Build vs buy authentication: what you are actually paying for

"Build or buy authentication" is usually framed as a price question. It is really a question about what you want to own for the next five years.

A login form takes a day. Everything around it — MFA, SSO, provisioning, recovery, audits, incidents — is a product that someone has to maintain. This article lays out what each option actually costs.

What "build" really includes

The first version is not the hard part. The full scope is:

• Credential handling: password hashing, policies, breach checks, rate limits.
• MFA: TOTP, WebAuthn/passkeys, recovery codes.
• SSO: SAML and OIDC service-provider implementations, per-tenant configuration, certificate rotation.
• Provisioning: JIT and SCIM, per tenant.
• Sessions: timeouts, device lists, forced logout, refresh.
• Account recovery: the flow that decides your real security level.
• Admin tooling: user search, lockout, impersonation with audit.
• Audit logs: who signed in, from where, what changed.
• Security response: CVEs in your dependencies, advisories, incident drills.

None of these is exotic. Together they are a small product with a permanent on-call rotation.

What "buy" really charges for

Buying moves that list to a vendor, but the pricing models differ sharply:

• Per MAU: cheap at 10,000 users, expensive at 1,000,000.
• Per connection: WorkOS publishes $125 per connection per month for SSO; Auth0 includes one enterprise connection on its free tier and charges for more.
• Platform fee: Okta Customer Identity starts at a $3,000 per month base, with suites and usage quoted separately.
• Flat: Casdoor Cloud is a flat monthly price with unlimited MAU and no per-connection fees.

The model matters more than the sticker: a per-connection price punishes exactly the B2B customers who make you money, and a per-MAU price punishes growth.

Hidden costs on both sides

Building:

• Every new enterprise customer is an integration project.
• Security reviews become your problem: pen tests, questionnaires, incident response.
• Staff turnover takes the knowledge with it.

Buying:

• Migration cost when the pricing model stops fitting.
• Vendor lock-in on user data and configuration.
• Feature gaps you cannot patch yourself.
• Procurement and legal time for each contract.

Self-hosted open source sits between the two: the software is free, but the operations are yours. Managed open source (or a flat-priced cloud) tries to combine a permissive license with someone else's on-call.

A rough decision rule

• Pre-revenue or single-tenant app with simple needs: build, or use a library. The scope is small and the requirements are stable.
• B2B SaaS with enterprise customers: buy or adopt an identity provider. The SSO/SCIM requirements alone justify it.
• Regulated or air-gapped environments: self-host an open-source provider. You need the data to stay inside, and you have the team to run it.
• Consumer app at scale: model per-MAU pricing at 10x your current users before deciding.

The checklist

1. List the protocols and features you need in 24 months, not today.
2. Estimate the per-user or per-connection cost at 10x growth.
3. Count the engineering weeks for the full scope above — including maintenance.
4. Check the license and the exit path: can you export users and configuration?
5. Decide what you want to own: the software, or the operations.

Where the middle ground is

Many teams end up with:

• An open-source identity provider for the protocols and the data.
• Managed hosting for production, so nobody is on call for sign-in.
• A flat price, so the bill does not grow faster than the product.

That is the configuration Casdoor is built for: Apache-2.0 self-hosted, or a managed cloud from $9 per month with unlimited MAU and no per-connection fees.

Related reading: what an authentication platform must include, SSO for SaaS and open-source identity servers.