Aeion Identity vs Auth0, Okta, Microsoft Entra

Auth0 pricing model:

``` Free tier: 7,500 MAU, limited features Standard: $0.023/MAU + $0.005/authorized API call Standards: $0.001/MAU for standards protocols Enterprise: Custom pricing ($20K-78K/month)

At 1,000 MAU (Standard): 1,000 × $0.023 = $23/month in MAU fees + 50,000 API calls × $0.00005 = $2.50/month + Standards: 50,000 × $0.00001 = $0.50/month = $26/month minimum

At 10,000 MAU (Standard): = $230/month + API calls

At 50,000 MAU (Enterprise): = $20,000/month minimum (before overages) ```

Okta pricing model:

``` Workforce Identity Cloud: $2-6/user/month All features: $6/user/month minimum

At 100 users: $2,400/year At 500 users: $12,000/year At 1,000 users: $24,000/year (minimum) ```

Microsoft Entra pricing:

``` Entra ID P1: $6/user/month Entra ID P2: $9/user/month (with risk-based Conditional Access) B2C: $0-0.00125/MAU (separate product)

At 100 users with P1: $7,200/year At 500 users with P2: $54,000/year ```

Aeion Identity: $0/month — included with every Aeion OS deployment.

The math at 500 users, 1 year:

Auth0 Enterprise: ~$20K/month × 12 = $240,000/year Okta (P2): 500 × $9 × 12 = $54,000/year Microsoft Entra (P2): 500 × $9 × 12 = $54,000/year Aeion Identity: $0/year

Auth0 Standard ($0.023/MAU):

• ✅ SAML 2.0, OIDC, PKCE
• ✅ Social login (30+ providers)
• ✅ TOTP, WebAuthn MFA
• ❌ Advanced threat detection: Paid add-on (~$0.05/MAU)
• ❌ Custom domains: Paid add-on
• ❌ Audit logs: Paid add-on (Log Streaming)
• ❌ Password breach detection: Paid add-on
• ❌ Customizable email templates: Paid add-on

Okta ($2-6/user/month):

• ✅ SSO, MFA, basic RBAC
• ❌ Full RBAC: Requires $6/user/month tier
• ❌ Lifecycle automation: Paid add-on
• ❌ Advanced AD integration: Separate product
• ❌ Audit logs: Paid add-on
• ❌ Custom branding: Paid add-on

Aeion Identity (free):

• ✅ Everything Auth0 Standard has
• ✅ Advanced threat detection (risk scoring, suspicious login alerts)
• ✅ Audit logs (90-day history, included)
• ✅ Scoped API keys with IP allowlists
• ✅ Password breach detection (configurable complexity, rotation, and breach checks)
• ✅ Billing-integrated RBAC (role elevation on subscription)
• ✅ Encrypted secrets (AES-256-GCM, not vendor-managed)

You're not just saving money. You're getting more features.

Auth0 and Okta encryption model:

``` Your data: encrypted by Auth0's/Okta's keys Your MFA secrets: stored by Auth0/Okta Your OAuth tokens: managed by Auth0/Okta Encryption keys: Auth0/Okta infrastructure

If Auth0/Okta is breached → your keys are in their key store If Auth0/Okta goes bankrupt → your MFA secrets are gone If Auth0/Okta changes pricing → you have no negotiating power ```

Aeion Identity encryption model:

• MFA (TOTP) secrets are encrypted at rest with AES-256-GCM, using a key derived specifically for that secret type
• OAuth refresh tokens are encrypted at rest with AES-256-GCM, using their own derived key
• Magic link tokens are encrypted at rest with AES-256-GCM
• Keys are derived via PBKDF2 from a master key that lives only in your deployment's environment configuration — never stored in the database

Why this matters:

• Your MFA secrets are encrypted with your own keys
• Your OAuth tokens are encrypted with your own keys
• If Aeion OS infrastructure is breached, the attacker gets encrypted blobs they can't decrypt
• If you want to migrate to another system, you control the decryption keys

Auth0/Okta: "Trust us with your keys." Aeion Identity: "You own your keys."

Auth0/Okta basic anomaly detection:

``` Auth0: "Unusual login detected" — binary flag → Just sends an alert email → No risk score, no blocking

Okta: "Risk-based authentication" — requires P2 ($9/user/month) → Risk score (0-100) → Can block logins with Conditional Access policies → But: requires additional configuration, separate product ```

Aeion Identity suspicious login detection:

Aeion combines dozens of signals — first-time IP address, first-time country, first-time device, off-hours login, repeated failed attempts before success, known proxy/VPN activity, known bot activity, and more — into a single risk score for every login attempt. Attempts that cross a suspicion threshold trigger an immediate alert email; attempts that cross a higher threshold are blocked outright. Every risky event is logged with its full set of contributing factors for audit.

Device fingerprinting:

Aeion recognizes returning devices using browser and OS signals — user agent, screen resolution, timezone, language, platform, and rendering fingerprints. A login from a brand-new device nudges the risk score up; a login from a known, previously-seen device doesn't add any risk penalty.

Auth0 and Okta don't give you this depth of risk analysis in their base tiers. You pay for it, and then you configure it yourself.

Auth0 API Keys:

``` Auth0 Management API uses OAuth tokens, not API keys For your own APIs: you use Auth0's rule engine No true API key management (per-key permissions, IP allowlists)

Better suited for: Auth0-as-IdP for SaaS apps Poorly suited for: Machine-to-machine API access ```

Okta API Access:

API Access Management: $3/user/month (separate from core SSO) Supports OAuth 2.0 scopes Supports IP allowlists No API key management for non-OAuth APIs

Aeion Identity API Key Service:

```typescript // True API key management: const apiKey = await apiKeyService.createApiKey({ name: "CRM Integration", userId: "usr_abc123", scopes: ["crm.contacts.read", "crm.contacts.write", "crm.deals.read"], rateLimit: 1000, // requests per minute allowedIps: ["203.0.113.0/24"], // CIDR notation expiresAt: "2027-01-01", // Optional expiry });

// Key format: ak_<unique-id>_<random32chars> // SHA-256 hash stored — full key shown only once at creation

// Rate limiting: sliding window, enforced per key // IP allowlisting: CIDR matching // Scoping: per-permission granularity ```

Use cases Aeion Identity handles:

• CRM integration: crm.contacts.read, crm.deals.read
• Analytics dashboard: bi.reports.read, bi.charts.read
• Mobile app backend: users.profile.read, commerce.orders.read
• Webhook consumer: webhooks.write + IP allowlist for the webhook sender

Each API key is independently:

• Scoped to specific permissions
• Rate-limited (per-key, configurable)
• IP-allowed (CIDR notation, multiple ranges)
• Expirable (or permanent)
• Revocable (immediate, Redis-backed)

Auth0/Okta RBAC:

``` Auth0: Rules + Roles + Permissions → You define roles (admin, member, etc.) → You assign permissions to roles → You assign roles to users → Manual process for every role change

Okta: Groups + Application Assignments → You manage groups in Okta → You assign apps to groups → When a user upgrades/downgrades → you manually update their group

Problem: Billing and identity are disconnected. When a user subscribes → someone manually updates their role. When a user cancels → someone manually updates their role. ```

Aeion Identity billing integration:

When a user's subscription changes, Aeion automatically elevates or demotes their role — no manual sync required:

• Subscribe → immediately elevated to the plan's role
• Cancel or expire → immediately demoted back to a standard member role

This happens through Aeion's built-in event system, with zero custom integration code required.

What this means:

• User subscribes → immediately gets premium features, no manual intervention
• User cancels → immediately loses premium features, no manual intervention
• User upgrades → immediately gets new plan's features
• User downgrades → immediately restricted to new plan's features

With Auth0/Okta: You need a process (and a person) to manage role changes. With Aeion Identity: It's automatic.