Clerk Alternatives - When to Move Auth Into Your Backend

The main Clerk alternatives are Auth0 and WorkOS (other hosted identity services), Supabase Auth, Firebase Authentication and StitchDB (auth built into a backend, with users in your database), and Better Auth (an open-source library you run yourself). If you like Clerk's UI but are tired of syncing users into your database with webhooks, a backend with built-in auth is usually the better move. If you just need cheaper enterprise SSO, look at WorkOS.

Clerk is good software. People leave it for three reasons: cost once they pass the free tier, the extra moving part between auth and data, and B2B features that cost add-ons. This article goes through each alternative with those reasons in mind.

#What Clerk costs today

As of November 2026, Clerk's pricing is:

MRU means monthly retained user; see Clerk's page for exactly how it is counted. Organizations are included up to 100 per app with 20 members each; beyond that, the B2B add-on is $100/month.

Two things stand out. MFA and passkeys require Pro, so a security-conscious free app has to pay $25. And on Pro, users 50,001 to 100,000 cost $0.02 each, which is up to $1,000/month on top of the base fee.

#The "two sources of truth" problem

With Clerk, users live in Clerk and your data lives in your database. To join them you either:

• copy users into a users table through a webhook, or
• verify Clerk's JWT in your database or API and trust its sub claim.

Both work. Both add something to maintain: a webhook handler that must be idempotent, retries when it fails, and a mapping between Clerk ids and your rows. When auth is part of the database, that layer disappears. The user id in the token is the primary key in auth.users, and a foreign key points straight at it:

create table public.projects (
  id bigint generated always as identity primary key,
  owner_id uuid not null default auth.uid() references auth.users on delete cascade,
  name text not null
);

alter table public.projects enable row level security;

create policy "Owners manage their projects" on public.projects
  for all to authenticated
  using (owner_id = auth.uid())
  with check (owner_id = auth.uid());

No webhook, no sync job. Deleting a user cascades to their rows.

#Clerk alternatives compared

#StitchDB: auth that lives in your database

StitchDB gives each project a dedicated Postgres database with Auth, REST and GraphQL APIs, Realtime, Storage and Edge Functions. Compared with Clerk:

• UI: there are no React components like <SignIn />, but there is a hosted sign-in page at https://<project-ref>.p.stitchdb.com/login with your logo, colors and seven languages. It handles sign-in, sign-up, magic links, password reset, TOTP and OAuth. "Secured by StitchDB" can be hidden from Pro.
• Methods: passwords, magic links and codes, 19 OAuth providers, phone, anonymous users, Web3 wallets, passkeys, TOTP and SMS MFA, and SAML SSO.
• B2B: Organizations add teams, roles (owner, admin, member plus your own), invite e-mails and org_id/org_role JWT claims, with policy helpers such as auth.has_role('admin', org_id). No add-on fee.
• Price: Free has 50,000 MAU, Pro is $15.99/month with 100,000 MAU, and extra MAU on Pro cost $0.002 each with the spend cap off.

Sending users to the hosted page from a Next.js or React app:

import { createClient } from 'stitchdb-js'

const stitchdb = createClient(STITCHDB_URL, STITCHDB_ANON_KEY, { auth: { flowType: 'pkce' } })

// on your sign-in button
await stitchdb.auth.signInWithHostedPage({ redirectTo: 'https://yourapp.com/auth/callback' })

On the callback page the client exchanges the ?code= for a session by itself.

Trade-offs: hosting is EU-only (Falkenstein and Nuremberg in Germany, Helsinki in Finland), so a US-only audience gets more latency than with a US provider. The platform is younger than Clerk. You build more of your own UI if you don't use the hosted page.

#Supabase Auth

Supabase Auth gives you the same model: users in auth.users, policies with auth.uid(). The free plan includes 50,000 MAU; Pro starts at $25/month with 100,000 MAU, then $0.00325 per MAU. Supabase can also be self-hosted with Docker. Free projects pause after a week without activity. A good pick if you want worldwide regions and an open-source stack; see Supabase vs Firebase for how it compares on the data side.

#Firebase Authentication

Free up to 50K MAU on Spark, with drop-in FirebaseUI and good native SDKs. Users live in Firebase, your data in Firestore, so the link is through security rules rather than SQL. Phone auth requires Blaze. A fit for Firebase apps; less so if you want Postgres.

#Auth0

The most established hosted option. Its free plan covers 25,000 MAU, but paid B2C plans start at $35/month for only 500 MAU. Choose Auth0 for enterprise integrations and compliance paperwork rather than price. Our Auth0 alternatives article has the full price ladder.

#WorkOS AuthKit

Free up to 1 million MAU, which is hard to beat, with SSO billed per connection ($125 each for the first 15). If the reason you are leaving Clerk is enterprise SSO cost across many customers, model it both ways: WorkOS charges per connection, Clerk per connection above the first.

#Better Auth

A TypeScript library with plugins for 2FA, passkeys and organizations. Users live in your database and there is no per-user fee. You run it in your own server, so you own e-mail delivery, rate limiting and upgrades.

#Where Clerk is still the better choice

• You want production-quality sign-in components in React today and don't want to design auth screens.
• You rely heavily on Clerk's prebuilt account management UI.
• Your app has fewer than 50,000 retained users and needs no MFA: the Hobby plan is free.

If that's you, stay. Moving auth is work, and users notice when sign-in changes.

#How to move off Clerk

1. Export users. Check Clerk's docs for how to export users on your plan and whether password hashes are included.
2. Keep ids if you can. If your tables reference Clerk ids as text, keep a mapping column (legacy_clerk_id) during the move.
3. Re-create OAuth apps with the new callback URL. On StitchDB it is https://<project-ref>.p.stitchdb.com/auth/v1/callback.
4. Plan the first sign-in. Users without an imported password sign in once with a magic link or OAuth.
5. Replace webhook sync with foreign keys to auth.users and policies. Delete the webhook last.

#FAQ

#Is Clerk free?

Yes, the Hobby plan is free for up to 50,000 monthly retained users per app as of November 2026. MFA, passkeys and branding removal need Pro at $25/month.

#What is the best Clerk alternative for Next.js?

If you want hosted components, Auth0 or WorkOS. If you want auth and database together, StitchDB or Supabase, both of which work with server components through the PKCE flow.

#Can I use Clerk with StitchDB?

You can verify Clerk tokens in an Edge Function and keep data in StitchDB, but you lose auth.uid() in policies. Most teams that want Postgres pick the built-in Auth instead.

#Does StitchDB have organizations like Clerk?

Yes. Turning on Organizations installs tables, invite e-mails, role helpers and JWT claims in your database, on every plan.

See what auth in your own database feels like: start free on StitchDB.