# FusionAuth vs BuildBase: free to self-host, under a licence worth reading

> FusionAuth Community is free to self-host and publishes no user cap, but it is not open source. What the licence actually restricts, what the paid tiers publish, and what you still build after login.

- Source: https://www.buildbase.app/compare/fusionauth-vs-buildbase
- Section: Comparisons
- Author: Dharmendra Jagodana
- Published: 2026-11-01

## In short

FusionAuth Community is free to self-host with no published user cap, but it ships under the FusionAuth Customer License Agreement, a proprietary agreement. Paid tiers start at $162 a month. BuildBase is not an identity product: it is 20 modules on one instance, with a Free plan and paid plans from $19 a month.

Nearly every directory listing I opened while writing this says FusionAuth
Community is free and open source.

The first half is true. The second half is not, and FusionAuth does not claim it
either: its own licence FAQ says the company has chosen a closed source model
for the core product. The free edition is real, it is genuinely free, and it is
governed by a proprietary agreement that you accept by downloading the software.
Those three things fit together fine. They just do not fit the sentence everyone
keeps repeating.

That matters less than it sounds. A FusionAuth evaluation gets stuck on the
licence; the expensive question is the one nobody asks.

## Which one should you pick

Pick FusionAuth if identity is the whole job and you want to run it yourself.
It is a complete identity server, it costs nothing to self-host, your backend
can be in any language it publishes a client library for, and it will still run
on your hardware the day the vendor stops returning calls. Pick BuildBase if the
login box is the small half of the problem and the real work is workspaces,
roles, plans, quotas, invoices and the mail that goes with them. These two
products overlap at the sign-in form and almost nowhere after it.

## What you are choosing between

FusionAuth is an identity server you deploy. Users, tenants, applications,
groups, tokens, the OAuth 2.0 and OIDC flows around them, plus lambdas for
custom logic and connectors for pulling identities from somewhere else. You run
the binary and you own the database. It is single-purpose software, deep rather
than wide.

BuildBase starts from the workspace instead of the session. Someone signs in,
belongs to workspaces with roles, and each workspace carries a plan, quotas,
credits and invoices. Authentication is one of 20 modules on a single instance.
PlugNode, one of six products of ours that run on it, uses auth, team workspaces
with role-based access control, Stripe billing and usage-based credit metering
out of the same records, which is the part that would otherwise be a mapping
table somebody maintains forever.

Different question, really. FusionAuth asks how identity should work and hands
you most of the controls. We assume it is settled and start at what the account
does next.

## What FusionAuth costs, verified 1 November 2026

Four plans, and the pricing page publishes less than you would expect.

**Community** is free and self-hosted: "Self-host FusionAuth on your own
infrastructure for free," with no user cap stated on the page. **Starter**
starts at $162 a month, billed annually, and includes basic hosting.
**Essentials** and **Enterprise** both read "Starting at $2,970/mo", billed
annually, the first with business hosting and the second with high availability
hosting. I read those cards twice on 1 November 2026 and they carried the same
figure both times, at the page's default selector position of 1,000 monthly
active users.

Treat that $2,970 collision as a reason to call sales rather than a price. The
page sets a monthly active user selector and then publishes no per-MAU rate, no
included-MAU allowance per tier, and no explanation of how moving the selector
changes any of the four cards. Every number carries "Starting at". So the honest
summary is that FusionAuth publishes a floor and a billing unit, and the rest of
the quote is a conversation.

The billing unit is documented far better than the price is. An active user is
anyone who logs in during the period, counted once however often they return.
Non-production instances are exempt. That covers development, UAT, testing and
CI, and instance count does not change the licence cost either, so three nodes
running for availability is still one licence.

Our side is our own published pricing, last checked against the live page on
31 October 2026. Free is $0 with 10,000 monthly active users, 50 workspaces,
1 GB of storage and 2 team seats, and it stops at its allowance rather than
billing over. Launch is $19 a month with 25,000 monthly active users, 1,000
workspaces, 10 GB of storage and 3 team seats. Grow is $49 with 100,000 and
Scale is $99 with 500,000. The paid plans start with a 7-day trial that does
not ask for a card, and yearly billing is ten months for twelve. Three quotas
bill past their allowance on the paid plans: workflow runs at $0.25, $0.15 or
$0.10 per 1,000 runs on Launch, Grow and Scale, web analytics events at $2 per
100,000 events, and storage at $0.10 per GB-month. We publish no uptime figure:
targets vary by plan.

> **Key takeaway:** You cannot build an honest side-by-side dollar table from these two pricing
> pages, and you should distrust one that tries. FusionAuth's published figures
> are floors with no scaling curve attached. Ours are complete prices for a
> different product. The comparison that decides it is not price per user.

## The licence, since nobody quotes it

The agreement at fusionauth.io/license is the FusionAuth Customer License
Agreement, version 2, dated 4 May 2026, and section 2.3 is explicit about how
the free tier enters it: free-tier licensees are bound by downloading the
free-tier software. There is no separate permissive licence underneath.

Section 3 is the part worth reading before you commit. No disassembling,
reverse engineering, modifying or making derivative works, at 3(d). No
distributing, renting, leasing, sublicensing, assigning, transmitting or selling
it onward, at 3(f), and no running it on a service bureau or time sharing basis,
at 3(e). Then 3(g): you may not use the software to create or develop a
competing product or service. Ownership stays put, by section 5.1. Some bundled
third-party components carry their own open source notices, and section 14.1
says those are governed separately.

One more clause is easy to miss. Section 2.3 applies section 2.1 to free-tier
licensees except 2.1.3, which is the software warranty. So the free tier runs
under the section 7 disclaimer: the offerings are provided "AS IS", with no
representations or warranties of any kind.

None of that makes FusionAuth a bad choice. Paid features over a free core is an
ordinary arrangement, and the free tier here is more generous than most. But
"free and open source" and "free under a proprietary agreement with a
no-compete clause and no warranty" are different propositions, and only one of
them is what you are actually agreeing to. If your reason for self-hosting is
that you want terms nobody can revoke, this is the paragraph that decides it,
and [the difference between self-hosted and open
source](/blog/self-hosted-vs-open-source) is worth settling before you pick
either product. [Ory](/compare/ory-vs-buildbase) is the contrast that makes it
legible: its core really is Apache-2.0, and that is a different kind of promise
from a free tier under a customer agreement.

Ours is a smaller promise and not a competing one. There is no free self-hosted
tier: self-hosting is arranged by talking to us, priced per installation, and
that price is not on sale, so there is no figure to give you. Once it is set
up, you create the installation in the dashboard, deploy the compose file, and
the installation checks in. FusionAuth's floor is download and run. Ours is a
conversation first, then an installation that phones home.

## What the free edition actually includes

More than you would guess, and the docs state the rule plainly: Community has
all features not otherwise labeled in the documentation. The question is only
which features carry a label.

Starter adds SAML v2 IdP-initiated login, advanced multi-factor methods and
connectors. Enterprise adds SCIM, threat detection, the tenant manager, the MFA
lambda and application MFA policies; the SCIM API docs carry an "Enterprise plan
required" notice on the page itself.

Read that list the right way round. General SAML v2 support is not labelled,
which puts it in the free tier, and only IdP-initiated login moves to Starter.
A FusionAuth install you pay nothing for can terminate SAML single sign-on for a
customer. That is worth saying plainly, because it is the single biggest thing
FusionAuth gives away that we charge for, and I come back to it below.

## Sign-in methods and SSO

These are not the same kind of list. BuildBase ships a fixed set you switch on:
email and password, magic links, email codes, phone codes, passkeys, Google,
LinkedIn, GitHub, Microsoft, Apple, one OpenID Connect or OAuth 2.0 provider of
your own, Ethereum and Solana wallets, and Enterprise SSO. Around those sit
guest users, usernames, device code sign-in and Google One Tap, which are ways
of using the methods rather than methods themselves. Separately, every app is an OAuth 2.0 authorization server,
which is how agents and third-party apps get access.

FusionAuth gives you the protocols and the configuration surface and lets you
assemble the list, which is the more flexible answer and the more work.

Enterprise SSO is where the two diverge commercially. BuildBase sells SAML and
OIDC sign-in and Directory Sync (SCIM) on the Enterprise plan, through your own
WorkOS account: a customer's IT admin connects their provider from a setup link,
verified domains send each person to their company sign-in, single sign-on can
be required per company, and directory groups map to roles. FusionAuth puts SCIM
on Enterprise too. But its SAML sits in the free tier, so if the only enterprise
question on your roadmap is "can you do SAML", FusionAuth answers it for nothing
and we do not. [Best auth for B2B SaaS](/compare/best-auth-for-b2b-saas) sorts
the wider field by whether you need that this quarter, and the [WorkOS
comparison](/compare/workos-vs-buildbase) covers what our arrangement costs.

| Feature | BuildBase | FusionAuth |
| --- | --- | --- |
| Licence | Proprietary SDK and platform | FusionAuth Customer License Agreement; free tier bound on download |
| Free tier | Free plan; paid plans start with a 7-day trial, no card | Community, self-hosted, no user cap published |
| What gets metered | Monthly active users, 10,000 on Free and 25,000 on Launch | Monthly active users; non-production instances excluded |
| Published entry price | Free; paid plans from $19/mo | Free self-hosted; Starter from $162/mo, billed annually |
| Price transparency | Full price list for every plan | Floors only; no per-MAU rate or allowance published |
| Languages | TypeScript and JavaScript | Seven client libraries, plus Android and iOS SDKs |
| SAML single sign-on | Enterprise plan, through your own WorkOS account | In the free tier; IdP-initiated login from Starter |
| Directory sync (SCIM) | Enterprise plan, through your own WorkOS account | Enterprise plan |
| Billing, email, workflows | Included, 20 modules on one instance | Not part of the product |
| Air-gapped deployment | Not offered | Air-gapped licence, by arrangement with sales |

> **Where FusionAuth wins:** **Your backend does not have to be JavaScript.** FusionAuth publishes client
> libraries for Go, Java, .NET Core, PHP, Python, Ruby and TypeScript, front-end
> SDKs for Angular, React and Vue, a Kotlin SDK for Android and a Swift SDK for
> iOS, plus an OpenAPI spec for anything else. Our SDK is TypeScript, and we do
> not support Vue, Svelte, React Native or native mobile at all. If your API is
> Django or Go, or your product is a native app, FusionAuth is adoptable and we
> are not. That single fact ends this comparison more often than anything else on
> this page.
>
> **SAML for nothing.** General SAML v2 is unlabelled in FusionAuth's docs, which
> puts it in the free self-hosted edition. Our Enterprise SSO is on the Enterprise
> plan, through your own WorkOS account. When a buyer's security review asks the
> SAML question, FusionAuth can answer it on a free install and we send you to a
> sales conversation. That is a real gap and no module count closes it.
>
> **Free at any user count, with no licence fee.** Community publishes no MAU cap.
> You can run it for ten users or a hundred thousand without a licence fee, and
> the only bill is infrastructure and the hours to operate it. Ours is free up to
> 10,000 monthly active users, and past that a paid plan from $19 a month. [The
> real cost of self-hosting against a managed
> service](/blog/self-host-vs-managed-cost) prices the hours either way, but free
> is free.
>
> **It runs where you need it to.** FusionAuth sells an air-gapped licence for
> networks with limited or no connectivity. We have nothing equivalent, and a
> self-hosted installation of ours checks in with our dashboard. For defence, health or
> regulated deployments that is not a preference, it is the requirement.
>
> **Depth in identity we do not match.** Lambdas for custom token and
> registration logic, connectors from Starter for federating against an existing identity
> store, a tenant manager, and threat detection on the Enterprise tier. We ship a
> fixed set of sign-in methods you switch on. If your problem really is identity
> rather than the account built around it, theirs is the deeper toolkit and it is
> not close.

## How to decide

Two questions end this outright.

Is your backend JavaScript, and is your front end web? If not, stop here:
FusionAuth is the only one of the two you can adopt. Does a contract require you
to run identity on your own hardware, air-gapped or otherwise? FusionAuth again.
Read section 3 first, especially 3(g).

If neither lands, the question is what you are actually buying. FusionAuth will
hold your users, run your flows, federate your OAuth clients and terminate SAML,
and it will not invoice anyone, enforce a quota, meter a credit, send a campaign
or run a workflow, because it was never meant to. Those stay yours. [The cost of
building auth yourself](/blog/cost-of-building-auth-yourself) does the
arithmetic for the half FusionAuth does cover, and the half it does not is
usually larger: plans, subscription state, entitlements, usage counters,
invoices, dunning and the mail around all of it. [Auth0
alternatives](/compare/auth0-alternatives) works through the same trap from the
other direction.

So do not let the licence argument eat the evaluation. It is worth twenty
minutes, and the answer is clear once you read section 3. Then go price the
second system, the one that turns a signed-in user into a paying customer,
because that is where the real number is. If the workspace that signs in is also
the record that gets billed, a bundle removes a mapping you would otherwise own
for the life of the product. That cuts both ways: fewer vendors to keep in step,
less freedom to swap one piece out. [What RBAC actually
is](/blog/what-is-rbac) covers the roles half if that is the piece you are
weighing, and
[SuperTokens](/compare/supertokens-vs-buildbase) is the closest sibling
comparison if free self-hosting with paid add-ons is the shape you are shopping
for.

## Sources

FusionAuth figures verified 1 November 2026 against FusionAuth's own pages.
[fusionauth.io/pricing](https://fusionauth.io/pricing) for the four plans, the
free self-hosted Community edition, the $162 Starter floor, the $2,970 shown for
Essentials and Enterprise at the default 1,000 MAU selector position, and the
hosting and support lines.
[fusionauth.io/license](https://fusionauth.io/license) for the FusionAuth
Customer License Agreement version 2 of 4 May 2026, section 2.3 on free-tier
acceptance and the 2.1.3 warranty exclusion, sections 3(d) to 3(g), the section
7 "AS IS" disclaimer, section 5.1 and section 14.1.
[fusionauth.io/license-faq](https://fusionauth.io/license-faq) for the closed
source model, the paid self-hosted licences, and the statement that you
typically do not pay to run Community behind your own web or mobile
application.
[fusionauth.io/docs/get-started/core-concepts/licensing](https://fusionauth.io/docs/get-started/core-concepts/licensing)
for the MAU definition, the exclusion of logins against non-production
instances, the four plan names, the note that instance count does not change
what a licence costs, and the air-gapped licence.
[fusionauth.io/docs/v1/tech/premium-features/](https://fusionauth.io/docs/v1/tech/premium-features/)
for the tier labels and the rule that Community holds everything unlabelled.
[fusionauth.io/docs/apis/scim/](https://fusionauth.io/docs/apis/scim/) carries
the Enterprise requirement on SCIM.
[fusionauth.io/docs/sdks/](https://fusionauth.io/docs/sdks/) lists the client
libraries and SDKs.

BuildBase plans, modules and sign-in methods come from our own constants, last
checked against the live pricing page on 31 October 2026 (PLAN_FACTS).