So your auth will then be tied to their API and you'll be paying $30 a month + a per user fee.

What bugs me about that kind of thing is that there have been secure password and oauth implementations that are easy to get started with for years, yet there's this continual edging into this space by people looking to make a buck and able to sell it to management because it has pretty dashboards. My personal take on these paid for solutions is you have to do nearly as much work, and you lose understand and power not having it integrated into your own product. Plus when one of these auth services gets compromised it's a far worse situation.