50% on top of the base plan.
Saad's view: "When MCP is table stakes for building apps in 2026 and BYO-agent is the approach users want in their agentic app experiences, you can't risk brittle, silently failing auth for your app."
Auth0 wins on regions and compliance
Clerk runs in the US only, with no region choice. Its SOC 2 report needs the $300-a-month Business plan and a HIPAA BAA needs Enterprise. Auth0 lets you pick a US, EU, UK, Japan, Australia or Canada region per tenant, offers a private cloud on AWS or Azure, and holds ISO 27001 as well as SOC 2. If your buyers require EU data residency or ISO 27001, that decides it.
Leaving is easier from Clerk
Clerk exports your users as a CSV from the dashboard, password hashes and TOTP secrets included. Auth0's bulk export leaves out password hashes. To get them, you open a support ticket with a PGP key and an acknowledgment signed by an executive. Plan your exit before you pick, since a missing hash export means every user resets their password on the way out.
Auth0 is built for the enterprise, Clerk for speed
Saad's view: "Auth0 is great for heavy enterprise use cases, customizable serverless options, and is built for large-scale enterprises that need every possible variation of auth configuration: SCIM, SAML, ISO 27001, HIPAA, etc."
"The downside of enterprise grade is for a small, fast-moving startup that needs to move fast, have polished front-end experiences out of the box, integration with React and Next, and sensible defaults. Clerk is the no-brainer option."
That matches our builds. On Clerk, sign-in worked a day after the first commit on our talent marketplace, and the agent work coordinator moved its agents to Clerk OAuth for its MCP server. The rough edges were at the seams. When sign-up depended on Clerk's emailed codes, we sent them through Resend instead. The full numbers are in Clerk vs. rolling your own auth.
Which to pick
| If your app... | Pick |
|---|---|
| Is a new Next.js or React SaaS under 50,000 users | Clerk |
| Needs workspaces with an owner and members on a startup budget | Clerk |
| Lets people connect AI agents through MCP | Either; both act as the OAuth server |
| Has agents that act in Google, Slack or GitHub for each user | Auth0, for Token Vault and async approval |
| Sells to buyers who need EU data residency or ISO 27001 | Auth0 |
| Needs many enterprise SSO connections from day one | Price both; Clerk's add-ons are cheaper per connection |
| Needs SCIM, SAML, HIPAA and custom flows across a large enterprise | Auth0 |
Some teams leave both for an open-source library such as Better Auth or Auth.js to own their users and avoid per-user bills. That puts sessions, password storage and security fixes back on your team. On our one app with hand-built auth, that work took 3,339 lines and about 45 security tickets.
Authentication is one of the first things we check when we take an AI-built app to production. If you're choosing an auth provider for a new app, or moving off one, schedule a call.
FAQ
Is Clerk cheaper than Auth0?
At startup scale, yes. As of October 2026, an app with 10,000 users that needs MFA pays $25 a month on Clerk Pro and $700 a month on Auth0 B2C Essentials. Clerk also counts only users who return after their first day.
Does Clerk or Auth0 support MCP servers?
Both do. Clerk documents using Clerk as the OAuth server for an MCP server in Next.js, and Auth0's Auth for MCP has been generally available since May 2026 on all plans.
Which is better for AI agents, Clerk or Auth0?
For agents that sign in to your own app through MCP, either works. For agents that act in Google, Slack or GitHub on a user's behalf, Auth0's Token Vault and async authorization cover what you would otherwise build yourself, priced as an add-on of 50% on top of the base plan as of October 2026.
Can I keep my users' passwords if I leave Clerk or Auth0?
Clerk exports users with password hashes as a CSV from the dashboard. Auth0's bulk export leaves hashes out; you request them through a support ticket with a PGP key and an executive-signed acknowledgment.
Sources
- Clerk pricing (October 2026)
- Clerk: pricing explained (MRU, February 2026 change)
- Auth0 pricing (October 2026)
- Clerk docs: build an MCP server in Next.js
- Auth0 blog: Auth for MCP generally available (May 2026)
- Auth0 blog: Auth0 for AI Agents generally available (November 2025)
- Clerk security and compliance
- Auth0 docs: data privacy and compliance
- Clerk changelog: export users with password hashes
- Auth0 docs: export password hashes and MFA secrets
Founder of Cosmic. Nearly 15 years in strategy, management and sales as a digital strategist, director of sales and product manager. He closed over $25M in new revenue at VMware Pivotal Labs, launched digital products at Capital One, and helped Viget grow from 30 to 75 people. He started Cosmic and built the Revenue Design® process after advising friends whose companies struggled to close deals and keep revenue steady.