This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 1, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
Firebase Authentication is one of the fastest ways to add login to a mobile or web app: a few lines of SDK code, social providers out of the box, and a free tier of 50,000 monthly active users. For a consumer app that fits the Firebase ecosystem, it is hard to beat on time-to-first-login.
Teams start looking for alternatives at a predictable set of moments: the first enterprise customer asks for SAML, the security team asks where the user data lives, or the bill at 500,000 MAU stops being trivial. This article compares the realistic options.
Why teams leave Firebase Auth
- No self-hosting. Firebase is a managed Google service. If the data cannot leave a region, or the product must run in a private network, it is out.
- Enterprise SSO is metered. The free tier includes a small SAML/OIDC allowance (50 MAU) and then charges per federated user, which is the wrong curve for a B2B product whose customers all arrive with their own identity provider.
- Vendor lock-in. Users, password hashes and MFA enrollments live in Firebase. Exporting profiles is possible; moving credentials is not trivial.
- Customization limits. Branding, custom claims and multi-tenancy exist, but the further you go from the default flow, the more you fight the platform.
- One cloud. Firebase means Google Cloud. Teams standardized on AWS or Azure usually prefer an identity layer that is not tied to a second cloud.
The options
| Option | Model | Free tier | Enterprise SSO | Self-host |
|---|---|---|---|---|
| Keycloak | Open source | Unlimited | Yes | Yes |
| Casdoor | Open source + managed cloud | Unlimited self-hosted; cloud from $9 / month | Yes | Yes |
| Auth0 | Managed | 25,000 MAU, 1 enterprise connection | Paid per connection | No |
| Amazon Cognito | Managed AWS service | 10,000 MAU (Lite / Essentials) | 50 federated MAU, then metered | No |
| Supabase Auth | Managed Postgres platform | 50,000 MAU | Not on the free plan | Self-hostable, with effort |
| Microsoft Entra External ID | Managed | 50,000 MAU / month | Yes | No |
| Zitadel | Open source + managed cloud | 100 daily active users on cloud | Yes | Yes |
| Logto | Open source + managed cloud | 50,000 MAU, 3 applications | Paid add-on | Yes |
| authentik | Open source | Unlimited | Yes | Yes |
Figures are from each vendor's pricing page as of November 2026; free tiers change, so verify before committing.
Keycloak and Casdoor: the self-hosted route
If the reason for leaving is control, these are the two open-source options that matter. Both are Apache-2.0 and speak OIDC and SAML.
- Keycloak is the reference implementation with the largest ecosystem and a long enterprise track record. The cost is operational: upgrades, database, backups and high availability are your team's job.
- Casdoor is smaller but covers the same protocols plus CAS and SCIM, with 75+ social providers, MFA and passkeys, and a managed cloud starting at $9 per month with unlimited MAU. It is the option when you want a flat bill instead of per-MAU pricing.
For a deeper comparison, see Casdoor vs Keycloak and Keycloak alternatives.
Auth0 and Entra External ID: managed, per-user
Auth0 is the most complete managed CIAM product, with the largest integration catalogue. Its free tier covers 25,000 MAU but only one enterprise connection; business customers usually mean per-connection fees.
Microsoft Entra External ID is the successor to Azure AD B2C and the natural choice if you are already on Azure. Both are managed only, priced per MAU beyond the free allowance.
Cognito and Supabase: tied to a platform
Cognito is convenient if you are on AWS, and its free tier covers 10,000 MAU. Supabase Auth is attractive if your database is already Supabase: 50,000 MAU free, with SAML on paid plans. Both make sense when the platform is the point, and less sense when identity needs to outlive the platform.
Zitadel, Logto and authentik
These are the open-source challengers with managed options. Zitadel's cloud free tier is measured in daily active users (100), which is far smaller than a 50,000-MAU allowance — check the unit before comparing. Logto's free cloud tier includes 3 applications, with SSO as a paid add-on. authentik is self-host only.
Migrating off Firebase
A realistic sequence:
- Export users. The Firebase Admin SDK and the Firebase CLI can list and export users; the profile data moves cleanly.
- Plan the passwords. Firebase stores password hashes; whether they can be verified elsewhere depends on the hash format and the destination. Assume a password reset or a first-login migration flow until proven otherwise.
- Recreate providers and app configuration in the new system: Google, Apple, phone sign-in, custom claims.
- Keep both systems during the transition. Firebase custom tokens can authenticate users into a new backend while the old app is still live, which makes a gradual migration possible.
- Cut over app by app, then disable the Firebase project.
The short version
If you need self-hosting or a flat bill, Keycloak or Casdoor. If you want fully managed and are on Azure, Entra External ID. If you are deep in AWS or Supabase, their native options. If you need the largest managed feature set, Auth0.
Related reading: Firebase Auth vs Casdoor and free identity providers.
Casdoor is open source and self-hostable, with a hosted option from $9 per month and no per-user fees.
Sources
- Firebase pricing
- Auth0 pricing
- Amazon Cognito pricing
- Supabase pricing
- Zitadel pricing
- Logto pricing
- Keycloak
- Casdoor pricing
Product names are trademarks of their respective owners.