Choosing auth, payments and analytics for a SaaS

Authentication, payments and analytics are the three services almost every SaaS buys before its first customer. Most start free, so the choice turns on what happens later: how the price grows with use, and how hard it is to leave. The prices below were read on each provider's pricing page on 27 October 2026. They change, so check the source before you decide.

Compare on four questions

How long until the first working sign-up or payment? Where does the bill jump as usage grows? What would it cost to move away? Can you export your data? Before choosing, write down the users and sales you expect in six and in eighteen months, and price each candidate at both points: a free tier says little about the bill once the product works.

Authentication: decide early

Auth is the hardest of the three to replace, because it holds passwords, sessions and every protected route. Hosted services differ mostly in what they count. Clerk is free up to 50,000 monthly retained users per app, a user who comes back at least 24 hours after signing up, and its Pro plan costs $25 a month (pricing). Supabase includes 50,000 auth monthly active users on its free plan and 100,000 on Pro, from $25 a month, then $0.00325 per user (pricing). WorkOS gives AuthKit free for the first million monthly active users and bills enterprise single sign-on at $125 per connection a month (pricing).

If company customers are likely to ask for SAML single sign-on or user provisioning within the year, start on a service that offers them, even before you need them: adding organizations later to an auth setup built for individual users is close to a rebuild.

Self-hosted options keep user records on your own servers: SuperTokens, Logto and Ory publish their code, and libraries such as Auth.js and Better Auth run inside your app. You then own the updates and the security fixes. Lucia, once a common choice, was deprecated in March 2025; its repository now offers a single-file example to copy instead.

Payments: who is the seller?

With Stripe, your company is the seller. Stripe's pricing page for France lists 1.5% + €0.25 per standard European card, 0.7% of volume for Stripe Billing subscriptions, and 0.5% per transaction for Stripe Tax's calculation where you are registered. Registering for VAT or sales tax in each country where you have to, and filing, stays your job.

A merchant of record resells your product and becomes the seller for the buyer and for the tax authorities. Paddle and Lemon Squeezy charge 5% + 50¢ per transaction (Paddle pricing, Lemon Squeezy pricing). Polar charges the same on its free plan and less on paid plans from $20 a month, plus 1.5% for cards issued outside the US (pricing). The higher fee replaces the tax registrations. Lemon Squeezy has belonged to Stripe since 2024, and its January 2026 update says the goal is to move its users to Stripe Managed Payments: check where that stands before building on it.

Moving later costs something in both directions. Leaving a merchant of record means taking on the tax obligations it handled; changing processors means moving saved cards, which depends on what each processor lets you export.

Analytics: traffic and product use are two questions

Web analytics answers where visitors come from and which pages they read. Product analytics answers what signed-in users do: funnels, retention, use of each feature. Most products need the first from day one and the second once there are users.

For web analytics without cookies, Plausible starts at $9 a month for 10,000 monthly pageviews and has a free self-hosted edition (pricing); Umami has a free hosted plan for one site and is free to self-host (pricing). The Google Analytics alternatives collection compares six of them.

Product analytics is usually billed by event. PostHog, for example, has a monthly free tier on each product and bills usage beyond it (pricing). Decide which events matter (sign-up, activation, the core action, payment) before you instrument, so the bill follows the questions you ask.

When to revisit

Change a provider when a trigger fires: its next price tier would cost more than the work of replacing it, a customer requires something it lacks (single sign-on, a data processing agreement, data kept in a given region), or it holds data you cannot export. Until then, the time is better spent on the product.

Sources

Read on 27 October 2026.