Lucia vs Stytch
Pricing
Lucia: Free and open source, deprecated since March 2025
Stytch: Free up to 10,000 MAU, then pay as you go
Description
Lucia: Open-source TypeScript session library, deprecated in March 2025 and replaced by a single-file code example you copy into your app
Stytch: Passwordless authentication API focused on magic links, OTPs, and passkeys
Pros
- The replacement is plain code: one session file you own, with no package to update
- Free, no MAU limits, and your auth data stays in your own database
- The author's Auth Book explains sessions, passwords and OAuth in depth
- Purpose-built for passwordless: magic links, OTPs, passkeys, and biometrics
- Free tier covers 10,000 monthly active users, unlimited organizations and 5 SSO or SCIM connections
- Clean API design with SDKs for React, Next.js, Python, Go, and more
Cons
- The npm package is deprecated: no fixes or security updates
- You build everything yourself: no pre-built login UI, no hosted dashboard
- Requires solid understanding of sessions, cookies, and auth security
- Removing Stytch branding from emails and login screens costs a $99 fee
- Extra SSO or SCIM connections cost $125 each beyond the 5 included
- Traditional email/password auth feels like an afterthought
Details
Lucia was auth stripped down to its essentials: a TypeScript library for session management, with helpers for password hashing, OAuth and token generation. There was no hosted service and no per-user pricing, just code running in your app and storing sessions in your own database.
The author deprecated the npm package in March 2025. The Lucia site and repository now offer a complete single-file session implementation to copy into your project instead, along with the Auth Book as a guide to building auth yourself. That route still suits developers who want full control, but it means owning the security of that code. For auth done in an afternoon, Clerk or Firebase Auth handle it as a managed service, and SuperTokens is an open-source option you can self-host.
Stytch is built around the idea that passwords are a liability. Instead of email/password as the default, it leads with magic links, one-time passcodes, passkeys, and biometric auth. The API is well-designed: you can have passwordless login working in under an hour. It also offers fraud tools such as device fingerprinting, with 10,000 fingerprints included free. Twilio completed its purchase of Stytch on 14 November 2025, and the product continues under the Stytch name.
Pricing is pay as you go with no monthly base fee. The free tier covers 10,000 monthly active users and AI agents, unlimited organizations, 5 SSO or SCIM connections and 1,000 machine-to-machine tokens, and usage above that is billed per unit with no hard caps. Full email customization and removal of Stytch branding cost $99. If your product specifically benefits from passwordless (fewer support tickets, higher conversion on sign-up), Stytch is a strong fit. If you just need standard social login and email/password, Clerk or Firebase Auth are simpler to set up.
Verified
