Include the application to see where authentication sits in the operating budget. For the illustrative read-heavy CRUD app at 1M active and retained users, app + Nathan is $1,278.57/month, versus $17,911.65 with Clerk Pro. Authentication accounts for 46.3% versus 96.2% of these modeled totals. Common app hosting is $686.65; account allowances apply once. Incremental operator time and implementation costs are additional.
Nathan can materially reduce the recurring authentication bill as retained usage grows. Cloudflare charges for small units of compute, requests and database work instead of each retained identity. In the moderate example below, one million monthly retained users cost an estimated $328.65/month on Cloudflare, or $483.65 including authentication email, compared with $17,225/month for Clerk Pro at published monthly rates. That is a modeled cash reduction of 97.2%, or $16,741/month, before operator time and implementation costs. Annualizing unchanged prices and usage gives $200,896; this is not a twelve-month invoice forecast.
The identity-only advantage is much smaller near 50,000 users: Clerk Pro and that Nathan example both cost $25/month. The app + auth totals differ because shared allowances and per-request policy work change the bill. Clerk’s free plan is cheaper for basic authentication within its limits. The economic case for Nathan is strongest when many users return, the workload is efficient and the operator can maintain a security-sensitive identity service.
Use a read-heavy task or notes app as a concrete example. It serves 1,000 dynamic API requests per active user/month, with 90% reads, 10% mutations and bounded small records. The same Workers/D1 application runs in both alternatives. Nathan also budgets one live policy check on every API request. These are representative assumptions, not measured “typical” industry usage.
At 1M active and retained users, the app alone is $686.65/month. Add Nathan and the cash total is $1,278.57; add Clerk Pro and it is $17,911.65. The total modeled cash reduction is 92.9%. Prices are current through November 2026; labor and omitted services are discussed below. [2] [3] [1] [9]
| Registered = active = retained | Common app | App + Nathan | App + Clerk Pro | Total cash reduction |
|---|---|---|---|---|
| 50,000 | $19.60 | $43.45 Auth 54.9% | $44.60 Auth 56.1% | 2.6% |
| 51,000 | $20.04 | $43.97 Auth 54.4% | $65.04 Auth 69.2% | 32.4% |
| 100,000 | $41.55 | $81.25 Auth 48.9% | $1,066.55 Auth 96.1% | 92.4% |
| 250,000 | $132.40 | $251.65 Auth 47.4% | $3,857.40 Auth 96.6% | 93.5% |
| 1,000,000 | $686.65 | $1,278.57 Auth 46.3% | $17,911.65 Auth 96.2% | 92.9% |
| 2,000,000 | $1,437.05 | $2,671.49 Auth 46.2% | $33,662.05 Auth 95.7% | 92.1% |
| 5,000,000 | $3,726.65 | $6,850.25 Auth 45.6% | $80,951.65 Auth 95.4% | 91.5% |
Allocate the common app bill first, then attribute the incremental bill to authentication. At 1M users, Nathan authentication adds $591.92/month (46.3% of its total); Clerk adds $17,225.00 (96.2% of its total).
Nathan: common app $686.65 + auth $591.92 = $1,278.57
Clerk: common app $686.65 + auth $17,225.00 = $17,911.65
The bars show proportions: each bar is 100% of its own stack’s total, not the same dollar amount. Gray is the common app; color is authentication.
| CRUD input | Illustrative baseline | Billing interpretation |
|---|---|---|
| Usage | 1,000 API requests/active user/month | 50/day on 20 active days; one business API request invokes one Worker. |
| Operation mix | 90% indexed reads/lists; 10% creates/updates/deletes | A list scans 20 rows; a mutation reads 2 and bills 3 writes including table/index effects. |
| App CPU | 3 CPU-ms/read; 5 CPU-ms/mutation | Whole app-handler budget includes local token verification on both sides; network wait is excluded. |
| App storage | 100 decimal kB/registered user at rest | 50 bounded records × 1 kB × 2 total table/index/metadata overhead; additional growth and business audit storage need another budget. |
| Public static assets | 2,000 requests/active user/month | Public SPA shell/JS/CSS/images go directly to Workers Static Assets. No Worker invocation or Workers Caching; private API data remains protected. |
| App diagnostic logs | 1 event/API request, sampled at 1%; 1 kB/event | Auth keeps its original 100% log budget. Required security audits are retained separately, not sampled away. |
| Nathan protected-Worker check | 1 same-account service-binding check/API request | Additional 2 CPU-ms, 10 row reads, zero writes and 1 diagnostic event sampled at 1%. No second public request fee. |
| Populations | Registered = app-active = Clerk-retained in scale table | Calculator separates active app use from MRU; storage follows registered accounts. |
Common app = bill(app meters) Nathan total = bill(app + identity + Nathan policy meters) + auth email Clerk total = bill(app meters) + Clerk Pro Nathan auth increment = Nathan total − Common app Auth share = auth increment ÷ that stack’s total
Apply one $5 Workers base and one set of request/CPU/D1/log allowances to each alternative’s Cloudflare account. Nathan’s auth share includes the extra bill when identity pushes an app meter over an allowance. Adding the old standalone $483.65 identity estimate to $686.65 app hosting would give $1,170.30 and understate this protected-Worker scenario. The correct combined figure is $1,278.57. Incremental attribution is a budgeting convention; another cost-center allocation can change the percentages without changing the invoice total.
The same-account app-policy subcall adds CPU, row reads and logs, no additional request fee. A gateway wrapper must count the public request once with combined CPU. An HTTP/cross-account implementation or additional session writes requires different inputs. The earlier identity-only gateway scenarios are never added on top of these already-counted CRUD API requests. [2] [5]
The app CPU budget includes local token validation for both providers. Nathan’s extra live policy path is projected engineering work for Worker authorization; it is not proof of the agreed 60-second revocation guarantee. Clerk’s local-token path alone does not establish equivalent live group/deprovisioning behavior; any additional equivalent controls need implementation and cost evaluation. Feature parity is unverified.
900M reads + 100M mutations create 18.2B app row reads and 300M billed writes. One billion Nathan policy checks add 2B CPU-ms and 10B reads. The original identity example adds 60M dynamic requests, 500M CPU-ms, 720M reads and 320M writes. All are assumptions.
| Meter at 1M users | App only → app + Nathan usage | App-only bill → combined bill |
|---|---|---|
| Workers plan | One paid account in either stack | $5.00 → $5.00 |
| Dynamic requests | 1B API → 1.06B API + identity; policy subcalls add no request fee | $297.00 → $315.00 |
| Workers CPU | 3.2B → 5.7B CPU-ms | $63.40 → $113.40 |
| D1 reads | 18.2B → 28.92B rows; one 25B allowance | $0.00 → $3.92 |
| D1 writes | 300M → 620M billed rows; one 50M allowance | $250.00 → $570.00 |
| D1 storage | 100 → 112 GB aggregate; one 5 GB allowance | $71.25 → $80.25 |
| Diagnostic logs | 10M → 80M retained events; current prices | $0.00 → $36.00 |
| Public static assets | 2B direct static requests in either stack | $0.00 → $0.00 |
| Cloudflare cash subtotal | All account meters combined | $686.65 → $1,123.57 |
| Nathan lifecycle email | 200,000 emails; selected Resend formula | Add $155.00 to the Nathan stack |
Combined Cloudflare $1,123.57 + auth email $155 = $1,278.57. Subtract app-only $686.65 to attribute $591.92 to Nathan auth. Clerk’s equivalent cash sum is app-only $686.65 + Pro $17,225 = $17,911.65. This leaves $16,633.08/month before incremental labor/tooling/development, or about 166.3 additional operator hours at $100/hour. At 51K users the $21.07 gap covers only about 12.6 minutes.
From December 1, with the same usage and announced log prices, the combined model becomes $1,250.94 for app + Nathan and $17,911.65 for app + Clerk. App + Nathan emits 80 GB/month of assumed logs, with 18.67 GB-month retained; the new log bill is about $8.37 instead of $36. [6]
| App workload at 1M users | App + Nathan | App + Clerk | Auth share: Nathan / Clerk |
|---|---|---|---|
| Light CRUD: 100 API requests/user/month | $630.25 | $17,334.05 | 82.7% / 99.4% |
| Read-heavy CRUD: 1000 API requests/user/month | $1,278.57 | $17,911.65 | 46.3% / 96.2% |
| Busy CRUD: 10000 API requests/user/month | $7,976.37 | $24,092.65 | 13.9% / 71.5% |
| Write-heavy: 50% mutations, 5 billed writes/mutation | $3,490.65 | $20,127.65 | 16.8% / 85.6% |
| Read-heavy CRUD with 100% app/policy diagnostic logs | $2,466.57 | $18,499.65 | 48.3% / 93.1% |
| Same CRUD app; five-minute refresh, 8 hours/day, 20 days | $22,216.57 | $17,911.65 | 96.9% / 96.2% |
A busier app raises hosting spend on both sides and lowers authentication’s share even if Clerk’s fee is unchanged. A write-heavy app can make business data the largest cost. Full diagnostic logging increases both stacks. None of these cases change vendor prices or prove capacity. Use your actual API traffic, billed rows and retained population rather than treating 1,000 requests as universal.
The adverse refresh case also survives the full-app comparison: 1,920 refreshes/user/month makes app + Nathan $22,216.57 at 1M users, above app + Clerk’s $17,911.65. Including app hosting does not remove the need to measure session behavior and billed identity writes.
App activity and Clerk MRU are independent inputs. A signup-only visitor can consume CRUD resources without becoming an MRU; a dormant account retains app and identity storage. The calculator lets you separate them.
Scope of “operating cost”: these are recurring platform cash totals for the specified small-record CRUD app plus authentication. File uploads/R2, background jobs, real-time features, app notification mail, domain fees, independent backup, external monitoring/support and development/operator labor are additional costs. The calculator can add common app costs equally and incremental Nathan effort separately.
Capacity remains a separate question. At 1M stored accounts the app footprint is 100 GB, requiring at least ten D1 databases before headroom in either stack; Nathan adds 12 GB of auth data requiring at least two more. At 5M the modeled aggregate is 560 GB with Nathan, below the published 1 TB account storage limit but still requiring partitioning and viable query throughput. This cost model implements no such architecture and adds no 1M+ test requirement. [4]
Compare one logical identity application with Clerk Pro, monthly billing, and no optional Clerk add-ons. Every registered account is assumed monthly retained in this table. Nathan uses Workers Standard, D1, diagnostic logs and paid Resend delivery. Application hosting and incremental labor are excluded on both sides.
| Registered = retained users | Cloudflare | Auth email | Nathan cash total | Clerk Pro | Cash reduction |
|---|---|---|---|---|---|
| 50,000 | $5.00 | $20.00 | $25.00 | $25.00 | 0.0% |
| 51,000 | $5.00 | $20.00 | $25.00 | $45.00 | 44.4% |
| 100,000 | $5.40 | $20.00 | $25.40 | $1,025.00 | 97.5% |
| 250,000 | $38.40 | $20.00 | $58.40 | $3,725.00 | 98.4% |
| 1,000,000 | $328.65 | $155.00 | $483.65 | $17,225.00 | 97.2% |
| 2,000,000 | $721.65 | $335.00 | $1,056.65 | $32,225.00 | 96.7% |
| 5,000,000 | $1,900.65 | $875.00 | $2,775.65 | $77,225.00 | 96.4% |
Why the supplied chart needed more detail: Clerk Pro starts at $25/month even below its 50,000-MRU allowance. At 51,000 retained users, the bill is $45; at 1M it is $17,225. A near-flat Nathan line must be supported by traffic, CPU, write, logging and email assumptions; it cannot mean free infrastructure or guaranteed capacity.
Clerk counts monthly retained users (MRUs): users who return in a given month at least 24 hours after signup. A million stored accounts is not automatically a million billable MRUs. One-time users who never return after that first day do not create MRU overage, while their requests and email can still consume Nathan resources. [1]
Clerk Hobby is free up to 50,000 MRUs per app. Pro is $25/month or $20/month billed annually. Pro includes the MFA, passkeys and one upstream enterprise SSO connection relevant to Nathan’s intended launch scope. The comparison uses Pro for those features, while showing why Hobby can win for a smaller basic-auth use case.
Clerk Pro/month = $25 + max(0, min(MRU, 100,000) − 50,000) × $0.020 + max(0, min(MRU, 1,000,000) − 100,000) × $0.018 + max(0, min(MRU, 10,000,000) − 1,000,000) × $0.015 + max(0, MRU − 10,000,000) × $0.012
The volume bands are applied incrementally. Annual billing lowers the base by $5/month, not the modeled usage overage. Enterprise quotes and committed-use discounts can reduce the comparison price and should replace list rates when available.
No separate authentication-email delivery bill is added for Clerk’s managed auth features in this comparison. Marketing mail, business notifications, SMS and unrelated application hosting are excluded from both sides. Nathan’s selected Resend expense covers the modeled authentication lifecycle mail.
Apps and SSO connections are different. Clerk plans include unlimited applications and 50,000 MRUs per app. Nathan’s 500 planned downstream OIDC clients are not 500 upstream enterprise SSO connections. Do not multiply Clerk’s base price by 500, or add $75 for each Nathan-connected app. Clerk’s additional upstream SSO bands are $75/connection for connections 2–15 and $60 for 16–100; 101+ requires a quote. None are added to the headline comparison. Nathan’s local app groups are also not automatically equivalent to Clerk Organizations; an Organizations/B2B add-on needs its own feature comparison. [1]
Nathan is intended to issue downstream OIDC tokens, protect private Workers and manage local grants. A complete Clerk replacement evaluation must verify the same required app journeys and app-side integration. This report compares the recurring economic model; it does not establish feature parity or production readiness.
There is no infrastructure line item for a retained user. Storing an extra identity adds bytes. Its sign-ins add small requests, active CPU and indexed database work. If that person does not return, their stored identity does not incur an active-user subscription fee. This changes the growth curve, although actual traffic still costs money.
Workers share a lightweight runtime. Cloudflare uses V8 isolates within existing runtime processes rather than reserving a dedicated virtual machine for every Nathan deployment. The operator does not provision an always-on IdP web server or a database instance with a fixed capacity charge. D1 scales its query billing to zero when no queries run; the Workers paid account still has its $5 monthly minimum. [11] [2] [3]
Active CPU is the expensive part of execution; waiting is not billed as duration. Waiting for Google, GitHub, Entra or D1 does not itself accumulate Workers CPU-ms. Signature verification, password hashing and JSON processing do. The model budgets whole sign-in CPU explicitly; a slow password hash or heavy plugin can exceed that budget. Workers Standard has no separate request-duration or bandwidth charge. [2]
One paid account unlocks substantial included usage. Nathan’s IdP, gateway and databases share the account’s allowances; they do not each earn a new free allocation. Workers Paid is distinct from Cloudflare’s website Pro/Business plans. This model does not require buying a website-plan upgrade just to access Workers Standard pricing. [2]
| Meter | Published paid allowance | Published overage |
|---|---|---|
| Workers Standard [2] | $5/account/month minimum; 10M requests + 30M CPU-ms | $0.30/M requests; $0.02/M CPU-ms |
| D1 reads [3] | 25 billion rows/month | $0.001/M rows read |
| D1 writes [3] | 50 million rows/month | $1/M billed rows written |
| D1 storage [3] | 5 GB/account | $0.75/GB-month |
| Workers Logs, through Nov 30, 2026 [2] | 20M events/month; seven-day retention | $0.60/M events |
| Observability from Dec 1, 2026 [6] | 50 GB ingestion + 10 GB-month storage | $0.25/GB ingested + $0.10/GB-month stored |
| Resend Pro, selected example [9] | $20/month; 50,000 transactional emails | $0.90/1,000 extra emails, rounded up in buckets |
Indexed reads are inexpensive, while writes deserve attention. D1 includes 25 billion scanned rows/month on Paid, but only 50 million billed writes. Reads are charged by rows scanned, not rows returned. Inserts, updates, deletes and index maintenance add writes. A full-table scan or unnecessary session/rate-limit update changes consumption; the identity’s existence is not the billing event. [3]
Service bindings avoid double request fees. In Workers Standard, a same-account call from one Worker to another through a Service Binding adds no extra request fee; Cloudflare bills the initial request and combined CPU. Database and log usage still count. Public HTTP calls, cross-account routing and optional Workers Caching need their actual billing treatment checked. The identity-only gateway sensitivities count Nathan overhead; the CRUD model explicitly adds both business-app compute and Nathan policy overhead. [2] [5]
Worker static assets can be served without dynamic invocation charges in the documented asset-serving configuration; routing those requests through gateway code is a different path. No savings here depend on skipping required policy checks, weakening MFA or extending the confirmed 60-second Worker revocation deadline.
The Free plan has daily ceilings, not a 50,000-identity entitlement: 100,000 Worker requests/day and 10 CPU-ms/invocation; D1 allows 5M read rows/day and 100,000 written rows/day. In the 51,000-user example, 3.06M dynamic requests/month average 102,000/day, and 16.32M billed writes average 544,000/day. Either can exceed Free, and bursts or password hashing can reach a limit earlier. Treat Free as a prototype budget, not a launch guarantee. [2] [3]
Moving to Workers Paid starts at $5/account/month. The same 3.06M requests, 25.5M CPU-ms, 16.32M writes, 36.72M reads and 0.612 GB of modeled state fit the Paid included allowances. That is why crossing Free limits does not automatically mean a large hosting bill.
Lifecycle mail is separate: 10,200 emails/month in this scenario uses the selected $20 Resend Pro plan. Resend Free allows 3,000/month and only 100/day. The report deliberately uses paid email whenever nonzero mail is modeled, so it does not rely on daily burst assumptions. With no mail, or a verified existing mail allocation, that $20 can change. [9]
The exact source currently has database-backed rate limiting in src/auth/instance.ts:49, D1-backed gateway sessions in src/gateway/worker.ts:67–85, Resend delivery in src/auth/email.ts:3 and enabled observability in both Wrangler configurations. These establish billable categories, not measured per-user quantities.
KV, Queues, Durable Objects and independent backup/SIEM services are not automatically charged just because Nathan runs on Cloudflare; add their meters if the implementation uses them. The inspected Durable Object directory binding is staging functionality, and launch directory sync is deferred. No Clerk directory-sync surcharge is added either.
The moderate example produces 4M sign-ins, 20M refresh exchanges and 60M dynamic identity requests per month. Its 500M CPU-ms average about 8.3 CPU-ms/request. D1 performs 720M modeled row reads and 320M billed writes. Storage is 12 GB; lifecycle email is 200,000 messages.
| 1M-user line item | Usage and calculation | USD/month |
|---|---|---|
| Workers plan | One paid account | $5.00 |
| Dynamic Worker requests | (60M − 10M) × $0.30/M | $15.00 |
| Workers CPU | (500M CPU-ms − 30M) × $0.02/M | $9.40 |
| D1 reads | 720M billed rows, within 25B allowance | $0.00 |
| D1 writes | (320M − 50M) × $1/M | $270.00 |
| D1 storage | (12 GB − 5 GB) × $0.75 | $5.25 |
| Diagnostic logs, current rates | (60M events − 20M) × $0.60/M | $24.00 |
| Cloudflare subtotal | Workers + D1 + current logs | $328.65 |
| Transactional email | $20 + 150 × $0.90; 200,000 emails | $155.00 |
| Nathan modeled cash total | Infrastructure + email; labor excluded | $483.65 |
| Clerk Pro, one app | $25 + 50,000 × $0.02 + 900,000 × $0.018 | $17,225.00 |
Most of the Cloudflare subtotal is writes, not hosting compute. D1 writes are $270 of $328.65. The Workers plan, requests and CPU together are $29.40. This is the mechanism behind the potential savings: millions of identities can be represented by modest storage and inexpensive active work, while Clerk’s MRU meter continues to charge for returning identities.
Clerk’s $17,225 minus Nathan’s modeled $483.65 leaves $16,741.35/month for incremental operation, security maintenance, external tooling and implementation amortization before cash costs reach parity. That is a budget, not a claim that self-hosting is effortless.
| Input | Moderate scenario | Why it matters |
|---|---|---|
| Billing population | Every registered user returns after the first 24 hours that month | Clerk bills MRU; dormant accounts do not trigger MRU overage. |
| Sign-ins | 4/user/month; 10 dynamic requests/sign-in | 40 requests/user includes the modeled ceremony, callback and supporting calls. |
| Sign-in CPU and D1 | 100 CPU-ms, 80 read rows, 30 written rows per whole sign-in | Budgets include indexes/cleanup/rate-limit effects; not measured Nathan behavior. |
| Refresh | 20/user/month; one request, 5 CPU-ms, 20 reads and 10 writes each | Short tokens used all day can create hundreds or thousands of refreshes instead. |
| Stored data | 12 decimal kB per registered user | Assumed aggregate identity/account/factor/group/session/index data with bounded retention. |
| Lifecycle email | 0.2 emails/retained user/month | Uses paid Resend whenever nonzero; free daily delivery limits are not assumed away. |
| Logs | 100% of auth invocations; one 1 kB event/request | Current config enables observability; more console events/traces increase cost. |
| Protected application requests | Zero in core identity comparison | External OIDC apps do not send every business request to the IdP; full gateway scenarios are separate. |
| Allowances | Fresh account; allocations applied once across all Nathan services | Other Workers/D1/apps on the account consume the same included usage. |
These are steady-state assumptions. They exclude a mass import/signup wave, one-time invitations, SMS, directory sync, unrelated application data and unbounded audit retention. Billed rows include the assumed index/cleanup/rate-limit effects; a SQL query count cannot validate them. The reproducible JSON records every input.
The table below changes workload, not vendor prices. The moderate example is one operating profile, not a forecast for every installation. Current October 2026 logging rates and the same conservative email plan apply throughout.
| Workload at 1M retained users | Nathan/month | Versus Clerk Pro $17,225 |
|---|---|---|
| Fewer sign-ins and refreshes | $77.73 | 99.5% lower |
| Moderate identity traffic | $483.65 | 97.2% lower |
| Five-minute refresh, 1 hour/day, 20 days | $2,903.65 | 83.1% lower |
| Five-minute refresh, 8 hours/day, 20 days | $21,397.37 | 24.2% higher |
| More sign-ins, writes, refreshes and mail | $3,887.65 | 77.4% lower |
| Add 1,000 protected requests/user, current full diagnostic logs | $2,023.65 | 88.3% lower |
| Same gateway traffic, 1% diagnostic logs; security audits retained | $835.65 | 95.1% lower |
| Four auth emails/user/month | $3,903.65 | 77.3% lower |
| Three times the billed database writes | $1,123.65 | 93.5% lower |
Short-token refresh is the most important adverse case. A five-minute token refreshed during one hour/day over 20 days implies roughly 240 exchanges/user/month, costing $2,903.65 at 1M users in this model. Eight hours/day implies 1,920 exchanges and $21,397.37/month, exceeding the $17,225 Clerk Pro comparison. That calculation also creates 19.32B billed writes and would need a viable high-throughput database design. The same eight-hour pattern costs about $1,044.88 at 51,000 users, versus Clerk’s $45.
The moderate 20-refresh assumption is therefore a usage condition. Before making a savings promise, establish session duration, refresh behavior, active-client hours and billed writes/exchange. Reducing redundant writes or unnecessary refreshes may help; required MFA, token validation and revocation guarantees must remain intact. This report does not recommend extending token lifetimes to make the cost chart look better.
Gateway traffic is a broader service than identity-only OIDC. Adding 1,000 protected requests/retained user/month means 1B extra requests at 1M users. With assumed two diagnostic events/request, full gateway logging lifts the Nathan estimate to $2,023.65. Sampling gateway diagnostics to 1%, while retaining required security audits, gives $835.65. Actual service-chain event counts and payload bytes must be measured. Clerk SDK/local JWT checks should not be treated as a billable Clerk API call for every app request.
Peak traffic is not monthly traffic. The provisional 5,000 protected requests/second launch test is a peak acceptance scenario. Holding it continuously for 30 days produces 12.96B protected requests. At 51,000 identities, the separate 1%-diagnostic-log example costs about $4,679/month including mail. User count alone cannot price a gateway. This is arithmetic, not a throughput test.
Hold one million registered accounts and their modeled 12 GB of storage fixed, then vary the monthly retained population:
| Registered users | Monthly retained | Clerk Pro/month | Nathan/month |
|---|---|---|---|
| 1,000,000 | 10,000 | $25.00 | $30.25 |
| 1,000,000 | 50,000 | $25.00 | $30.25 |
| 1,000,000 | 100,000 | $1,025.00 | $30.65 |
| 1,000,000 | 250,000 | $3,725.00 | $63.65 |
| 1,000,000 | 500,000 | $8,225.00 | $201.65 |
| 1,000,000 | 1,000,000 | $17,225.00 | $483.65 |
At 50,000 retained users, Clerk Pro is $25 while Nathan’s stored million-account population makes its model $30.25. Low retained usage can make Clerk the cheaper cash choice. A viral wave of non-returning signups is excluded from Clerk MRU billing but can still generate Nathan requests, account writes and verification emails. Add that acquisition workload separately.
The 0.2-email baseline suits an illustrative social/passkey/password/TOTP mix with occasional lifecycle messages. Four email-OTP logins/user/month create 4M emails at 1M retained users; the conservative selected Resend Pro+overage formula costs $3,575 for email, or $3,903.65 for Nathan including infrastructure. The current Nathan launch plan does not require email OTP; this is an optional sensitivity, not an implemented feature claim.
Resend publishes larger-volume plans and rates as well. The model retains the simple $20/50K + $0.90/1K formula throughout to make the comparison conservative and reproducible; choosing a lower eligible volume-plan total may reduce these email estimates. At 1M emails/month the captured Scale plan is $650, below the selected formula’s $875. Mail bursts, sending-rate approval, deliverability and a verified sender remain operational requirements. [9]
Bulk onboarding also has a one-time cost: one message for each of 51,000 users exceeds the selected 50K allowance by 1K, giving a $20.90 send-month estimate if no other email is sent. It must not be silently folded into the steady-state lifecycle assumption. SMS and upstream Microsoft/other IdP licensing, if required, need separate bills.
Cloudflare has announced new unified Observability prices effective December 1, 2026. Paid includes 50 GB ingestion and 10 GB-month stored data, then $0.25/GB ingested and $0.10/GB-month stored. The report’s primary table uses prices in force on October 28; it does not mix the two periods. [6]
At 1M users, 60M assumed 1 kB log events mean 60 GB ingestion and a steady seven-day retained footprint of 14 GB-month. New log charges would be $2.50 ingestion + $0.40 storage = $2.90, versus $24 currently. Nathan’s example becomes $462.55/month including mail from December, holding everything else fixed. Real enriched event bytes, traces and retention can change that amount. The calculator supports both periods.
Head sampling defaults to 100% when unspecified; current Nathan Wrangler configs enable observability without lowering it. Diagnostic sampling can reduce volume, but security audit and incident evidence policies need an explicit, complete design. Never log credentials, tokens or passwords to save engineering work. [12]
All Cloudflare allowances are shared at account level. If another application has already consumed every inclusion, the 1M-user workload’s modeled incremental usage plus email is $548.72/month, excluding a new $5 base already paid by that account. The usual fresh-account total is $483.65. Do not give every Worker or database another copy of the allowance.
Paid D1 has 30 days of Time Travel recovery; that is useful built-in recovery, not a cross-account disaster-recovery plan. Optional R2 Standard storage is $0.015/GB-month with 10 GB included; its operations and storage use rounded billing units. Seven uncompressed 12 GB snapshots would average 84 GB if retained continuously, or about $1.11/month in R2 storage after its free 10 GB, before export work and operations. This is a storage example only: Nathan’s snapshot/export automation is not validated, and an independent backup must protect against loss of the Cloudflare account. [4] [8] [7]
Clerk’s subscription buys a managed authentication product, hosted UI/SDK integration, delivery/operations work, maintained protections and a support path. Nathan’s operator owns configuration, upgrades, recovery, credential rotation, monitoring and incident response. Cloudflare runs the underlying compute/storage; it does not take over responsibility for Nathan’s identity logic.
The assessed Nathan source is MIT-licensed at 90ebc43f6d19cf69049646a19a6f96f74de6975a, so this model includes no software license fee. Future paid support or hosted offerings are separate commercial decisions. Nathan remains pre-public-beta in the launch plan; mandatory MFA, shared app-policy enforcement and end-to-end release gates are not yet verified. A low infrastructure estimate does not make the implementation ready to replace a production provider.
Nathan ownership cost/month = Cloudflare + transactional delivery + external tooling + incremental operator hours × loaded hourly rate + amortized implementation, migration and independent review Break-even incremental hours = (Clerk quote − Nathan cash − other monthly/amortized costs) ÷ loaded hourly rate
| At 1M retained users | Incremental labor at $100/hour | Nathan total/month |
|---|---|---|
| 0 hours | $0.00 | $483.65 |
| 6 hours | $600.00 | $1,083.65 |
| 20 hours | $2,000.00 | $2,483.65 |
| 80 hours | $8,000.00 | $8,483.65 |
| 180 hours | $18,000.00 | $18,483.65 |
In the standalone identity-only 1M-user model, break-even is about 167 incremental hours/month at $100/hour, before other omitted costs. At 51,000 MRUs the identity-only $20 cash difference pays for only 12 minutes/month at the same rate. The CRUD totals have their own break-even calculation above and in the calculator. These are budgeting sensitivities; no claim is made that either effort level is sufficient. Include the one-time cost of building Nathan to release quality, then amortize it over the intended operating period.
Do not claim equivalent compliance or guarantees from a Cloudflare account alone. Clerk’s published Business/Enterprise plans add items such as audit features, compliance documentation and contractual support/SLA options. Required enterprise assurances need an actual quote and an equivalent Nathan operating design. Base Pro list pricing is deliberately the comparison floor here. [1]
D1 has a 10 GB maximum per database, which cannot be raised, and a published 1 TB aggregate account storage limit. The modeled 12 GB at 1M users requires at least two databases even under ideal packing; 24 GB at 2M needs at least three, and 60 GB at 5M needs six, all before headroom. The inspected Nathan auth configuration binds one auth database. Partitioned identity/session/audit storage is an engineering requirement for these projected footprints, not a feature already implemented. [4]
Each D1 database is inherently single-threaded. Cloudflare’s guidance relates throughput to query duration; a low per-row price is not a promise of unlimited concurrent queries. Read replication can help suitable reads without extra replica charges, but policy freshness and the confirmed 60-second Worker revocation bound constrain consistency and caching choices. More databases, backups and queueing also add development and operational effort. [4] [3]
High refresh rates can need substantial write throughput even when the dollar formula is affordable. At a later scale milestone, use the real usage bill, storage growth, query durations, D1 row metrics and observed errors to select the architecture. This report adds no 1M-user load test to the agreed launch acceptance scope.
For bot defense, Turnstile’s Free plan includes unlimited challenges, subject to widget/hostname limits; enterprise functionality is quoted. That can reduce one defensive service bill, but is not full feature parity with Clerk Protect, a WAF subscription or a complete abuse-control design. Nathan must still bound CPU, rate-limit expensive routes and guard mail/DB writes against denial-of-wallet attacks. [10]
This script-free edition preserves the static results. The companion report.html contains the interactive workload calculator; raw inputs and results are available beside this report.
“Nathan runs in your own Cloudflare account, so your authentication infrastructure bill follows compute, database activity and storage rather than a fee for every retained user. Using published October 2026 prices, the moderate example projects about $484/month including email for 1 million monthly retained users, compared with $17,225/month for Clerk Pro at list rates. Actual cost depends on sessions, refreshes, email, logs and operator effort; the 1M-user figure is a projection, not tested capacity.”
For a whole-app comparison, add: “With the illustrative read-heavy Workers/D1 CRUD workload, app + Nathan projects $1,279/month versus $17,912 with Clerk Pro at 1M active and retained users. Authentication is about 46% versus 96% of those cash totals. Both include the same app; development and incremental operations are extra.” Publish the detailed assumptions alongside either claim.
For a team with many retained users and the skills to operate Nathan, that is a credible reason to evaluate self-hosting. For low retained usage, short-token heavy sessions, limited operational capacity or a requirement for immediate managed support/compliance, Clerk can be the better economic choice. Publish the workload with the number, keep the source date, and update the report when rates or implementation change.
Data classification: vendor prices and limits are sourced facts; Nathan workload rates, storage, log volume and operator hours are assumptions; every dollar comparison is a calculation. No Nathan deployment invoice, usage trace, 1M+ benchmark, current CI result or live Clerk quote was supplied or generated.
sources/clerk-pricing.txt. SHA-256 recorded in source-ledger.json.sources/workers-pricing.txt. SHA-256 recorded in source-ledger.json.sources/d1-pricing.txt. SHA-256 recorded in source-ledger.json.sources/d1-limits.txt. SHA-256 recorded in source-ledger.json.sources/service-bindings.txt. SHA-256 recorded in source-ledger.json.sources/observability-pricing.txt. SHA-256 recorded in source-ledger.json.sources/r2-pricing.txt. SHA-256 recorded in source-ledger.json.sources/d1-time-travel.txt. SHA-256 recorded in source-ledger.json.sources/resend-pricing.txt. SHA-256 recorded in source-ledger.json.sources/turnstile-pricing.txt. SHA-256 recorded in source-ledger.json.sources/workers-runtime.txt. SHA-256 recorded in source-ledger.json.sources/workers-logs.txt. SHA-256 recorded in source-ledger.json.Repository evidence: MIT license; database rate limiting; Resend adapter; gateway sessions; auth observability/D1 config; gateway config. Source establishes categories, not per-user unit counts.
Files: model-inputs.json (rates/assumptions), source-ledger.json and sources/ (dated snapshots and hashes), model-results.json, baseline-costs.csv, sensitivity-costs.csv, crud-total-costs.csv, crud-sensitivity-costs.csv; figures cost-at-scale.png/svg, one-million-breakdown.png/svg, crud-total-cost-at-scale.png/svg and crud-cost-composition.png/svg; report.html (interactive), report-static.html (script-free/printable) and source/model downloads in this directory.
cd plans/reports/nathan-vs-clerk-2026-10-28 python3 cost_model.py node verify_model.mjs uv run --with matplotlib==3.10.7 python make_charts.py
The arithmetic is offline and standard-library-only. Python Decimal and the browser JavaScript implementation agree across 101 cases: 57 identity-only and 44 CRUD/shared-account cases, including zero activity, allowance boundaries, fractional populations, common costs and adverse refreshes. Independent checks reproduce Cloudflare’s published $8 and $45.40 Worker examples, verify Clerk band boundaries and reconcile the 1M CRUD line items. Figures use saved results rather than hand-entered points. Refreshing source snapshots requires internet and a deliberate review/update of the price inputs; scraping does not silently rewrite the rate sheet.
Currency is USD, before tax, in a 30-day model month. Display totals are rounded to cents; tiny invoice-rounding differences are possible. The email formula explicitly rounds excess mail into 1,000-message buckets. The optional R2 example respects its separate rounded storage units. Enterprise contracts, regional product choices, unrelated account consumption and future prices can differ.