Firebase Auth Alternatives for Web and Mobile Apps
A good Firebase Auth alternative depends on why you are leaving. If you are moving your data from Firestore to Postgres, pick an auth that lives in the database: StitchDB or Supabase. If you only want to replace auth and keep Firebase for everything else, Clerk, Auth0 or WorkOS are standalone services that plug in. All of them cover e-mail, OAuth and phone sign-in on web, iOS, Android and Flutter.
Firebase Authentication is free for most apps and easy to start with. The reasons to switch tend to show up later: daily e-mail limits on the free plan, the SAML/OIDC cap, and the fact that your users live in a different system from your relational data once you outgrow Firestore.
#Where Firebase Auth pinches
These numbers come from Firebase's own pricing and limits pages, as of November 2026:
| Limit | Spark (free) | Blaze |
|---|---|---|
| Monthly active users | 50K | Billed above the free tier |
| SAML / OIDC users | 50 MAU | Billed |
| Phone sign-in | Not available | Billed per SMS |
| E-mail link sign-in e-mails | 5 per day | 25,000 per day |
| Password reset e-mails | 150 per day | 10,000 per day |
| Verification e-mails | 1,000 per day | 100,000 per day |
| New accounts per IP | 100 per hour | 100 per hour |
The one that surprises people is e-mail link sign-in: 5 per day on Spark means magic-link login is not usable on the free plan for a real launch. You need Blaze, which means a billing account.
The other friction is structural. Firebase Auth pairs naturally with Firestore security rules. If you move your data to Postgres, you want auth.uid() in SQL policies, and Firebase tokens don't give you that out of the box.
#The alternatives
| Alternative | Free tier (Nov 2026) | Phone sign-in | Magic links on free | Mobile SDKs |
|---|---|---|---|---|
| StitchDB Auth | 50,000 MAU | Yes, your own SMS provider | Yes, within plan e-mail limits | JS, Flutter, Swift, Kotlin, Python, C# |
| Supabase Auth | 50,000 MAU | Yes | Yes | JS, Flutter, Swift, Kotlin, Python, C# |
| Clerk | 50,000 MRU per app | Check Clerk docs | Check Clerk docs | iOS, Android, Expo (see Clerk docs) |
| Auth0 | 25,000 MAU | Yes | Yes | Native SDKs |
| WorkOS AuthKit | 1M MAU | Check WorkOS docs | Check WorkOS docs | See WorkOS docs |
#StitchDB
StitchDB is a hosted backend with a dedicated Postgres database per project. Auth stores users in auth.users in that database, and the API is compatible with the open-source Supabase stack.
Sign-in methods on every plan: e-mail and password, magic links and six-digit codes, 19 OAuth providers including Google and Apple, phone sign-in through Twilio, Twilio Verify, MessageBird, Vonage or Textlocal, anonymous users, passkeys, Web3 wallets, SAML SSO and MFA.
The free plan includes 50,000 MAU and 500 auth e-mails a month (30 an hour) sent by StitchDB with no SMTP setup. With your own SMTP server, the hourly limit is yours to set. Paid plans can send from your own domain.
Anonymous users map well to Firebase's anonymous auth, and they keep their id when they upgrade:
const { data } = await stitchdb.auth.signInAnonymously()
// later, when the visitor creates an account:
await stitchdb.auth.updateUser({ email: '[email protected]' })Native Google and Apple sign-in work with ID tokens from the platform libraries:
await stitchdb.auth.signInWithIdToken({ provider: 'google', token: idToken })There are SDKs for Flutter, Swift and Kotlin with the same methods.
Trade-offs: EU hosting only (Germany and Finland), a younger platform than Firebase, and no self-hosted edition. On Free, the API services sleep after a period without requests and wake on the next one. Plan limits are on the pricing page.
#Supabase Auth
The same model as StitchDB: users in Postgres, policies in SQL, the same client libraries. Free covers 50,000 MAU and Pro starts at $25/month with 100,000 MAU. Free projects pause after a week of inactivity. Supabase has more regions worldwide and can be self-hosted.
#Clerk
Clerk replaces Firebase Auth's UI with polished prebuilt components and has a free Hobby plan for 50,000 monthly retained users per app. MFA and passkeys need Pro ($25/month). Your data stays wherever it is, so you link users to records yourself. Details in Clerk alternatives.
#Auth0
Mature and feature-rich, with a 25,000 MAU free tier. Paid consumer plans start at $35/month for 500 MAU. Choose it for enterprise identity features, not to save money.
#WorkOS AuthKit
Free up to 1 million MAU, with enterprise SSO priced per connection. A strong fit for B2B apps; less relevant if you never sell to companies.
#Mapping Firebase concepts
| Firebase Auth | StitchDB / Supabase Auth |
|---|---|
firebase.auth().currentUser.uid | (await stitchdb.auth.getUser()).data.user.id |
| Custom claims (Admin SDK) | app_metadata or the custom access token hook |
Security rules request.auth.uid | auth.uid() in Row Level Security |
| Anonymous auth | signInAnonymously() |
| E-mail link sign-in | signInWithOtp({ email }) |
| Phone auth | signInWithOtp({ phone }) + verifyOtp |
| Blocking functions (beforeCreate) | "Before user created" auth hook |
Custom claims deserve a note. In Firebase you set them with the Admin SDK. On StitchDB you write a Postgres function and register it as the access token hook:
create or replace function public.custom_access_token_hook(event jsonb) returns jsonb
language plpgsql stable as $$
declare claims jsonb := event->'claims';
begin
claims := jsonb_set(claims, '{tenant_id}',
to_jsonb((select tenant_id from public.profiles where id = (event->>'user_id')::uuid)));
return jsonb_set(event, '{claims}', claims);
end $$;
revoke execute on function public.custom_access_token_hook(jsonb) from anon, authenticated, public;Then set the hook in Studio under Authentication, Hooks. See Auth hooks.
#Moving users from Firebase
Firebase can export users with the Firebase CLI (firebase auth:export), including password hashes in Firebase's modified scrypt format. Whether a target can verify those hashes varies, so check before you plan a silent migration. A safe plan that works with any target:
- Export users and import them with the same e-mail and, where possible, a stored mapping of the Firebase uid.
- Mark imported users so your app knows they haven't signed in on the new system yet.
- On their first visit, send a magic link or code instead of asking for a password.
- Move OAuth providers by adding the new callback URL to each provider's console, next to the old one, until the switch is done.
If your data is moving too, read Migrate from Firebase to Postgres first: it's easier to move users and data in one planned step.
#When to stay on Firebase Auth
Stay if you're happy on Firestore, your app uses Firebase-specific services (Cloud Messaging, Remote Config, App Check) heavily, and the Blaze plan's costs are fine for you. Firebase Auth is free up to 50K MAU and well documented. Replacing just the auth layer while keeping Firestore rarely pays off.
#FAQ
#Is Firebase Authentication free?
The Spark plan includes 50K MAU, but phone sign-in needs Blaze and e-mail link sign-in is limited to 5 e-mails a day on Spark, as of November 2026.
#What is the best open source Firebase Auth alternative?
Supabase Auth, which you can self-host. StitchDB runs the same Auth API as a hosted service, so code written for it is portable.
#Can I keep Firestore and switch only auth?
Yes, with a standalone provider and custom tokens, but it adds a moving part. Most teams switch auth when they switch databases.
#Does StitchDB support phone sign-in like Firebase?
Yes, with your own SMS provider account. Test phone numbers with fixed codes are available for development and app store review.
Bring your users and data under one roof: create a free StitchDB project.