Identity And Access Management — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) Workforce Core
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAzure AD Free $0 up to 500k objects; Okta SSO $2/user/mo min $2000/yr, MFA add $4/user/mo total; Entra ID P1 $6/user/mo, P2 $9/user/mo; JumpCloud Free 10 users+10 devices then $9/user/mo
Customer Identity & Access (CIAM) Platform
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free 7.5k MAU, 2 social IdPs; Essentials $35/mo for 500 MAU + $0.07/MAU over; B2B $150/mo; Clerk Free 10k MAU then $25/mo + $0.02/MAU; Supabase Auth Free unlimited on free project, Pro $25/mo
SSO Platform / Enterprise Federation (SAML/OIDC)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWorkOS SSO Free dev 1M API calls/mo then $99/mo per product, bundle SSO+DirSync+Audit Logs $149/mo; Okta SSO $2/user/mo min 100 users $200/mo; Azure AD P1 $6/user/mo includes SAML; BoxyHQ OSS Free self-host
MFA Provider / TOTP/Push Auth
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsDuo Free 10 users unlimited apps; Essentials $3/user/mo, Advantage $6/user/mo, Premier $9/user/mo; Authy Free 100 auths/mo then $0.05/auth; Okta MFA $3/user/mo add-on to SSO
Passwordless Authentication (WebAuthn/FIDO2)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSimpleWebAuthn OSS Free $0 self-host; Hanko Cloud Free 500 MAU then $39/mo; Corbado Free 1k MAU then $99/mo 5k MAU; Descope Free 7.5k MAU then $49/mo base + $0.05/MAU over
Secrets Management for IAM (Service Accounts & Keys)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsVault OSS Free; HCP Vault Dedicated $0.03/hr ~$22/mo + storage $0.15/GB; Doppler Free 5 users then $12/user/mo; Infisical Free self-host, Cloud Free 1 project then $15/mo; AWS Secrets $0.40/secret/mo + $0.05/10k API calls
API Authorization / OAuth 2.1 Authorization Server
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsOry Hydra OSS Free; Ory Network Free 10k tokens/day then $0.15/1k tokens over; Keycloak OSS Free; FusionAuth Community Free, Cloud $37/mo; Auth0 authz included in MAU pricing $35/mo base
Session Management & Token Revocation / CAEP
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsRedis OSS Free self-host; Upstash Free 10k cmds/day then $10/mo 100k/day, $25/mo 500k/day; Keycloak Free sessions; Okta CAEP Continuous Access add-on $2/user/mo; Transmit $10k/yr base
Audit Logs WORM for IAM Events
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsWorkOS Audit Logs Free 10k events/mo then $0.01/event or $99/mo bundled; CloudTrail Free first copy, then $2.00/100k mgmt events; Axiom Free 500GB ingest 30d then $25/mo per 100GB; Panther $150/mo base + $10/GB
Zero Trust Network Access (ZTNA) for Admin
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudflare Access Free 50 users then Teams Standard $7/user/mo; Tailscale Free 3 users 100 devices then Personal Pro $6/user/mo, Teams $10/user/mo; Zscaler ZPA $20/user/mo min 100 users $24k/yr; ZPA+ZIA bundle $45/user/mo
Directory Sync & SCIM Provisioning
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsBoxyHQ SCIM OSS Free; WorkOS DirSync Free dev 100 directories then $99/mo per product, trio bundle $149/mo; JumpCloud includes SCIM $9/user/mo; Okta Lifecycle $4/user/mo min $400/mo
How this hobby identity and access management checklist works.
Each requirement below is something a hobby identity and access management build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.