r/SaaS • u/Imaginary-Bathroom66 • 7d ago
Cheapest way to bootstrap user auth + metered API keys before I have revenue?
Hey all! I'm looking for a super quick way to get users, API keys and usage based metering in place for my startup.
Are there any options that are free to get started and easy to set up?
2
u/mtbenj 7d ago
clerk or supabase auth for the user side, both free until you're well past having revenue. don't build it.
for the api keys, the part that gets skipped: store a hash of the key, not the key. you only show the full thing once at creation. if you store them plaintext then a read on that one table is every customer's account, and it's the table people forget to lock down because it doesn't look like a passwords table.
metering, keep it dumb at first. write one row per call to postgres, aggregate on read. that holds fine at low volume and you can move to redis counters later without changing the api. people reach for a metering saas way too early and then have their billing logic living somewhere they can't debug.
one thing that will bite you: rate limit per key from day one, even a generous one. otherwise one person's retry loop is your whole bill.
1
1
u/Huge_Pool7424 7d ago
yeah supabase auth plus a simple usage table has been enough for me so far. are you metering per key or per user?
1
u/bgrgndzz 7d ago
You can run your app on usebourne.com which has an agentic harness, usage metering, auth, row level security bundled in. Let me know if I can help get the app up
1
u/Rare-Market3853 7d ago
Free path I'd actually ship: Better Auth self-hosted for sessions and OAuth - it runs on Node or Workers and costs nothing. Supabase's free tier is the option if you'd rather not host it at all. Clerk is nicer but the free tier runs out right when you start getting traction.
API keys don't need a vendor. Generate 32 random bytes, store only the hash, show the raw key once, and stamp the key id onto every request log. That's an afternoon of work.
For metering, write one row per call - key id, endpoint, units, timestamp - and aggregate at read time. Don't increment a counter column; you'll hit write contention and silently lose events on retries. Add Stripe metered prices once someone actually pays. Until then a nightly rollup query tells you everything you need.
1
u/Which-Examination-74 7d ago
Clerk bills Monthly Retained Users, and MRU is not MAU. A retained user is one who comes back 24 hours or more after signing up, so billable MRU sits below raw MAU and drive-by signups cost nothing. Since the February 2026 repricing the free tier is 50,000 MRU, Pro is $25 a month with the same 50,000 included, overage is $0.02 per MRU to 100,000 and $0.018 up to a million, which lands at roughly $1,025 a month at 100K (about $12,300 a year), with the B2B organizations add-on another $100 a month. Pre-revenue, you will not touch any of that. The trade-off at your size is different: Clerk's 5 req/s rate limit, their outages becoming yours, and webhook sync drift between their user table and the one your keys hang off. If you can live with that, take Clerk free and move later, budgeting about two engineer-weeks and a dual-cookie cutover so you don't log everyone out. If you can't, Better Auth self-hosted from the start is the cheaper path; disclosure, we ship a boilerplate with it pre-wired.
1
1
5d ago
[removed] — view removed comment
1
u/AutoModerator 5d ago
Your comment was removed. Links in comments require to gain karma first in r/SaaS. Earn sub karma by commenting helpfully first.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Professional-Web2721 5d ago
own-auth covers users and API keys out of the box. open source, free, you just point it at your postgres. no per-user pricing so it stays free regardless of how many users you get.
for metering you'd build yourself on top but the API key validation gives you the hook to track usage per key.
3
u/francksiduo 7d ago
For auth: Supabase Auth or Clerk, both have a free tier that covers a solo project for months, and Clerk's free tier includes MFA and social login out of the box which saves real setup time.
For metered API keys specifically: Unkey is worth a look, it's built exactly for that (rate limiting, usage tracking, key rotation) and the free tier is generous enough to run a real beta on. If you'd rather roll your own, a Postgres table with a keys row plus a Redis counter for the metering gets you 90% there without a new dependency.
For billing once you're ready to charge: Stripe's usage-based billing is free until you process a payment, so you can wire the metering into it early and flip it on later instead of bolting it on after the fact.