AskMeAnything
Ask
Ask
68
@thea_mandel ·

clerk at $25/mo or self-host auth.js with a sessions table, 2,100 users and one dev Provider Migration

2,100 registered users, maybe 600 monthly active. Currently on the free tier of a hosted auth provider and about to cross into paid, which lands somewhere around $25/month plus per-user beyond the included bucket.

I am one developer. The $25 is not the issue on its own, it is that this is a line that grows with users while my revenue is not growing at the same rate. Email plus Google is all I need. Is moving to Auth.js with a sessions table a two-day job or am I about to learn a lot about password reset emails?

10 answers Share
Report

10 answers

BestTopNewOldControversial

Answering anonymously — a moderator will review it first.

  • @stack_trace_sy · 4mo ago · 3 replies
    @stack_trace_sy ·

    At 2,100 users and one developer, keep paying, and it is not close.

    The bill is not the cost. The cost is that you now own password reset emails and their deliverability, session invalidation, MFA the first time someone asks, SSO the first time a real customer asks, bot signups, credential stuffing, and the 2am "nobody can log in" that has no one else to escalate to. $25 and change is roughly twenty minutes of your time per month. You will spend that on auth in a bad week regardless.

    Revisit when the bill is a meaningful fraction of revenue, or when you need something they will not do. Not when it crosses from zero to a number, which is a psychological event rather than a financial one.

    96
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @serger_seth · 4mo ago
      @serger_seth ·

      The thing that actually flips this is not user count, it is whether auth becomes part of the product. Org invites, custom role hierarchies, per-tenant SSO, audit logs your customer wants to export. Once you are shipping auth as a feature, owning it starts to pay for itself. Until then you are paying rent on a house you do not want to maintain.

      29
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
    • @warranty_wes · 4mo ago
      @warranty_wes ·

      Also go and read the current pricing yourself rather than planning around a number from a thread. It moves, in both directions, and the shape of the included tier matters more than the headline.

      13
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @rueben_alsop · 4mo ago · 2 replies
    @rueben_alsop ·

    Regardless of what you decide, do this today: stop letting the provider's user id be your primary key.

    Own a users table with your own id, and a provider_subject column holding theirs. Foreign keys point at yours. Then a migration later is a mapping table and a weekend, instead of touching every table you own. It is maybe an hour of work now and it is the difference between a decision you can revisit and one you cannot.

    61
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @burr_and_edge · 4mo ago
      @burr_and_edge ·

      Highest value hour in this entire thread and it has nothing to do with the price. Do it whether you migrate or not.

      24
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @pumptest_pat · 4mo ago
    @pumptest_pat ·

    Counterpoint, since everyone is saying stay: Auth.js with a database adapter, email and one OAuth provider is genuinely not much code. A sessions table, an adapter, a callback, and you are done. If that really is all you need forever, two or three days buys you never thinking about monthly active users again.

    The trap is "forever". Almost nobody's auth requirements stay still.

    34
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
  • @labcoat_lior · 4mo ago · 2 replies
    @labcoat_lior ·

    The migration cost people forget is passwords. If your provider stores them hashed and will not export the hashes, you cannot move those users - you have to send 2,100 reset emails, and some percentage of people simply will not do it and are gone.

    Check the export policy before you plan anything, because the answer changes the entire shape of the migration.

    18
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @p99_hana · 4mo ago
      @p99_hana ·

      And if they will export hashes, check the algorithm and parameters too. Getting the hashes is only useful if you can verify against them without asking everyone to reset anyway.

      15
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @deadbug_wiring · 4mo ago · 2 replies
    @deadbug_wiring ·

    Self-hosting is always cheaper. It is a users table and a sessions table, that is the whole thing.

    16
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @stack_trace_sy · 4mo ago
      @stack_trace_sy ·

      The two tables are the easy part and always have been. The cost is the forty edge cases around them - email enumeration, account linking when the same person signs up with Google and then with a password, session fixation, rate limiting the login endpoint, what happens when someone changes the email on their OAuth account. You only meet those once you have users, which is the worst time to meet them.

      13
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report