Buyer guide · ciam
How to choose a CIAM platform
How product, security, and engineering teams should evaluate Customer Identity (CIAM) platforms — registration, MFA, B2B, fraud, and compliance.
Quick answer
How to choose a CIAM platform
Short answer
For consumer or B2B SaaS, choose a CIAM that fits your registration model, scale, and privacy obligations. Look for passwordless and social login, frictionless MFA, B2B/multi-tenant support if you sell to enterprises, strong fraud signals, fine-grained authorization, and clear data residency. Build vs buy is a serious question — buy unless identity is your product.
- Best for
- Product leaders, CTOs, security engineers, and identity architects at consumer apps and B2B SaaS choosing where customers sign up, sign in, and manage accounts. Especially relevant if you are facing a build-vs-buy decision or migrating off a homegrown auth system.
- When to choose
- CIAM choice matters most when you are launching a new product, scaling past 50K MAU, adding B2B enterprise customers who demand SSO, replacing homegrown auth, or facing GDPR/CCPA/LGPD obligations. Mistakes are expensive because you cannot easily migrate users mid-flight.
- When not to choose
- Start from your customer model. B2C-only? Optimize for conversion and fraud. B2B-only? Optimize for tenant SSO and SCIM. Mixed? Validate that one platform can do both without losing on either side. Then run a 2-week DX evaluation with your real engineers, not your evaluator. Model 24-month MAU cost.
- Related tools & categories
- Run IAM Stack FinderRequest vendor shortlist
Who this guide is for
Product leaders, CTOs, security engineers, and identity architects at consumer apps and B2B SaaS choosing where customers sign up, sign in, and manage accounts. Especially relevant if you are facing a build-vs-buy decision or migrating off a homegrown auth system.
When this matters
CIAM choice matters most when you are launching a new product, scaling past 50K MAU, adding B2B enterprise customers who demand SSO, replacing homegrown auth, or facing GDPR/CCPA/LGPD obligations. Mistakes are expensive because you cannot easily migrate users mid-flight.
How to choose
Start from your customer model. B2C-only? Optimize for conversion and fraud. B2B-only? Optimize for tenant SSO and SCIM. Mixed? Validate that one platform can do both without losing on either side. Then run a 2-week DX evaluation with your real engineers, not your evaluator. Model 24-month MAU cost.
Key buying criteria
Authentication UX
Passwordless (magic link, OTP, passkeys), social login, biometric, and clean drop-in UI components. Friction kills conversion.
B2B / multi-tenant
If you sell to enterprises, you need org-scoped users, SSO/SAML per tenant, SCIM provisioning, and role hierarchies inside each org. Not all CIAM vendors do this well.
Authorization
Beyond login, how do you express "who can do what on which resource?" RBAC, ABAC, ReBAC, or fine-grained policies (OPA, Cedar, Cerbos, OpenFGA-style).
Fraud and abuse
Bot detection, credential stuffing protection, device fingerprinting, impossible travel, and account takeover signals. Especially important for fintech, marketplaces, gaming, and crypto.
Privacy and residency
GDPR, CCPA, LGPD, regional data residency, consent management, and the right to be forgotten. Plan for EU + US at minimum.
Scale and pricing model
MAU-based pricing rewards or punishes you depending on your usage curve. Free B2C users + paying B2B users on the same platform can get expensive fast.
Developer experience
SDKs in your stack, sane local dev story, webhooks/hooks for custom logic, and clean migration tooling for password hashes.
Compliance and certifications
SOC 2 Type II, ISO 27001, HIPAA, PCI when relevant, and vendor security posture you can defend to your customers.
Evaluation checklist
- Defined your user model (B2C, B2B, B2B2C, mixed)
- Mapped expected MAU growth over 18 months
- Decided required auth factors (password, passkey, OTP, social)
- Decided whether you need per-tenant SSO/SCIM for enterprise customers
- Defined authorization model (RBAC vs ABAC vs ReBAC)
- Mapped fraud / ATO risk tolerance
- Confirmed data residency obligations
- Tested password / user import from incumbent
- Reviewed hosted vs embedded UI trade-offs
- Modeled MAU cost at 3x today's traffic
Common vendor categories
Auth0 (Okta), Microsoft Entra External ID, Ping, ForgeRock, Thales OneWelcome, IBM Security Verify. Deep features, certifications, premium pricing.
Clerk, Stytch, WorkOS, Frontegg, SuperTokens. Strong DX, modern UIs, B2B-friendly, lighter enterprise tooling.
Keycloak, Zitadel, Ory, SuperTokens (self-hosted). Best when you want full control and have engineering capacity.
Implementation considerations
- Plan migration first — password hash export is the single hardest part of switching CIAM.
- Use a hosted login page or universal login before embedding components — easier to iterate.
- Stand up a real fraud profile before launching public signup.
- Wire account recovery flows and test them; account recovery is where most ATO happens.
- Audit consent and privacy flows before go-live in EU / California.
Pricing considerations
- Most CIAMs price per MAU; some price per active user, some per total user, some per token.
- B2B add-ons (SAML SSO, SCIM, audit log) are typically separate paid SKUs.
- Fraud, bot defense, and advanced MFA often cost extra.
- Build TCO over 24 months at projected scale — surprises are common at 100K+ MAU.
Questions to ask vendors
- Show your default sign-up and sign-in flows on mobile web — no editing.
- What is your bot/credential-stuffing posture? Native or 3rd-party?
- How do you support per-tenant SSO and SCIM at scale?
- Show me passkey enrollment end-to-end.
- What is your data residency footprint today and roadmap?
- How do you handle password hash migration from bcrypt/argon2/scrypt/PBKDF2?
- What does MAU mean precisely in your pricing — and what counts as inactive?
- Show me a real customer's audit and event stream.
- Compliance + DPA + sub-processor list?
- What happens to our data if we leave?
Common mistakes
- Building auth in-house because it 'looks simple.'
- Choosing a B2C-only CIAM and then trying to sell to enterprises with SSO requirements.
- Ignoring fraud and bots until after launch.
- Underestimating MAU costs at scale.
- Forgetting to test account recovery and impersonation flows.
- No password migration plan when switching vendors.
- Coupling identity tightly to a single SDK with no abstraction layer.
Recommended related vendors
Thales OneWelcome
CIAM platform from Thales (via the OneWelcome acquisition) focused on customer identity, consent and B2B / B2C use cases, with strong EU data residency.
LoginRadius
CIAM platform offering social login, SSO, MFA, consent and progressive profiling, oriented toward customer-facing apps.
Transmit Security
Identity security platform focused on passwordless authentication, identity verification and fraud prevention for CIAM use cases.
Ory
Open source identity, authorization and zero trust stack (Kratos, Hydra, Keto, Oathkeeper) available self-hosted or as Ory Network SaaS.
Zitadel
Open source identity and access platform with built-in multi-tenancy, SSO, MFA and a managed Zitadel Cloud SaaS.
SuperTokens
Open source auth library with prebuilt UI, session management and self-hosted or managed deployment options.
Okta
Okta is a leading cloud-native identity and access management platform offering SSO, MFA, lifecycle management, and identity governance for enterprise workforce and customer-facing applications.
Stytch
Stytch is an API-first authentication platform offering passwordless authentication (magic links, OTPs, passkeys), session management, and B2B organization management with a clean, headless developer experience.
Auth0
Auth0 is a developer-centric customer identity and access management (CIAM) platform offering authentication, authorization, and user management for web and mobile applications, now operating as Okta Customer Identity Cloud.
Frontegg
Frontegg provides a full user management and authentication platform for B2B SaaS companies, including enterprise SSO, multi-tenancy, RBAC, audit logs, and self-service admin portals for end customers.
WorkOS
WorkOS provides a developer API for adding enterprise identity features — SSO, SCIM directory sync, audit logs, and admin portals — to B2B SaaS applications, enabling faster enterprise sales readiness.
Clerk
Clerk provides drop-in authentication UI components and a complete user management platform for React, Next.js, and modern web applications, including B2B organization management and enterprise SSO.
Related comparison pages
Related resources
Related glossary terms
Plain-language definitions for the concepts on this page.
Frequently asked questions
Should we build auth in-house?
Almost never. Identity is a moving target — passkeys, OAuth 2.1, fraud, compliance — and the engineering opportunity cost is huge. Build only if identity is the product.
What is the difference between IAM and CIAM?
IAM is for employees and contractors (workforce). CIAM is for your customers and end users. CIAM puts more weight on UX, scale, fraud, and privacy; IAM puts more weight on governance, lifecycle, and provisioning.
Is Auth0 still the default?
It is widely adopted and feature-rich but not always the right fit at startup price points or for opinionated B2B. Clerk, Stytch, WorkOS, and Frontegg compete strongly in different niches.
Do I need passkeys today?
They are not mandatory but rapidly becoming a competitive UX advantage. Choose a CIAM that supports them so you can roll them out when ready.
Self-hosted CIAM — when is it the right call?
When data residency or cost requires it, or when identity is core to your product. Keycloak, Zitadel, Ory, and SuperTokens are credible options.