Auth0
- Free allowance
- Free plan: up to 25,000 monthly active users, unlimited social connections, 5 organizations, 1 enterprise connection, 1,000 machine-to-machine authentications, 1 tenant and 3 admins; no credit card needed to sign up
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailno card, phone unknown
- Binding limit
- request-rateAuthentication API: 300 burst, 300 requests per minute sustained; Management API: 2 burst, 2 requests per second sustained; Get Token (/oauth/token): 30 requests per second
- Evidence
- documented40 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-03checked 2026-11-02 (live); stale on 2026-12-03
| Free tier | Free plan: up to 25,000 monthly active users, unlimited social connections, 5 organizations, 1 enterprise connection, 1,000 machine-to-machine authentications, 1 tenant and 3 admins; no credit card needed to sign up unit users; metered on identity-count; An MAU is a non-internal user that authenticated during a month for a given tenant. The Free plan is the same for B2C and B2B. It includes 1 custom domain, which needs credit card verification, and 5 Actions + Forms. Pro MFA factors and role management are not available on Free. Each account holds one free tenant at a time. |
|---|---|
| Price | none stated |
| Limits |
|
| Binding | request-rate The Management API takes 2 requests a second on Free, so any bulk user administration is slow; sign-ins share the Authentication API's 300 requests a minute. |
| Identity | email The sign-up page asks for an email address, or a GitHub, Google or Microsoft sign-in, and states no credit card is required. After registration a profile page asks for an Account Type when the email domain is not a corporate one or for a Role when it is, and the user is asked to create a tenant, which takes a tenant name and a region. A custom domain needs credit card verification. Whether a later step asks for a phone number is unverified: behind a sign-up. |
| Egress | not applicable: an authentication API; no traffic allowance or egress term is published |
| Per-object cap | Auth0 states a user profile size limit of 10 KB, and writes over it succeed for now but may start to fail; user_metadata set through the Authentication API Signup endpoint takes at most 10 string fields of at most 500 characters each |
| Retention | Tenant logs are kept 1 day on Free; a Free tenant with no admin login, user login or API call for 150 days is deleted with all its data and cannot be recovered (1 days) |
| Interface | rest Authentication API (OAuth 2.0 and OIDC endpoints such as /oauth/token and /userinfo) and Management API v2 at https://{tenant}/api/v2/ with a Bearer token; both are served on the tenant's own domain. endpoint: https://{tenant}/api/v2/ |
| Tooling | Any HTTP client or OAuth 2.0 / OIDC library against the tenant's Authentication API and Management API v2. |
| Composes with | An OIDC identity provider in front of apps on free compute; user import is included on Free, so users can be moved in through the Management API. |
| Reliability | A Free tenant inactive for 150 days is deleted and cannot be recovered; Free support is community only. |
| Notes | Essentials starts at USD 35 a month for 500 MAUs (B2C); paid plans add role management, MFA factors and longer log retention. |
| Evidence note | documented Every limit is quoted from the first-party pricing page, rate-limit policy, data processing page, support article and sign-up page. No probe was run, because the API is served on a per-tenant domain. A token request on a Free tenant would move it to measured. |
| Parsed numbers |
|
Evidence 40
| date | source | what it proved |
|---|---|---|
| 2026-10-30 | auth0.com/pricing | the Free plan is USD 0 with up to 25,000 MAUs |
| 2026-10-30 | auth0.com/pricing | the Free plan needs no credit card to sign up |
| 2026-10-30 | auth0.com/pricing | an MAU is a non-internal user that authenticated in a month for a tenant |
| 2026-10-30 | auth0.com/pricing | the Free plan is the same for B2C and B2B, 25,000 MAUs, no card |
| 2026-10-30 | auth0.com/pricing | Free includes 1,000 machine-to-machine authentications |
| 2026-10-30 | auth0.com/pricing | Free includes 5 organizations |
| 2026-10-30 | auth0.com/pricing | Free includes 1 enterprise connection |
| 2026-10-30 | auth0.com/pricing | Free has unlimited social connections |
| 2026-10-30 | auth0.com/pricing | Free includes 1 tenant |
| 2026-10-30 | auth0.com/pricing | Free has 3 admins |
| 2026-10-30 | auth0.com/pricing | Free keeps logs 1 day |
| 2026-10-30 | auth0.com/pricing | a custom domain needs credit card verification |
| 2026-10-30 | auth0.com/pricing | Free includes 5 Actions + Forms |
| 2026-10-30 | auth0.com/pricing | Pro MFA factors are not available on Free |
| 2026-10-30 | auth0.com/pricing | role management is not available on Free |
| 2026-10-30 | auth0.com/pricing | part of the text of Composes with, above |
| 2026-10-30 | auth0.com/pricing | standard support is not available on Free |
| 2026-10-30 | auth0.com/pricing | part of the text of Notes, above |
| 2026-10-30 | auth0.com/docs/troubleshoot/customer-support/operational-pol | the Authentication API allows a 300 burst and 300 a minute on Free |
| 2026-10-30 | auth0.com/docs/troubleshoot/customer-support/operational-pol | the Management API allows 2 a second on Free |
| 2026-10-30 | auth0.com/docs/troubleshoot/customer-support/operational-pol | the token endpoint allows 30 a second |
| 2026-10-30 | support.auth0.com/center/s/article/tenant-unban-request | free tenants inactive for 150 days are deleted |
| 2026-10-30 | support.auth0.com/center/s/article/tenant-unban-request | a deleted tenant cannot be recovered |
| 2026-10-30 | support.auth0.com/center/s/article/tenant-unban-request | one free tenant per account at a time |
| 2026-10-30 | auth0.com/docs/secure/data-privacy-and-compliance/data-proce | inactive Free customers' tenants and data are scheduled for deletion after 150 days |
| 2026-10-31 | auth0.com/signup | the sign-up page states no credit card is required |
| 2026-10-31 | auth0.com/signup | the sign-up asks for an email address |
| 2026-10-31 | auth0.com/signup | the sign-up offers GitHub sign-in |
| 2026-10-31 | auth0.com/signup | the sign-up offers Google sign-in |
| 2026-10-31 | auth0.com/signup | the sign-up offers Microsoft sign-in |
| 2026-10-31 | auth0.com/docs/api/management/v2 | the Management API is served at /api/v2 on the tenant domain with a Bearer token |
| 2026-11-01 | auth0.com/docs/manage-users/user-accounts/metadata/metadata- | Auth0 states a 10 KB user profile size limit, and writes over it succeed for now but may start to fail |
| 2026-11-01 | auth0.com/docs/manage-users/user-accounts/metadata/metadata- | the Management API List and Search Users endpoints index, query and return at most 1 MB of data per user |
| 2026-11-01 | support.auth0.com/center/s/article/auth0-prompts-for-account | after registration the profile page prompts for an Account Type when the email domain is not corporate |
| 2026-11-01 | support.auth0.com/center/s/article/auth0-prompts-for-account | after registration the profile page prompts for a Role when the email domain is corporate |
| 2026-11-01 | auth0.com/docs/get-started/auth0-overview/create-tenants | after the account is created the user is asked to create a tenant |
| 2026-11-01 | auth0.com/docs/get-started/auth0-overview/create-tenants | a tenant takes a name and a region |
| 2026-11-01 | auth0.com/docs/manage-users/user-accounts/metadata/metadata- | user_metadata set through the Authentication API Signup endpoint takes at most 10 string fields of at most 500 characters each |
| 2026-11-01 | auth0.com/docs/api/authentication | the Authentication API supports the OpenID Connect and OAuth 2.0 identity protocols |
| 2026-11-01 | auth0.com/signup | the sign-up page asks for an email address first, with GitHub, Google and Microsoft sign-in as alternatives |