Faable Auth vs ZITADEL

Short answer: ZITADEL and Faable Auth are both standards-first OAuth 2.0 / OpenID Connect identity servers with hosted login, multi-tenant organizations and machine-to-machine clients — closer to each other than either is to a component library like Clerk. The real differences are three. How you pay: ZITADEL Cloud bills the sum of daily active users, so one person who signs in on ten days counts ten times; Faable charges a flat plan fee with unlimited MAU on Hobby and Pro. Whether you can run it yourself: ZITADEL is open source (AGPL-3.0) and self-hostable; Faable Auth is managed only. And what comes with it: Faable Auth shares one subscription with Faable Deploy, your app hosting.

ZITADEL details checked against zitadel.com pricing, its help center and docs in October 2026. They change — confirm anything decisive on their own site.

At a glance

Pricing, worked through

The two meters count different things, and that matters more than the list prices.

ZITADEL bills the sum of daily active users: every day, each user who signs in, refreshes a token or — for a service user — authenticates counts once, and the month is the sum of the days. A user who signs in on twenty days of the month is twenty units. Pro includes 25,000 of those units for US$100/month; beyond that, usage is billed at the end of the period, along with extra identity provider connections (US$100 each after 3), custom domains (US$50 each after 1), Management API requests above 500,000 and administrators beyond 3.

Faable counts monthly active users — anyone with a successful login in the month, once — and only Free has a limit (15,000). Hobby (15 €) and Pro (99 €) have no per-user line.

What that means for a product with 2,000 users who come back every working day (about 21 days a month):

The honest reading: ZITADEL’s Free is generous on features — MFA and passkeys at no extra charge, unlimited organizations — but its 100 daily active users is a test allowance, not a launch. Its Pro is a good fit for an app people sign in to occasionally. For an app people use every day, the daily meter grows with engagement, while Faable’s fee stays flat. Faable is the one that charges for MFA (Hobby) and for passkey sign-in (Pro).

Faable figures are plan fees from Auth pricing, in euros, VAT excluded; ZITADEL figures are its list prices in US dollars. ZITADEL’s calculator does not state the size of a DAU billing unit, so we don’t compute the overage — use their pricing calculator .

Self-hosting

This is where ZITADEL is simply different. It is open source — AGPL-3.0 since version 3, with the SDKs and API definitions still under Apache 2.0 — and runs on PostgreSQL. Using it as your own identity platform doesn’t trigger the copyleft; modifying it and offering it as a service to others does. Its Enterprise plan replaces the AGPL with a commercial license, with support and an SLA.

Faable Auth is managed only: there is nothing to install, patch or back up, and no way to run it on your own servers. If running the identity server yourself is a requirement — air-gapped networks, an on-premises mandate — ZITADEL (or Keycloak) is the option, and this page can stop here.

Where your users’ data lives

ZITADEL Cloud lets you pick the region when you create an instance — United States, European Union, Switzerland or Australia, all on Google Cloud — and keeps backups in the same region, noting that data in transit may leave it when users sign in from abroad. Contracts are with CAOS AG in St. Gallen, under Swiss law, but its DPA and privacy policy name Zitadel, Inc., in San Francisco. If your procurement asks who processes the data, read both.

Faable Auth runs in Europe, operated by a European company, with no non-EU region to choose by mistake. See European alternatives to Auth0, Clerk and Cognito for how the European providers compare on this point, and our compliance scope.

Machine-to-machine, token exchange and MCP

Machine-to-machine. Both issue tokens to services through standard OAuth. On ZITADEL a service user counts as a daily active user on each day it authenticates — a cron job that runs every day is about 30 units a month, on top of your people. Faable meters client credentials tokens separately: 100 a month on every plan, then €2.25 per 1,000 on Hobby and Pro.

Token exchange. Faable supports RFC 8693 token exchange for delegation and service-to-service calls on behalf of a user. ZITADEL documents it as an experimental beta you enable through its feature API.

MCP servers. Both can act as the authorization server of a remote MCP server through Dynamic Client Registration, off by default on both. Faable also supports Client ID Metadata Documents — the other registration method the MCP specification allows — and adds a consent screen, per-tool permissions with step-up and a Connected apps list where users revoke access. See Add OAuth to your MCP server.

Migrating from ZITADEL

Users move with their passwords when you can get the hashes out. ZITADEL hashes with bcrypt by default, and Faable imports bcrypt strings ($2a$/$2b$/$2y$) as they are, re-hashing them with Argon2id on each user’s first sign-in:

1. Get your users with their password hashes — from your PostgreSQL database if you self-host; on ZITADEL Cloud, ask their support for an export.
2. Send them to the Management API’s POST /user/import — up to 500 users per request, with "dry_run": true first — passing each bcrypt string as password_hash. See Import and export password hashes.
3. Recreate your clients in Faable and point your apps at the new issuer. Because both speak standard OIDC, most apps only change the issuer URL, client ID and secret.

When Faable Auth is the better fit

• Your users sign in often and you want a bill that doesn’t grow with every day they come back.
• You want to launch for free: 15,000 monthly users on Free, against 100 daily active users.
• You need identities held by a European company in Europe, without having to check which entity is in the DPA.
• You run services or cron jobs that shouldn’t count as users.
• You want auth and hosting together: Faable Deploy and Faable Auth share one subscription.

When ZITADEL might fit better

• You need to self-host the identity server, or want the option to leave the managed service and run the same code yourself.
• You need SCIM to provision users from your customers’ directories.
• You want MFA and passkeys on the free plan and stay under 100 daily active users.
• You need data residency in Switzerland, the US or Australia.
• Your users sign in rarely, so the daily meter stays low.

Related

• Faable Auth vs Auth0, Clerk & Keycloak · vs Clerk · vs Better Auth
• European alternatives to Auth0, Clerk and Cognito
• Import and export password hashes
• Faable Auth features · Auth pricing

Last updated on October 29, 2026