Founders usually ask for authentication in one line: “users need to log in.” That sentence hides at least four different projects, and the cost to add OAuth and SSO swings from a couple of thousand pounds to the best part of twenty-five thousand depending on which one you mean. The word that matters is who is signing in. A consumer tapping a Google button is one thing. An employee at a hospital trust arriving through their employer’s identity system is another. This guide separates the two, explains the jargon, and gives you ranges for a UK app in 2026 so that a quote on your desk makes sense.
How much does it cost to add OAuth and SSO?
The cost to add OAuth and SSO to a UK app ranges from about £1,500 to £25,000. A single social login on an app that already has accounts typically costs £1,500 to £4,000. A full email, password, and social login system costs £4,000 to £10,000. Enterprise single sign-on for business customers, using SAML or OpenID Connect, costs £5,000 to £15,000 for the first connection and £10,000 to £25,000 for a complete enterprise setup.
These are build costs, quoted as one-off projects, and they assume a sensible scope. The spread is wide because the three tiers solve different problems, and a founder who needs the first tier but is quoted for the third is paying for software their customers will never use. If you want the consumer end in detail, we cover it in our guide to the cost of adding social login.
OAuth and SSO are not the same thing
The two terms get used as if they were interchangeable, and a lot of expensive misunderstandings start there. OAuth 2.0 is an open standard, published as RFC 6749, that lets your app act on a user’s behalf at another service without ever seeing their password. When you tap “Continue with Google”, OAuth is the machinery underneath. OpenID Connect sits on top of it and adds the part that says who the user is.
Single sign-on, or SSO, is a different idea: one login that works across several systems. In the business world it usually means a company’s staff signing into your app with the same corporate identity they use for everything else, through a protocol such as SAML 2.0 or OpenID Connect. So OAuth is the plumbing, and SSO is a product feature built on top of plumbing like it. Consumer apps almost never need SSO. Business software sold to larger organisations increasingly cannot close a deal without it.
Tier one: social sign-in for consumers
If your users are the public, this is the tier you want, and it is the cheapest. Adding Google, Apple, or Facebook sign-in is mostly a one-off build, because the providers do not charge you per login. On an app that already has accounts, one provider costs £1,500 to £4,000. If you are building the account system at the same time, the whole authentication layer costs more, and that is the next tier.
Apple adds a rule that catches people out. Section 4.8 of the App Store Review Guidelines requires apps that offer third-party sign-in to also offer an equivalent privacy-focused option, which in practice means Sign in with Apple on iOS. Check the current wording before you scope, because it has been revised before, but budget for the Apple button as the default.
Tier two: a full account system
This is where most first-time apps land. You need people to register with an email and password, verify their address, reset a forgotten password, stay logged in securely, and optionally sign in with a social provider as well. Built properly, that is £4,000 to £10,000, and almost all of the cost is the unglamorous work around the login screen: session handling, password reset flows, rate limiting against guessing attacks, and account linking so the same person is never split into two records.
You do not have to build this yourself. Managed services such as Auth0, Firebase Authentication, Clerk, and Supabase Auth provide most of it, and integrating one typically costs £1,500 to £4,000 rather than the full build. The trade is a monthly bill that grows with your user count, in exchange for less to build and less security risk to carry. Check each vendor’s current pricing page before you decide, since plans change often. Our comparison of Firebase, Supabase, and custom backends walks through that trade-off.
Tier three: enterprise SSO for business customers
This is the tier that surprises people. A larger customer’s IT team will often ask for SSO as a condition of buying, so that their staff log in with the company identity and IT can switch off a leaver’s access in one place. Supporting that means implementing SAML 2.0 or OpenID Connect, building an admin screen where each customer’s IT team enters their own identity provider settings, and testing against the systems customers actually use, such as Microsoft Entra ID and Okta.
The first connection costs £5,000 to £15,000 because you are building the machinery. After that, each new customer is mostly configuration, which we budget at £500 to £1,500 of support time per customer, since every IT team has its own quirks. A complete enterprise package adds role-based permissions, audit logs, and automatic provisioning and de-provisioning of users through a standard called SCIM, and lands between £10,000 and £25,000.
What pushes the price up
Four things move the number more than the sign-in method itself. The first is the number of platforms: an app on iOS, Android, and the web means three sets of testing and secure token storage on each device. The second is the data you hold. If the app handles health or financial information, the security review is longer, and our guide to UK GDPR for a consumer app shows why that is not optional.
The third is multi-factor authentication, which adds a second step such as a code or a passkey, and typically adds £1,500 to £4,000. The fourth is migration. Moving existing users from an old login system without making them all reset their passwords is delicate work, and it is the item most often missing from a first quote.
How long does it take?
Time is the other half of the cost, and it tracks the tiers closely. A single social provider on an app with accounts is usually one to two weeks of work including testing on each platform. A full account system takes three to six weeks. Enterprise SSO takes four to eight weeks for the first connection, mainly because you are waiting on a customer’s IT team to hand over settings and test accounts, and that waiting is outside your control.
Build that delay into the plan. We have seen a two-week SSO job stretch to two months because the customer’s identity administrator was on leave. Ask the customer for a named technical contact before you promise a date, and agree a test account in their system up front.
Questions to ask before you accept a quote
A good authentication quote can answer these without hesitation. Which providers and protocols are included, and on which platforms? Is the account system built or bought, and who pays the monthly fee if it is bought? Does the price include password reset, email verification, and account linking? What happens to existing users? Is multi-factor authentication in scope? And for SSO, is the customer admin screen included, or only the protocol?
If a quote says “authentication: £3,000” with no breakdown, that line is hiding a decision. Our guide to red flags in app developer pitches covers the other places vague line items cause trouble later.
A worked example
Picture a UK app that helps estate agents manage viewings. At launch it is used by individual agents who sign up themselves. Email and password plus a Google button is enough, and it costs around £6,000 as a complete tier two build. Nine months later, a national agency with 400 staff wants to roll it out but insists on signing in through their Microsoft identity system.
That request is tier three. The first SAML connection, the customer admin screen, and testing against their setup come to roughly £9,000, and the agency’s onboarding adds another £1,000 or so. The deal is worth it, but only if you knew the cost was coming. This is why we ask founders early who the customer is: a business buyer changes the authentication budget more than any other single answer.
When not to build SSO yet
Do not build enterprise SSO speculatively. It is a feature you build because a named customer is asking for it, ideally with a signed order or a clear commitment attached. Many B2B products ship their first year on email and password plus Google sign-in, then add SSO when the first large buyer requires it, and charge for it on a higher plan to cover the support time.
The honest sequencing is simple. Start with the cheapest tier that serves the users you actually have, choose a design that will not make the next tier a rewrite, and spend the saved money on proving people want the product. If you are still pricing the rest of your build, our overview of what an app costs to build in the UK in 2026 puts authentication in context.
What to do next
The cost to add OAuth and SSO comes down to who signs in. Consumers need a social button and a solid account system, which runs from £1,500 to £10,000. Business customers who insist on single sign-on push the figure to £5,000 to £25,000, with a smaller recurring cost for every new connection. Match the tier to your real customers, and add the next one only when someone is waiting for it.
If you want a straight answer for your own app, send us a project brief and tell us who your first ten users are. We will tell you which tier you need and what it will cost.
.webp)
.webp)
