Amazon Cognito for AWS serverless stacks, where cost shape and IAM integration dominate. Auth0 for B2B products that need enterprise SSO, organizations, and a decade of maturity. Clerk for React-first products where the sign-in experience is part of the product itself. All three protect a Node.js backend the same way, through JWT verification; the real differences live in the cost curves, the developer experience, and the exit doors.
What is each provider actually optimized for?
Cognito is infrastructure: a user directory wired into IAM, API Gateway, and AppSync, priced and operated like any other AWS primitive. Auth0 is an enterprise identity platform: federation, organizations, and login-time extensibility refined since 2013. Clerk is a product layer: prebuilt React components and session management built so a team ships polished auth screens in hours.
Our bias, stated plainly: on AWS serverless stacks, Cognito usually wins on integration alone. When authentication UX is the product, in consumer onboarding or a multi-tenant SaaS dashboard, Auth0 and Clerk earn their keep. We wire all three into Node.js backends as part of our integration work, and the choice rarely hinges on the token: it hinges on everything around it.
How do the cost shapes compare as MAU grows?
Cognito bills per monthly active user with a large free allowance, and the curve stays close to linear as you grow: for plain email and social sign-in, it is the cheapest of the three at scale. Auth0 climbs in tier steps, and B2B features push you into higher plans early. Clerk sits between the two.
The shape matters more than any single figure. With Auth0, moving between tiers can multiply the bill overnight when one feature you need, enterprise connections for instance, is gated on a higher plan. Clerk offers a generous free allowance for early products, then bills per MAU with paid add-ons for organization features. Check the current pages before committing: Cognito pricing, Auth0 pricing, and Clerk pricing. All three have reshaped their tiers in recent years, so treat anything older than a quarter as stale.
Which integrates best with an AWS serverless backend?
Cognito, and it is not close. API Gateway and AppSync accept a Cognito user pool as a native authorizer: nothing to write, deploy, or scale yourself. Identity pools exchange tokens for scoped IAM credentials, which neither competitor replicates. Auth0 and Clerk integrate cleanly, but through verification code you own.
In a Node.js Lambda or container, that verification looks identical for all three, because each publishes a standard JWKS endpoint; the jose library covers it in a few lines:
import { createRemoteJWKSet, jwtVerify } from "jose";
// Same code for all three providers, only the issuer changes
const issuer = process.env.AUTH_ISSUER;
const jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));
export async function verify(token) {
const { payload } = await jwtVerify(token, jwks, { issuer });
return payload; // sub, email, custom claims
}
The difference is everything Cognito spares you before this code runs: a native authorizer, IAM policies, CloudFormation support, and one consolidated bill. The trade-offs arrive later, in the sections below.
Choosing between Cognito, Auth0, and Clerk for an AWS backend? Describe your system: a one-page diagnosis within 48 hours.
Get my diagnosis →Who wins on developer experience and hosted UI?
Clerk, by a wide margin. Its prebuilt React components for sign-in, user profile, and organization switching look finished out of the box. Auth0's Universal Login is mature and customizable with some effort. Cognito's hosted UI remains its weak point: limited theming and enough quirks that many teams end up building custom screens.
Cognito's rough edges are well documented: overlapping SDK generations, case-sensitivity surprises, awkward attribute flows. AWS has been reworking its managed login pages, so re-test before ruling it out, but historically this is where projects lose days. Clerk targets React and Next.js first; SDKs beyond that ecosystem exist but are younger. Auth0 covers nearly every stack and runs custom logic at login time through Actions.
What about B2B organizations and compliance?
Auth0 is the safest answer today. Organizations, per-customer enterprise SSO connections, and a long compliance record make it the default when you sell to large companies. Clerk ships organizations and B2B billing too, but it is a younger company with historically fewer certifications: check its current compliance list against your buyers' security questionnaires.
Cognito can federate with SAML and OIDC providers, but multi-tenant B2B stays yours to build: mapping tenants to app clients or separate pools, tenant-aware claims, admin tooling. Multi-region is genuinely hard, since user pools are regional resources with no managed active-active story. If per-customer SSO deals are on your roadmap, that gap costs more than any subscription.
Side by side: where each one wins
Three defensible choices with three different centers of gravity: Cognito is the infrastructure pick, Auth0 the enterprise pick, Clerk the product pick. This is the summary we draw on a whiteboard during architecture reviews, and the last row is the one that settles most debates.
| Criterion | Cognito | Auth0 | Clerk |
|---|---|---|---|
| Cost shape by MAU | Per MAU, large free allowance, near-linear at scale | Tiered plans, steep jumps, features gated by tier | Free allowance, then per MAU plus paid add-ons |
| Developer experience | Rough: dated ergonomics, known quirks | Mature SDKs, solid docs | Best of the three, prebuilt components |
| AWS integration | Native: API Gateway, AppSync, IAM | JWT verification you own | JWT verification you own |
| B2B features | Federation, but multi-tenancy is DIY | Organizations, enterprise SSO, SCIM | Organizations, younger enterprise record |
| Lock-in | High: password hashes not exportable | Moderate: export terms vary, verify | Moderate: migration tooling, verify terms |
| When it wins | AWS serverless stack, cost at scale | B2B SaaS selling to enterprises | React product where auth UX is the product |
How hard is it to leave each one?
Harder than any sales page admits, because the exit door is your users' password hashes. Cognito does not export them: leaving means forced resets or a slow lazy-migration proxy. Auth0 and Clerk have both offered hash exports under conditions that change over time; get the current terms in writing before you commit.
Everything else moves: profiles export, social logins re-link at the next sign-in. Our standing advice is to sync user records into your own database through webhooks from day one; it doubles as an escape hatch and an analytics source. Consume those webhooks with the same idempotency discipline we apply to Stripe events, because every identity provider re-delivers.
Decision checklist
- Backend on API Gateway or AppSync, cost pressure at scale: pick Cognito.
- Enterprise buyers, per-customer SSO or SCIM on the roadmap: pick Auth0.
- React or Next.js product where the auth UX helps sell: pick Clerk.
- Before signing anything: confirm password hash export terms in writing.
- From day one: mirror users into your own database via idempotent webhooks.