FusionAuth is cheaper at scale.

And we're not going to pretend otherwise. Their flat-rate pricing beats every per-MAU vendor including us once you hit roughly 10 000 monthly active users. So this page isn't about beating them on price — it's about telling you honestly when the extra built-ins (SAML IdP, PKI, POPIA residency, audit webhooks) are worth paying more for, and when they aren't.

When WeldForge wins When FusionAuth wins

Pick FusionAuth if …

Being honest about where they're the better answer.

Scale

You're above 25 000 MAU and price is the decision

FusionAuth Essentials is $225/mo flat up to 100 000 MAU. WeldForge Cloud Team at 25 000 MAU is ~$524/mo. We lose that contest, cleanly.

Self-host

You're self-hosting and happy

FusionAuth's community edition is genuinely free and unlimited. If their ops model fits your team — single JAR, single Postgres, good enough docs — stay. Our self-host tier matches them but doesn't materially beat them.

Breadth

You need their specific feature inventory

FusionAuth has a few things we don't: passwordless "magic link" flows, a very rich theming engine, and WebAuthn as a passwordless primary factor. If those are must-haves, they are the call.

Pick WeldForge if …

Where the extra monthly spend pays for itself.

Compliance

Data residency matters — especially POPIA

FusionAuth Cloud runs in US and EU. WeldForge Cloud includes Cape Town (AWS af-south-1). If your data has to stay in South Africa for POPIA or banking-sector reasons, FusionAuth requires you to self-host in ZA yourself.

Protocol

You need first-class SAML IdP mode

Both platforms speak SAML. The difference is emphasis — WeldForge treats per-tenant SAML IdP as a core capability, with every tenant automatically exposing /t/{slug}/saml2/idp/metadata signed with the tenant's own key. FusionAuth supports SAML IdP but the ergonomics are less tenant-native.

PKI

You need to issue client certificates

FusionAuth does not ship internal PKI. WeldForge issues per-tenant CAs, CRLs and OCSP responses in the base tier — if you need mTLS or client-cert auth for a zero-trust rollout, this is the difference between writing Bouncy Castle yourself and not.

Audit

You need HMAC-signed audit webhooks, not log tail

FusionAuth emits events; integrating them with a SIEM or webhook receiver is your problem. WeldForge's outbound webhook subscription with HMAC-SHA256 signatures + retry queue + dead-letter is built in.

API keys

You want scoped API keys (path + method)

FusionAuth has API keys, but they are either full-access or tenant-scoped — no per-endpoint restriction. WeldForge keys carry {path, methods} scopes so a reporting integration can be locked to read-only on specific endpoints.

Managed

You just don't want to run an IdP

Both offer managed hosting. The honest tie-breaker is support responsiveness, residency, and whether you want a smaller vendor that answers emails directly (us) or a larger one with paid premium tiers (FusionAuth).

Pricing at common MAU tiers

Retail list prices for roughly equivalent plans, 2026 Q2. Credit where credit is due: FusionAuth's flat-rate model genuinely wins at scale.

Monthly Active Users	WeldForge	FusionAuth	Winner on price
500	$0 Cloud Starter free	$125 Cloud Starter minimum	WeldForge
1 000	$29 Cloud Starter	$125 Cloud Starter	WeldForge
10 000	$149 Cloud Team	$125 Cloud Starter cap	FusionAuth (by $24)
25 000	$524 Cloud Team + overage	$225 Cloud Essentials	FusionAuth (by $299)
100 000	$1 699 Cloud Business + overage	$225 Cloud Essentials cap	FusionAuth (by $1 474)
250 000	$2 499 Cloud Scale	$425 Cloud Premium	FusionAuth (by $2 074)

Honest call FusionAuth is the price leader once you cross ~10 000 MAU. If your identity platform is a cost-centre and SAML IdP / PKI / POPIA residency aren't hard requirements, they are the right call. If any of those are hard requirements, the per-MAU pricing on our side buys real capability.

Run the numbers for your MAU

Feature-for-feature

Both platforms cover the OIDC + SAML + MFA core; the deltas are in what sits on top.

Capability	FusionAuth Essentials	WeldForge Cloud Team
OAuth 2.0 / OpenID Connect issuer	✓	✓
SAML 2.0 Service Provider + Identity Provider	✓	✓
MFA — TOTP / WebAuthn / SMS / backup	✓	✓
Passwordless magic links	✓	Via MFA + email only
Social logins	✓	✓
LDAP / AD upstream	Enterprise tier	✓
SCIM 2.0	Enterprise tier	✓
Internal PKI (per-tenant CA, CRL, OCSP)	—	✓
HMAC-signed outbound audit webhooks	Events + custom integration	✓ built in with retry + DLQ
Scoped API keys (path + method)	Tenant-scoped only	✓
Service-account tokens with admin role	API keys only	✓
Multi-tenancy	✓ tenants feature	✓ tenant-scoped queries
Themes / login UI customisation	✓ rich templating	✓ CSS + logo
Kickstart / JSON provisioning	✓	Via admin API
POPIA-native data residency	Self-host in ZA yourself	✓ Cape Town region
Self-host (unlimited, free)	✓	✓
Source-available	Free tier EULA-restricted	✓

Migrating from FusionAuth

FusionAuth has a solid export API; both systems speak the same wire protocols, so the migration is straightforward.

Step 1 — Export users from FusionAuth

curl -X POST https://fusionauth.example.com/api/user/search \
    -H "Authorization: $FUSIONAUTH_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"search":{"queryString":"*","numberOfResults":10000}}' \
    > fusionauth-users.json

FusionAuth exports bcrypt or PBKDF2 hashes which WeldForge accepts natively — no password resets.

Step 2 — Export tenants and applications

curl https://fusionauth.example.com/api/tenant \
    -H "Authorization: $FUSIONAUTH_API_KEY" > tenants.json

curl https://fusionauth.example.com/api/application \
    -H "Authorization: $FUSIONAUTH_API_KEY" > applications.json

Step 3 — Import to WeldForge

curl -X POST $HOST/api/admin/migrate/fusionauth \
    -H "x-app-authorization: $TOKEN" \
    -H "Content-Type: application/json" \
    --data-binary @tenants.json

The converter maps FusionAuth tenants → WeldForge tenants, applications → OIDC clients, identity providers → SAML SPs or social providers, and preserves role assignments.

Step 4 — Update issuer URLs

Change OIDC issuer from https://fusionauth.example.com/ to https://sso.weldforge.org/t/<slug>/. The discovery document shape is identical.

Professional services FusionAuth → WeldForge migration done by our engineering team: $3 500 flat, typically 1 week elapsed.

FAQ

Is FusionAuth really open source?

Not strictly — the community edition is free but governed by their EULA with specific usage restrictions. WeldForge's self-host tier is similarly source-available under a commercial licence. Call it a tie on that axis.

Why does FusionAuth beat you on price?

They charge flat-rate tiers; we charge per-MAU overage above each tier. Our model gives smaller customers a genuinely cheap entry ($29 vs their $125 minimum) and bets that mid-market customers will value the extra built-ins enough to justify the crossover. Above ~25 000 MAU, their model wins on pure dollars.

Do you support passwordless magic-link login?

Partially — via email-based MFA flow, not as a primary-factor replacement. If passwordless-first is central to your UX, FusionAuth is stronger.

Will my FusionAuth theme carry over?

No. FusionAuth themes use their own templating engine; WeldForge login customisation is CSS + logo + custom claims. Deep theme work in FusionAuth does not transfer 1:1.

Can I use FusionAuth and WeldForge together?

Yes — federate FusionAuth into WeldForge as an upstream OIDC IdP, or vice versa. Useful during a gradual migration.

Next step Use the cost calculator to see the dollar delta at your actual MAU. If the price gap matters more than the built-in features, FusionAuth is the right answer — we'll say so. If the features matter, read the pricing page or start on a paid tier at $149/mo.