AWS Cognito Pricing Explained (2026)

The Auth Bill I Didn’t See Coming

Sometime in 2022, deep in my AWS phase — the one where I thought “real founders run on AWS” and paid for it in anxiety — I wired up Amazon Cognito for a side project. The pitch was irresistible to a broke engineer: 50,000 monthly active users, free. Fifty thousand. I’d never have 50,000 users of anything. Auth, the thing I dreaded paying for, was going to cost me exactly nothing forever.

And for a while, it did. The problem wasn’t the bill. The problem was that I spent a full weekend fighting the hosted UI, the token refresh logic, and a redirect loop that only happened in Safari, to save money I was never going to spend anyway. Classic Broken Engineer move: optimizing a cost that was already zero while the actual product sat there with no users.

Then two years later I watched the pricing get rewritten under people’s feet, and a bunch of teams who’d made the same “it’s basically free” bet got a very different invoice. So let me lay out what Cognito actually costs in 2026, the change that stung, and — the part I care about — whether a founder should touch it at all.

---

How Cognito Pricing Actually Works: MAUs and Three Tiers

Cognito’s core unit is the monthly active user (MAU) — a user who signs in, has a token refreshed, or otherwise authenticates at least once in a calendar month. Sign up 100,000 users and only 4,000 log in this month? You pay for 4,000. That part is genuinely fair, and it’s the industry norm now.

What changed is that in late 2024, AWS split the old flat product into three feature tiers, and the tier you’re on decides your per-MAU rate:

Tier	Price per MAU	Free tier	What you get
Lite	from $0.0055 (drops with volume)	10,000 MAU	The basics — sign-up, sign-in, social login
Essentials	$0.015	10,000 MAU	Passkeys, email MFA, custom flows — the new default
Plus	$0.020	none	Threat protection, adaptive auth, compromised-credential checks

A few things to actually internalize here. Essentials is the default for every new user pool, so unless you deliberately downgrade to Lite, you’re paying $0.015/MAU past the free tier — nearly 3x the Lite rate. Plus has no free tier at all; you pay from user number one. And federated sign-in (Okta, Microsoft Entra ID, any SAML/OIDC connection) is billed separately: your first 50 federated users are free, then it’s $0.015 per MAU on top. (If that SSO vocabulary is fuzzy, I untangled OAuth vs SAML — the two standards enterprise buyers actually ask for.)

Do the math and Cognito is, at scale, absurdly cheap. 100,000 MAU on Lite, after the free tier, is roughly $500/month. The same 100,000 on Clerk or Supabase would cost you a multiple of that. If you’re running a million users and you’re already living inside AWS, Cognito is one of the cheapest auth options on the planet. That’s the honest case for it, and I won’t pretend otherwise.

---

The Free Tier Trap Nobody Reads the Fine Print On

Here’s the detail that bit me and a lot of other people. When Cognito launched years ago, the free tier was 50,000 MAU. That’s the number burned into every old blog post and every founder’s memory, including mine.

The new tiers give you 10,000 free MAU, not 50,000. But AWS grandfathered the old deal: if your user pool was created before November 22, 2024, you keep the 50,000 free allowance — as long as you stay on Lite and don’t touch your tier. The moment you switch tiers to grab a newer feature, you drop to the 10,000 free tier and you can’t go back up.

So the “50,000 free users” that made Cognito legendary is, for anyone starting today, a 10,000-user free tier. Still generous. But it’s a fifth of what the reputation promises, and that gap is exactly the kind of stale number that makes a founder budget wrong. Verify it before you plan around it — which is the whole reason I re-check every price in these posts.

---

The 2024 Change That Actually Stung: M2M Billing

Now the part that generated real anger, and it wasn’t about human logins at all. It was about machine-to-machine (M2M) auth — the client-credentials flow your backend services use to get tokens and talk to each other. No human involved, just microservice A proving to microservice B that it’s allowed in.

For years, M2M on Cognito was effectively free. Then in May 2024, AWS announced two new charges: $6 per month per app client, plus a per-token-request fee. Read that first one again. Six dollars a month for each registered app client, whether or not it ever requested a single token.

That’s the one that hurt. Per-MAU pricing scales with usage — no users, no bill. But a flat per-client subscription punishes your architecture. One writeup walked through a modest setup with 19 services: that’s $114 a month before a single token is issued, for something that cost $0 six months earlier. Teams with proper distributed architectures were suddenly staring at $200–$400/month for the crime of having split their backend into services the way everyone tells you to.

AWS gave existing M2M accounts (configured before May 9, 2024) a 12-month grace period that ended May 9, 2025 — so the bill genuinely “came due” for a lot of people in 2025. The community pushback was loud and sustained, because you couldn’t optimize the fee away. Your services existed; you paid.

To their credit, AWS reversed course. In November 2025 they removed the per-app-client dimension entirely. Now M2M is billed purely on successful token requests — that same 19-service setup dropped to something like $0.13/month. Sanity restored. But the episode is the lesson: on a hyperscaler, a pricing dimension can appear overnight and retroactively tax a decision you made a year ago. You’re a tenant, and the landlord can change the lease.

---

The Part That Isn’t on the Pricing Page: Developer Experience

I could forgive rough pricing if the thing were a joy to use. It isn’t. Cognito’s cost is low; its developer-experience tax is high, and that tax doesn’t show up on any invoice — it shows up in your weekends.

The hosted UI is dated and awkward to customize. The docs are sprawling AWS docs, which means you’ll bounce between fifteen pages to do one thing. Token handling, refresh flows, and the difference between ID tokens, access tokens, and the user-info endpoint are yours to get subtly wrong. Custom sign-up flows mean Lambda triggers — more moving parts, more IAM, more 1 AM debugging. This is the same thing I felt trying to lock down an S3 bucket at midnight: AWS hands you a powerful, enterprise-grade toolbox with the safety off, and assumes you’re a team who knows which end is dangerous. (I wrote that whole story up in AWS cloud security for founders — the anxiety, not the bill, is the real AWS tax.)

When you’re a solo founder, you are not that team. Every hour you spend wrestling Cognito’s DX is an hour not spent on the only thing that matters — getting users in the first place. Auth is plumbing. It should be the 1% of your work that hums quietly in the background. Cognito has a way of becoming 10%.

---

What I’d Actually Reach For Instead

So here’s the Broken Engineer take, and it’s the same shape as my take on every AWS service: Cognito is the technically-cheapest option and almost never the right one for a founder. The pennies you save per MAU get eaten alive by the DX, the surprise-fee risk, and the sheer time cost — unless you’re already deep in AWS with a team who lives in IAM. In that world, fine, Cognito’s the pragmatic call. For everyone else, I’d pay a little more for something that doesn’t fight me.

The friendlier options, with 2026 pricing I actually checked:

• Clerk — the smoothest drop-in auth I’ve used. As of February 2026 the free tier is 50,000 monthly active users (they bill on retained users — someone who signs up and never returns doesn’t count). Pro is about $25/month with published overages above that. Prebuilt components, done in an afternoon. This is where I send most founders.
• Supabase Auth — free for 50,000 MAU, and the Pro plan ($25/month) covers 100,000 MAU, then ~$0.00325/MAU. If you’re already using Supabase for your Postgres, auth is right there in the same box, batteries included.
• WorkOS — its AuthKit layer is free up to 1 million MAU, then you pay per enterprise SSO connection (~$125/month each). Built for the moment a B2B deal asks for SAML — your auth stays free until an enterprise customer whose contract easily covers it walks in.
• Better Auth — the open-source route. Free, you own the code, you self-host. Great if you’re a control freak who’d rather not rent auth at all, and it pairs with whatever database you already run.
• Auth0 — the most mature, most configurable API, if you want deep control and don’t mind wiring more yourself. It also gets pricey fast, so watch the tiers.

Notice the pattern: Clerk and Supabase both hand you a 50,000-user free tier with a dashboard you don’t need a certification to operate — the same headline number Cognito used to be famous for, minus the AWS learning curve and minus the risk of a new fee dimension landing on you next spring. The auth mechanism choice — passwords, passkeys, magic links — is a separate conversation (here’s password vs passkey); this is purely about who hosts the plumbing.

---

The Bottom Line

AWS Cognito’s pricing in 2026 comes down to a few truths. It’s MAU-based across three tiers — Lite from $0.0055, Essentials at $0.015 (the default), Plus at $0.020 with no free tier. New pools get 10,000 free MAU, not the legendary 50,000 that only survives on old grandfathered pools. And the M2M saga — a $6/client fee that ambushed existing users in 2024, then got scrapped in late 2025 — is a clean little parable about renting infrastructure from a company that can rewrite the price list while you sleep.

At true scale, inside AWS, Cognito is genuinely cheap and I won’t knock anyone who’s already there. But if you’re a broke solopreneur choosing auth today, the few dollars you’d save aren’t worth the weekends you’d lose. Flip on Clerk or Supabase Auth, take the same 50k free users with a tenth of the friction, and get back to the product. Security you don’t have to configure is security you can’t misconfigure — and auth you don’t have to babysit is auth that lets you go build.

This is the Broken Engineer Guide. I over-engineer everything, fail at business, and share the scars so you don’t collect your own. Pick the auth that gets out of your way — then go find some users.