FusionAuth is cheaper at scale.
And we're not going to pretend otherwise. Their flat-rate pricing beats every per-MAU vendor including us once you hit roughly 10 000 monthly active users. So this page isn't about beating them on price — it's about telling you honestly when the extra built-ins (SAML IdP, PKI, POPIA residency, audit webhooks) are worth paying more for, and when they aren't.
Pick FusionAuth if …
Being honest about where they're the better answer.
You're above 25 000 MAU and price is the decision
FusionAuth Essentials is $225/mo flat up to 100 000 MAU. WeldForge Cloud Team at 25 000 MAU is ~$524/mo. We lose that contest, cleanly.
You're self-hosting and happy
FusionAuth's community edition is genuinely free and unlimited. If their ops model fits your team — single JAR, single Postgres, good enough docs — stay. Our self-host tier matches them but doesn't materially beat them.
You need their specific feature inventory
FusionAuth has a few things we don't: passwordless "magic link" flows, a very rich theming engine, and WebAuthn as a passwordless primary factor. If those are must-haves, they are the call.
Pick WeldForge if …
Where the extra monthly spend pays for itself.
Data residency matters — especially POPIA
FusionAuth Cloud runs in US and EU. WeldForge Cloud includes Cape Town (AWS af-south-1). If your data has to stay in South Africa for POPIA or banking-sector reasons, FusionAuth requires you to self-host in ZA yourself.
You need first-class SAML IdP mode
Both platforms speak SAML. The difference is
emphasis — WeldForge treats per-tenant SAML IdP
as a core capability, with every tenant automatically
exposing /t/{slug}/saml2/idp/metadata
signed with the tenant's own key. FusionAuth supports
SAML IdP but the ergonomics are less tenant-native.
You need to issue client certificates
FusionAuth does not ship internal PKI. WeldForge issues per-tenant CAs, CRLs and OCSP responses in the base tier — if you need mTLS or client-cert auth for a zero-trust rollout, this is the difference between writing Bouncy Castle yourself and not.
You need HMAC-signed audit webhooks, not log tail
FusionAuth emits events; integrating them with a SIEM or webhook receiver is your problem. WeldForge's outbound webhook subscription with HMAC-SHA256 signatures + retry queue + dead-letter is built in.
You want scoped API keys (path + method)
FusionAuth has API keys, but they are either full-access
or tenant-scoped — no per-endpoint restriction.
WeldForge keys carry {path, methods}
scopes so a reporting integration can be locked to
read-only on specific endpoints.
You just don't want to run an IdP
Both offer managed hosting. The honest tie-breaker is support responsiveness, residency, and whether you want a smaller vendor that answers emails directly (us) or a larger one with paid premium tiers (FusionAuth).
Pricing at common MAU tiers
Credit where credit is due: FusionAuth's flat-rate model genuinely wins at scale, and the table below says so.
| Monthly Active Users | WeldForge | FusionAuth | Winner on price |
|---|---|---|---|
| 500 | $0 Cloud Starter free | $125 Cloud Starter minimum | WeldForge |
| 1 000 | $29 Cloud Starter | $125 Cloud Starter | WeldForge |
| 10 000 | $149 Cloud Team | $125 Cloud Starter cap | FusionAuth (by $24) |
| 25 000 | $524 Cloud Team + overage | $225 Cloud Essentials | FusionAuth (by $299) |
| 100 000 | $1 699 Cloud Business + overage | $225 Cloud Essentials cap | FusionAuth (by $1 474) |
| 250 000 | $2 499 Cloud Scale | $425 Cloud Premium | FusionAuth (by $2 074) |
Feature-for-feature
Both platforms cover the OIDC + SAML + MFA core; the deltas are in what sits on top.
| Capability | FusionAuth Essentials | WeldForge Cloud Team |
|---|---|---|
| OAuth 2.0 / OpenID Connect issuer | ✓ | ✓ |
| SAML 2.0 Service Provider + Identity Provider | ✓ | ✓ |
| MFA — TOTP / WebAuthn / SMS / backup | ✓ | ✓ |
| Passwordless magic links | ✓ | Via MFA + email only |
| Social logins | ✓ | ✓ |
| LDAP / AD upstream | Enterprise tier | ✓ |
| SCIM 2.0 | Enterprise tier | ✓ |
| Internal PKI (per-tenant CA, CRL, OCSP) | — | ✓ |
| HMAC-signed outbound audit webhooks | Events + custom integration | ✓ built in with retry + DLQ |
| Scoped API keys (path + method) | Tenant-scoped only | ✓ |
| Service-account tokens with admin role | API keys only | ✓ |
| Multi-tenancy | ✓ tenants feature | ✓ tenant-scoped queries |
| Themes / login UI customisation | ✓ rich templating | ✓ CSS + logo |
| Kickstart / JSON provisioning | ✓ | Via admin API |
| POPIA-native data residency | Self-host in ZA yourself | ✓ Cape Town region |
| Self-host (unlimited, free) | ✓ | ✓ |
| Source-available | Free tier EULA-restricted | ✓ |
Migrating from FusionAuth
FusionAuth has a solid export API; both systems speak the same wire protocols, so the migration is straightforward.
Step 1 — Export users from FusionAuth
curl -X POST https://fusionauth.example.com/api/user/search \
-H "Authorization: $FUSIONAUTH_API_KEY" \
-H "Content-Type: application/json" \
-d '{"search":{"queryString":"*","numberOfResults":10000}}' \
> fusionauth-users.jsonFusionAuth exports bcrypt or PBKDF2 hashes which WeldForge accepts natively — no password resets.
Step 2 — Export tenants and applications
curl https://fusionauth.example.com/api/tenant \
-H "Authorization: $FUSIONAUTH_API_KEY" > tenants.json
curl https://fusionauth.example.com/api/application \
-H "Authorization: $FUSIONAUTH_API_KEY" > applications.jsonStep 3 — Import to WeldForge
curl -X POST $HOST/api/admin/migrate/fusionauth \
-H "x-app-authorization: $TOKEN" \
-H "Content-Type: application/json" \
--data-binary @tenants.jsonThe converter maps FusionAuth tenants → WeldForge tenants, applications → OIDC clients, identity providers → SAML SPs or social providers, and preserves role assignments.
Step 4 — Update issuer URLs
Change OIDC issuer from
https://fusionauth.example.com/ to
https://sso.weldforge.org/t/<slug>/. The
discovery document shape is identical.
FAQ
Is FusionAuth really open source?
Not strictly — the community edition is free but governed by their EULA with specific usage restrictions. WeldForge's self-host tier is similarly source-available under a commercial licence. Call it a tie on that axis.
Why does FusionAuth beat you on price?
They charge flat-rate tiers; we charge per-MAU overage above each tier. Our model gives smaller customers a genuinely cheap entry ($29 vs their $125 minimum) and bets that mid-market customers will value the extra built-ins enough to justify the crossover. Above ~25 000 MAU, their model wins on pure dollars.
Do you support passwordless magic-link login?
Partially — via email-based MFA flow, not as a primary-factor replacement. If passwordless-first is central to your UX, FusionAuth is stronger.
Will my FusionAuth theme carry over?
No. FusionAuth themes use their own templating engine; WeldForge login customisation is CSS + logo + custom claims. Deep theme work in FusionAuth does not transfer 1:1.
Can I use FusionAuth and WeldForge together?
Yes — federate FusionAuth into WeldForge as an upstream OIDC IdP, or vice versa. Useful during a gradual migration.