Auth0 to Cognito, with social logins and password resets intact.

Auth0 had been chosen four years earlier when it was the obvious answer. The team had since outgrown the price tier without outgrowing the feature surface. The migration risk was real — auth is the front door — but the financial math was no longer debatable.

Cognito’s pre-authentication Lambda trigger verified each user’s password against Auth0 on first login post-cutover, then created the equivalent Cognito user. Google and Apple federated providers preserved social connections (Cognito’s federated identity providers map cleanly to Auth0’s social connections).

After ten weeks, 87% of active users had been migrated transparently. The remainder got a courtesy "we’re upgrading our system, sign in again" email that explicitly avoided the words "password reset" (and didn’t require one). Auth0 contract didn’t renew; annual saving was over $130k.