Vibe coding · Free vibe coding stack · Part 5

Free auth for vibe coding (2026)

How to add free user login to a vibe-coded project — Clerk as the start-here, then WorkOS, Supabase Auth, Kinde, and OSS (Better Auth / Auth.js).

~12 min read

Part 1 of Free vibe coding stack covered free cloud AI API keys. Part 2 was courses. Part 3 was hosting. Part 4 was database and storage. A Neon database without login is an open spreadsheet. Part 5 is auth — sessions you can ship without paying day one.

This chapter is user login. Email (magic links, receipts) is Part 6 — coming next in this series. If you picked Supabase in Part 4 because it bundles Auth, stay on Supabase Auth — do not add Clerk on top of the same app.

Hosted auth map

Copywriter-verified 3 Sep 2026; re-checked 8 Sep 2026 from official docs. Clerk bills monthly retained users (return ≥24h after signup). WorkOS and Supabase bill MAU. Quotas move — screenshot Usage the week you launch.

OSS map

Skip Auth0 and Firebase as primary in this chapter — leftover BaaS. If the agent scaffolded them anyway, one vendor, not two.

Wire it from Cursor

Same loop as Part 4: create the project, copy keys, put them in .env, add the same names on Vercel / Cloudflare / Netlify (Part 3). Never commit .env. Secret keys stay on the server. Paste this if you want the agent to stay on one vendor:

Wire this app to Clerk using NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY from .env.
Walk me through: (1) creating the Clerk application if needed,
(2) putting keys in .env and .gitignore,
(3) the same env vars on the host dashboard,
(4) sign-in / sign-up / a protected route.
Do not add a second auth vendor. Do not put CLERK_SECRET_KEY in client code.
If this app already uses Supabase Auth, stop and keep Supabase — do not add Clerk.

Clerk (start-here)

Clerk is hosted sign-in UI, sessions, and Next.js middleware. Official Hobby is free: 50,000 monthly retained users (MRU) per application, unlimited apps, up to 3 dashboard seats, up to 3 social connections, a fixed 7-day session, and 1-day application-log retention. Custom domain is included on Hobby. A user counts as retained if they come back at least 24 hours after signup — one-time tire-kickers do not fill the meter (“First Day Free”). Pro is $25/mo ($20/mo annual). MFA, production passkeys, remove Clerk branding, and custom session lifetime sit on Pro, not Hobby. Hit the Hobby MRU limit and you get a one-month grace, then you upgrade — Hobby is a hard limit, not pay-as-you-go overage.

This series still starts with Clerk (DX, components, Cursor-friendly) the same way Part 4 starts with Neon, not the cheapest disk. WorkOS wins if the number on the pricing page is the only decision.

1. Create an application at dashboard.clerk.com → API keys.
2. Local: NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY in .env. Host: same names.
3. Add the Clerk provider + middleware. Restrict CLERK_SECRET_KEY to server routes.

WorkOS AuthKit

WorkOS AuthKit is user management with a 1 million MAU free band, then $2,500/mo per extra million. Staging is free. Production AuthKit still requires a payment method on file even if you never cross 1M MAU. Hosted custom domain is $99/mo. Enterprise SSO / Directory Sync start around $125/connection — that is usually the first bill, not MAU.

1. Create an environment → copy WORKOS_API_KEY and WORKOS_CLIENT_ID.
2. Use AuthKit’s hosted UI or the SDK. Keep staging keys out of production.

Supabase Auth

If Part 4 already gave you a Supabase project, Auth is included: 50,000 MAU on Free, social providers, basic MFA. The same 7-day pause applies. Copy the anon key and URL you already have — do not invent Clerk “for nicer UI” beside it.

1. Authentication → providers in the Supabase dashboard.
2. SUPABASE_URL + SUPABASE_ANON_KEY in .env (service role on the server only).

Kinde

Kinde Free: 10,500 MAU, 5 monthly active organizations, unlimited apps, no card. MFA is included on Free. Pro from $25/mo. Users you bill through Kinde Billing (more than USD $4/month) do not count toward MAU. Smaller free band than Clerk or WorkOS — pick it if you also want Kinde’s billing, not as a second auth next to Clerk. Note vs Clerk: Kinde Free includes MFA; Clerk Hobby does not (MFA is Pro).

1. Create an app → KINDE_CLIENT_ID, KINDE_CLIENT_SECRET, KINDE_ISSUER_URL.
2. Set callback URLs for local and the Part 3 host.

Better Auth

Better Auth is TypeScript auth you run. No MAU meter. You store sessions (usually on the Part 4 database) and send magic-link / reset mail via Resend in Part 6 (email & SMS — next in the series). BETTER_AUTH_SECRET and BETTER_AUTH_URL in .env.

Auth.js / NextAuth

Auth.js is the Next-native OSS path. Same deal: you own providers, the database adapter, and email. AUTH_SECRET plus OAuth client IDs. Fine if the scaffold is already NextAuth — do not migrate to Clerk “because the blog said so” mid-demo.

Free vs paid (the honest cliffs)

• Clerk — Hobby is a hard MRU cap. Pro when you need MFA / passkeys, or you outgrow 50k retained users.
• WorkOS — AuthKit MAU is huge; the bill is production extras (custom domain, SSO connections).
• Supabase — Auth is “free” until the project pauses or you need Pro for always-on.
• Kinde — 10.5k MAU is the hobby ceiling unless billed users offset it.
• OSS — $0 vendor fee; you pay in email deliverability and session bugs.

Practical tips

• One auth vendor — Clerk or WorkOS or Supabase Auth or OSS. Two session cookies is how demos rot.
• Secrets on the server — publishable / anon keys in the browser; secret / service role never.
• Callback URLs — localhost plus the Part 3 production domain, both listed in the dashboard.
• Quotas move — Clerk’s unit is MRU as of Feb 2026. Screenshot Usage.

What’s next in Free vibe coding stack

You can log a user in. They still need mail, visibility, and (maybe) a card:

• Part 6 — email & SMS — Resend start-here (coming next)
• Part 7 — monitoring — GSC + GA4 (later in the series)
• Part 8 — payments — Stripe Checkout (series closer)

Browse tools we actually use on vibecoderslife.com/tools (Cursor, Vercel, GitHub — affiliate links marked where active). Clerk is a plain product URL.

FAQ

How do I add free login to a vibe-coded project?

Create a Clerk application, put the publishable + secret keys in .env and on your host, and paste the Cursor prompt above. Do not add a second auth vendor “just in case.”

Clerk vs WorkOS?

Clerk if you want components and Next middleware (this series’ start-here). WorkOS if you need ~1M free MAU and will file a card for production. They are not the same billing unit (MRU vs MAU).

I already use Supabase. Should I add Clerk?

No. Use Supabase Auth. Clerk on top of Supabase is two user tables.

Is Better Auth really free?

The library is. Hosting, Postgres (Part 4), and transactional email (Part 6) are still your problem.

Do I need a credit card?

Not for Clerk Hobby, Supabase Free, Kinde Free, or OSS. WorkOS wants billing info before production. Clerk Pro / Kinde Pro / WorkOS add-ons need a card.