TL;DR: Every host is auth-agnostic and every auth vendor is hosting-agnostic, so a 3-person team stitches two vendors and two bills to get “deploy it and let my colleague log in.” The auth vendors’ free tiers are MAU-generous and their paid tiers are enterprise-shaped — with nothing between. That missing middle tier is the gap AgentCell fills by treating identity as a platform property.
The wall after deploy
Deploying has been solved for a decade. The moment one other person should use the app, you hit a wall that has nothing to do with your code: put it on the internet and anyone can read it, so you need a login. Choosing a provider, wiring OAuth, modelling users and sessions, handling departures — days of work for 200 lines of business logic. (This is the longer version of our most-read essay — the mechanics below are the reference companion.)
Free, and then a cliff
Identity pricing as of mid-2026, from public pages:
| Vendor | Free tier | First paid step | Why it fails a 3-person tool |
|---|---|---|---|
| WorkOS | 1M MAU (AuthKit) | $125/mo per enterprise SSO connection | Priced per B2B customer. Your own team’s Google Workspace is one connection at full list price — generating zero revenue |
| Clerk | 50,000 MRU | Pro $100/mo, Business $300/mo flat | Flat enterprise pricing regardless of team size |
| Auth0 | 25,000 MAU | B2B Essentials $150/mo for 500 MAU | Built for scaled consumer/B2B auth, not three colleagues |
| Cloudflare Access | 50 users | $7/user/mo | Closest to workable — but Zero Trust fluency required, and built for org-internal access, not ad-hoc external sharing |
Your app has three users. You will never approach any free-tier limit — and the thing you want, colleagues sign in with work accounts, is a feature, not a volume. It lives on the far side of the cliff in every row.
Why the pricing is shaped like that (it’s not a mistake)
These products serve B2B SaaS companies selling to enterprises. WorkOS’s per-connection model is perfect there: forty enterprise customers, forty connections, each generating revenue — $125 each is trivially worth it. Applied to an internal tool, one team signing into its own dashboard pays the same $125 for a connection that generates no revenue at all. The free tiers are sized for scale you don’t have and don’t want, betting you’ll grow into enterprise features later.
There is no tier priced for a permanently small audience. Not an expensive tier — a tier that does not exist. Three to ten people, forever, SSO included, SCIM and audit exports never needed. Nobody sells that.
The stitching tax
Meanwhile hosting: Render, Railway, Fly, Netlify, Cloudflare Pages — all hand you a public URL and treat auth as your problem (Railway has no access layer at all). So the team selects two vendors, integrates them, and absorbs two unrelated meters — compute plus identity — to reach one sentence: “deploy it, and let my colleague log in.” For one app, annoying. For the tenth app, the whole ballgame: nobody does that setup ten times.
The internal-tools platforms bundle identity and charge per seat instead (Retool Business $50–65/builder, Airtable billing every editor monthly, Power Apps $20/user) — backwards when the app has three users. See AgentCell vs Retool for the full math.
Auth is a platform property
Applications owning their own identity made sense when apps were big: one product, a million users, identity as product surface. Small software inverts it: the identity model is the company’s existing one (Google Workspace, Okta, Entra), identical across all twenty tools, with HR already handling departures. Writing it into each app is worse than wasteful — the answer to “who sees the revenue dashboard” ends up in unreviewed agent-written code, different in every tool.
The correct boundary is an identity-aware proxy in front of the app: authenticate before code runs, hand the app a verified user, change sharing without redeploying, deprovision once centrally. Cloudflare Access, Google IAP, and Vercel’s deployment protection are all versions of this pattern — what never existed is that pattern packaged and priced for three colleagues and a FastAPI app. That is the front door.
FAQ
Can’t I just use the free tier? For audience size, yes — you’ll never hit MAU limits. The SSO feature is what’s gated, not the volume. Three users needing Google SSO pay the enterprise floor.
What about Cloudflare Access at $7/user? Genuinely the closest fit — if your sharing is org-internal, your team speaks Zero Trust policy, and recipients never sit outside the org. Ad-hoc per-app sharing with outsiders is where it breaks.
What should cheap SSO for small teams cost? Our test: the tenth tool must not trigger a pricing conversation. Org sign-in belongs at the bottom of the pricing page — that position, not any single number, is the wedge.
Paying enterprise prices for a team login form? Deploy now.