FusionAuth review

FusionAuth is a customer identity and access management platform that sits between an application and the people, services or AI agents trying to access it. It provides authentication and authorization through APIs; it is not just a login component embedded in an application. Teams can use it as a hosted service or deploy it themselves, including on-premises, in hybrid environments or in air-gapped deployments.

In a typical stack, an application delegates sign-in and identity management to FusionAuth, then uses its identity services to control access. Authentication options include passkeys, magic links, social logins and multi-factor authentication. Authorization includes role-based access control and fine-grained controls. The platform is designed for B2C, B2B, B2B2C, partner, API and machine-to-machine identity models. Its deployment range gives teams control over where identity data and infrastructure live, while making them responsible for choosing the operating model and integrating the platform into their applications.

FusionAuth describes its identity capabilities as API-driven and exposes them through the FusionAuth API. It also lists webhooks as a feature. The homepage does not identify a CLI, so teams planning command-line administration or automation should confirm the supported workflow in the vendor’s documentation.

The vendor lists SDKs for Angular, OpenAPI, Node.js, .NET Core, React, Ruby, TypeScript, Go, PHP, Python, Java, Vue and JavaScript. Quickstarts cover .NET Core, Angular, Python, iOS, React, Java, Remix, Drupal, JavaScript, Ruby, Flask, Next.js, Rust, Vue, Flutter, WordPress, Go, PHP, Android and Nuxt. Documentation, articles, community resources and security reporting are linked from the developer area.

That coverage gives teams several ways to connect an existing stack, but the SDK and quickstart lists are not identical. Check the documentation for your framework and deployment model, and verify how its examples handle your required authentication flows, token validation and environment configuration.

The Community plan costs $0 and provides self-hosted deployment with unlimited monthly active users (MAUs). It is the clearest fit for teams willing to operate the identity service themselves. The Starter hosted plan starts at 1,000 MAUs and lists one connector, 100 machine-to-machine entities and unlimited identity providers (IDPs). Its annual-billing price is $162 per month. Essentials lists business hosting, five connectors, 1,000 machine-to-machine entities and unlimited IDPs for $240 per month on annual billing. It also includes email support with a 24–48 hour response.

Enterprise includes high-availability hosting, unlimited connectors and machine-to-machine entities, unlimited IDPs, and 24/7 phone and email support. A 99.99% SLA is available, but the plan price is not published. Standalone month-to-month prices for Starter and Essentials are also not published. FusionAuth says pricing depends on plan, hosting and MAUs; the vendor does not publish per-MAU overage rates or add-on prices. Get a quote that covers expected MAU growth, hosting and support before sizing a production budget.

FusionAuth can be self-hosted, but self-hosting does not mean the software is open source. Reddit commenters describe FusionAuth as closed-source; teams should review the vendor’s license terms before adopting it. The free Community plan is a no-cost self-hosted option, not evidence of an open-source license.

The vendor lists self-hosted, dedicated, on-premises, hybrid and air-gapped deployment options. That gives organizations control over deployment location, but it also makes infrastructure operation and upgrades part of the project. The vendor does not publish data export details on the homepage, so ask about user, configuration and audit-data exports, plus the process for leaving a hosted deployment.

Migration effort will depend on how applications use FusionAuth’s APIs, SDKs and identity flows. Keep application code behind an identity boundary where practical, document protocol and token assumptions, and confirm what data and configuration can be exported before you build a long-lived dependency.

The Enterprise plan lists high-availability hosting and offers a 99.99% SLA; confirm the SLA terms, service boundaries and incident process before relying on it. FusionAuth also advertises advanced threat detection, breached-password checks and deployment options for data sovereignty needs. Those features are not a substitute for validating the security controls, compliance requirements and operational responsibilities in your own architecture.

The vendor does not publish API rate limits or per-MAU overage rates on its homepage, so ask how throttling, burst traffic and MAU growth affect a production deployment. Self-hosted teams should plan for operating and upgrading the identity service. Reddit discussions show a practical integration issue: one BookStack setup failed OIDC discovery because the configured and returned issuer values did not match; matching them resolved the problem. Another thread raised concerns about closed-source software and the tradeoff between self-hosting and source visibility. Treat issuer configuration, deployment operations and software access as review items, not afterthoughts.