Solutions Use case

Migrate from Auth0, Okta, Cognito, Firebase or Clerk

LumoAuth speaks the same OpenID Connect your current provider does, so most apps migrate by changing two settings. The CLI imports users with their existing password hashes, passkeys and authenticator secrets, so nobody is forced to reset anything.

Start free Migrations overview

Price increases, missing features, and data you cannot take home

Per-user pricing grows faster than revenue. Enterprise connections cost extra. Agent security does not exist.

How LumoAuth solves it

Same protocol, new issuer

The discovery document, token shape and redirect patterns are standard. Your OpenID Connect library does not care who issued the token. Docs

Import users without resets

lumo migrate imports an Auth0 export with its bcrypt, argon2 and scrypt hashes, TOTP secrets and passkeys. Step-by-step guides cover Okta, Cognito, Firebase and Clerk. Docs

Map rules and actions

Auth0 rules and actions usually become webhooks, progressive profiling rules or attribute policies. The guide maps the common ones. Docs

Cut over safely

Run both issuers side by side, move applications one at a time, and keep the old provider as a fallback until you are done. Docs

Enterprise features included

Customer SSO, directory sync, organizations and agent identity are part of the plans, not per-feature invoices. Docs

No lock-in the other way either

Export every user, consent and setting. Rotate keys. Point any library elsewhere. Docs

Setting it up

Export from your current provider

Users, connections, applications.

Create applications in LumoAuth

Same redirect URIs, same scopes.

Run lumo migrate

Dry run first, then import.

Switch the issuer

Change the issuer URL and client credentials in your app config and deploy.

Standards involved

Plain names on the left, the specification on the right. The full map is in the standards reference.

Sign-in: OpenID Connect, OAuth 2.1
Logout: OIDC back-channel logout
Password hashes: bcrypt, argon2id, scrypt, PBKDF2

Standards reference on the docs site

Which plan you need

The migration tooling is free. Pick the plan by monthly active users and features; every plan has a published overage price, with no per-user cliff.

See all plans and add-ons

Documentation

Migrations overviewdocs.lumoauth.dev/migrations From Auth0docs.lumoauth.dev/migrations/auth0 From Oktadocs.lumoauth.dev/migrations/okta From Cognitodocs.lumoauth.dev/migrations/cognito From Firebasedocs.lumoauth.dev/migrations/firebase From Clerkdocs.lumoauth.dev/migrations/clerk lumo migratedocs.lumoauth.dev/cli/migrate

Questions

Will users have to reset passwords?

No, if your export contains the hashes. LumoAuth verifies the imported hash on first sign-in and re-hashes with its own settings.

What about social logins?

Re-create the provider apps with your existing client IDs. Users are matched by verified email.

How long does it take?

A single application with a few thousand users is typically a day. Large multi-application estates are migrated one application at a time.

Ship passwordless sign-in this week. Put guardrails on your agents today.

The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.

Start free Talk to us Read the docs