Migrating Off Auth0 Without Logging Everyone Out
By The Alt Auth Team
The reason teams stay on an auth provider they have outgrown is rarely the product. It is the migration: the fear of a maintenance window, of emailing every customer a password reset, of some forgotten integration breaking on a Friday. That fear is mostly unfounded if you stage the move properly.
Stage one: dual-write, single-read
Start by creating each user in the new system as they authenticate against the old one. Your app still trusts the old provider; the new one is silently accumulating an identical user table. After one full billing cycle you will have covered the overwhelming majority of active users without a single person noticing.
Stage two: flip the read path
Point new sessions at the new provider, keeping the old one as a fallback for anyone not yet migrated. Because both issue signed tokens, your app can verify either during the overlap. This is the only genuinely risky step, and it is reversible in one config change.
Stage three: sweep the tail
- Export the remaining dormant accounts and import them by CSV.
- Those users hit password recovery on first return — a normal flow, not a mass reset email.
- Keep the old tenant alive, read-only, for one more cycle before cancelling.
- Only then remove the fallback verification path from your app.
The whole sequence runs in the background over weeks. There is no window, no all-customer email, and no moment where a login fails because the cutover happened mid-request.