FusionAuth vs BuildBase: free to self-host, under a licence worth reading

Nearly every directory listing I opened while writing this says FusionAuth Community is free and open source.

The first half is true. The second half is not, and FusionAuth does not claim it either: its own licence FAQ says the company has chosen a closed source model for the core product. The free edition is real, it is genuinely free, and it is governed by a proprietary agreement that you accept by downloading the software. Those three things fit together fine. They just do not fit the sentence everyone keeps repeating.

That matters less than it sounds. A FusionAuth evaluation gets stuck on the licence; the expensive question is the one nobody asks.

Which one should you pick

Pick FusionAuth if identity is the whole job and you want to run it yourself. It is a complete identity server, it costs nothing to self-host, your backend can be in any language it publishes a client library for, and it will still run on your hardware the day the vendor stops returning calls. Pick BuildBase if the login box is the small half of the problem and the real work is workspaces, roles, plans, quotas, invoices and the mail that goes with them. These two products overlap at the sign-in form and almost nowhere after it.

What you are choosing between

FusionAuth is an identity server you deploy. Users, tenants, applications, groups, tokens, the OAuth 2.0 and OIDC flows around them, plus lambdas for custom logic and connectors for pulling identities from somewhere else. You run the binary and you own the database. It is single-purpose software, deep rather than wide.

BuildBase starts from the workspace instead of the session. Someone signs in, belongs to workspaces with roles, and each workspace carries a plan, quotas, credits and invoices. Authentication is one of 20 modules on a single instance. PlugNode, one of six products of ours that run on it, uses auth, team workspaces with role-based access control, Stripe billing and usage-based credit metering out of the same records, which is the part that would otherwise be a mapping table somebody maintains forever.

Different question, really. FusionAuth asks how identity should work and hands you most of the controls. We assume it is settled and start at what the account does next.

What FusionAuth costs, verified 1 November 2026

Four plans, and the pricing page publishes less than you would expect.

Community is free and self-hosted: "Self-host FusionAuth on your own infrastructure for free," with no user cap stated on the page. Starter starts at $162 a month, billed annually, and includes basic hosting. Essentials and Enterprise both read "Starting at $2,970/mo", billed annually, the first with business hosting and the second with high availability hosting. I read those cards twice on 1 November 2026 and they carried the same figure both times, at the page's default selector position of 1,000 monthly active users.

Treat that $2,970 collision as a reason to call sales rather than a price. The page sets a monthly active user selector and then publishes no per-MAU rate, no included-MAU allowance per tier, and no explanation of how moving the selector changes any of the four cards. Every number carries "Starting at". So the honest summary is that FusionAuth publishes a floor and a billing unit, and the rest of the quote is a conversation.

The billing unit is documented far better than the price is. An active user is anyone who logs in during the period, counted once however often they return. Non-production instances are exempt. That covers development, UAT, testing and CI, and instance count does not change the licence cost either, so three nodes running for availability is still one licence.

Our side is our own published pricing, last checked against the live page on 31 October 2026. Free is $0 with 10,000 monthly active users, 50 workspaces, 1 GB of storage and 2 team seats, and it stops at its allowance rather than billing over. Launch is $19 a month with 25,000 monthly active users, 1,000 workspaces, 10 GB of storage and 3 team seats. Grow is $49 with 100,000 and Scale is $99 with 500,000. The paid plans start with a 7-day trial that does not ask for a card, and yearly billing is ten months for twelve. Three quotas bill past their allowance on the paid plans: workflow runs at $0.25, $0.15 or $0.10 per 1,000 runs on Launch, Grow and Scale, web analytics events at $2 per 100,000 events, and storage at $0.10 per GB-month. We publish no uptime figure: targets vary by plan.

The licence, since nobody quotes it

The agreement at fusionauth.io/license is the FusionAuth Customer License Agreement, version 2, dated 4 May 2026, and section 2.3 is explicit about how the free tier enters it: free-tier licensees are bound by downloading the free-tier software. There is no separate permissive licence underneath.

Section 3 is the part worth reading before you commit. No disassembling, reverse engineering, modifying or making derivative works, at 3(d). No distributing, renting, leasing, sublicensing, assigning, transmitting or selling it onward, at 3(f), and no running it on a service bureau or time sharing basis, at 3(e). Then 3(g): you may not use the software to create or develop a competing product or service. Ownership stays put, by section 5.1. Some bundled third-party components carry their own open source notices, and section 14.1 says those are governed separately.

One more clause is easy to miss. Section 2.3 applies section 2.1 to free-tier licensees except 2.1.3, which is the software warranty. So the free tier runs under the section 7 disclaimer: the offerings are provided "AS IS", with no representations or warranties of any kind.

None of that makes FusionAuth a bad choice. Paid features over a free core is an ordinary arrangement, and the free tier here is more generous than most. But "free and open source" and "free under a proprietary agreement with a no-compete clause and no warranty" are different propositions, and only one of them is what you are actually agreeing to. If your reason for self-hosting is that you want terms nobody can revoke, this is the paragraph that decides it, and the difference between self-hosted and open source is worth settling before you pick either product. Ory is the contrast that makes it legible: its core really is Apache-2.0, and that is a different kind of promise from a free tier under a customer agreement.

Ours is a smaller promise and not a competing one. There is no free self-hosted tier: self-hosting is arranged by talking to us, priced per installation, and that price is not on sale, so there is no figure to give you. Once it is set up, you create the installation in the dashboard, deploy the compose file, and the installation checks in. FusionAuth's floor is download and run. Ours is a conversation first, then an installation that phones home.

What the free edition actually includes

More than you would guess, and the docs state the rule plainly: Community has all features not otherwise labeled in the documentation. The question is only which features carry a label.

Starter adds SAML v2 IdP-initiated login, advanced multi-factor methods and connectors. Enterprise adds SCIM, threat detection, the tenant manager, the MFA lambda and application MFA policies; the SCIM API docs carry an "Enterprise plan required" notice on the page itself.

Read that list the right way round. General SAML v2 support is not labelled, which puts it in the free tier, and only IdP-initiated login moves to Starter. A FusionAuth install you pay nothing for can terminate SAML single sign-on for a customer. That is worth saying plainly, because it is the single biggest thing FusionAuth gives away that we charge for, and I come back to it below.

Sign-in methods and SSO

These are not the same kind of list. BuildBase ships a fixed set you switch on: email and password, magic links, email codes, phone codes, passkeys, Google, LinkedIn, GitHub, Microsoft, Apple, one OpenID Connect or OAuth 2.0 provider of your own, Ethereum and Solana wallets, and Enterprise SSO. Around those sit guest users, usernames, device code sign-in and Google One Tap, which are ways of using the methods rather than methods themselves. Separately, every app is an OAuth 2.0 authorization server, which is how agents and third-party apps get access.

FusionAuth gives you the protocols and the configuration surface and lets you assemble the list, which is the more flexible answer and the more work.

Enterprise SSO is where the two diverge commercially. BuildBase sells SAML and OIDC sign-in and Directory Sync (SCIM) on the Enterprise plan, through your own WorkOS account: a customer's IT admin connects their provider from a setup link, verified domains send each person to their company sign-in, single sign-on can be required per company, and directory groups map to roles. FusionAuth puts SCIM on Enterprise too. But its SAML sits in the free tier, so if the only enterprise question on your roadmap is "can you do SAML", FusionAuth answers it for nothing and we do not. Best auth for B2B SaaS sorts the wider field by whether you need that this quarter, and the WorkOS comparison covers what our arrangement costs.

How to decide

Two questions end this outright.

Is your backend JavaScript, and is your front end web? If not, stop here: FusionAuth is the only one of the two you can adopt. Does a contract require you to run identity on your own hardware, air-gapped or otherwise? FusionAuth again. Read section 3 first, especially 3(g).

If neither lands, the question is what you are actually buying. FusionAuth will hold your users, run your flows, federate your OAuth clients and terminate SAML, and it will not invoice anyone, enforce a quota, meter a credit, send a campaign or run a workflow, because it was never meant to. Those stay yours. The cost of building auth yourself does the arithmetic for the half FusionAuth does cover, and the half it does not is usually larger: plans, subscription state, entitlements, usage counters, invoices, dunning and the mail around all of it. Auth0 alternatives works through the same trap from the other direction.

So do not let the licence argument eat the evaluation. It is worth twenty minutes, and the answer is clear once you read section 3. Then go price the second system, the one that turns a signed-in user into a paying customer, because that is where the real number is. If the workspace that signs in is also the record that gets billed, a bundle removes a mapping you would otherwise own for the life of the product. That cuts both ways: fewer vendors to keep in step, less freedom to swap one piece out. What RBAC actually is covers the roles half if that is the piece you are weighing, and SuperTokens is the closest sibling comparison if free self-hosting with paid add-ons is the shape you are shopping for.

Sources

FusionAuth figures verified 1 November 2026 against FusionAuth's own pages. fusionauth.io/pricing for the four plans, the free self-hosted Community edition, the $162 Starter floor, the $2,970 shown for Essentials and Enterprise at the default 1,000 MAU selector position, and the hosting and support lines. fusionauth.io/license for the FusionAuth Customer License Agreement version 2 of 4 May 2026, section 2.3 on free-tier acceptance and the 2.1.3 warranty exclusion, sections 3(d) to 3(g), the section 7 "AS IS" disclaimer, section 5.1 and section 14.1. fusionauth.io/license-faq for the closed source model, the paid self-hosted licences, and the statement that you typically do not pay to run Community behind your own web or mobile application. fusionauth.io/docs/get-started/core-concepts/licensing for the MAU definition, the exclusion of logins against non-production instances, the four plan names, the note that instance count does not change what a licence costs, and the air-gapped licence. fusionauth.io/docs/v1/tech/premium-features/ for the tier labels and the rule that Community holds everything unlabelled. fusionauth.io/docs/apis/scim/ carries the Enterprise requirement on SCIM. fusionauth.io/docs/sdks/ lists the client libraries and SDKs.

BuildBase plans, modules and sign-in methods come from our own constants, last checked against the live pricing page on 31 October 2026 (PLAN_FACTS).