WorkOS Review
Login, user management, and enterprise SSO for your app, priced per feature you turn on
Is this your product? Claim this page · Request a change
Looking for a WorkOS alternative? See our ranked comparison.→What is WorkOS?
WorkOS is an API and hosted UI for adding login, signup, and user management to an app, with a specific focus on the enterprise features that big customers ask for: SSO, SCIM directory sync, audit logs, and admin self-service. AuthKit is the part most developers touch first: a hosted login page with email/password, social login, passkeys, magic links, and MFA already built.
You start on the free tier for regular auth and user management, then pay per feature as you turn on enterprise pieces. SSO and directory sync are priced per identity provider connection, so the bill grows with how many enterprise customers you sign, not with how many total users you have.
Recent releases (Widgets API, an MCP server for managing your WorkOS setup, step-up authentication) show WorkOS pushing past pure auth into general infrastructure for enterprise-ready SaaS.
WorkOS screenshots
Who it's for
- ✓ Developers who expect enterprise customers to demand SSO and SCIM directory sync and don't want to build IdP integrations themselves
- ✓ Teams that want a hosted login UI (AuthKit) instead of building their own auth screens
- ✓ Apps that will stay under 1M monthly active users for a while and want the core auth product free
Who should look elsewhere
- ✗ Teams that want one flat, predictable monthly bill instead of several metered line items across MAUs, SSO connections, and audit log retention
- ✗ Solo developers or small apps that just need basic login and won't sell to enterprise buyers who need SSO
Pros
- + Core login and user management is free up to 1M monthly active users, so most apps pay nothing until they have real scale
- + SSO and directory sync pricing scales down per connection as you add more enterprise customers, up to 48% off once you reach 51-100 connections
- + AuthKit gives you a hosted, customizable login page so you don't have to design and maintain your own auth screens
- + Supports 20+ identity providers (Okta, Azure AD, Google, OneLogin, and others) through one integration
Cons
- – Pricing is split across many separate metered items (MAUs, SSO connections, directory sync connections, audit log streams and retention, Radar checks, custom domain), so there's no single number that tells you what you'll pay
- – Each SSO connection still costs $125/month at low volume, which adds up fast if you sign many small enterprise customers who each bring their own identity provider
- – The Annual Credits plan, the Enterprise support tier, and any deployment needing more than 100 SSO or directory sync connections all require talking to sales, no published price
WorkOS pricing
It has a free plan, so you can start at no cost in Authentication & User Management.
| Plan | Price | Highlights |
|---|---|---|
| AuthKit / User Management | Free | Free for the first 1M monthly active users · $2,500/month per additional 1M MAUs · Email/password, social login, passkeys, MFA, magic auth |
| SSO (per connection) | $125/mo | $125/connection for 1-15 connections · Drops in steps to $65/connection at 51-100 connections (48% off) · More than 100 connections requires talking to sales for custom pricing |
| Directory Sync (per connection) | $125/mo | Same per-connection pricing and volume discounts as SSO · SCIM and HRIS-based directory sync |
| Audit Logs | $125/mo | $125/month per SIEM log stream · $99/month per 1M events retained |
| Radar (bot/fraud protection) | Free | First 1,000 checks free · $100/month per additional 50,000 checks |
| Custom Domain | $99/mo | Serve AuthKit and API endpoints on your own domain |
| Annual Credits | Custom | Everything in Pay as you go, plus pre-pay credit discounts · 99.99% uptime SLA · Guided migration and onboarding · Guaranteed support SLA |
| Enterprise Support | Custom | Dedicated support account manager · Quarterly architecture review · 24x7x365 response SLAs |
WorkOS charges per feature rather than one seat price. Core login and user management (AuthKit) is free up to 1M monthly active users, then $2,500/month per additional 1M MAUs. Enterprise features like SSO, Directory Sync, and Audit Logs are separate metered add-ons, each billed monthly with volume discounts. SSO and Directory Sync connections above 100, along with the Annual Credits plan and the Enterprise support tier, are quote-only. All numbers from the live pricing page dated 2026-07-22.
Pricing verified July 22, 2026 · source
How WorkOS's pricing compares
WorkOS next to its closest alternatives on entry price, billing, and whether pricing is public.
| Tool | Starting price | Billing | Free option | Pricing disclosed |
|---|---|---|---|---|
| WorkOS | Free | usage-based | Yes | Partly public |
| Auth0 | $35/user/mo | tiered | Yes | Partly public |
| Clerk | $25/mo | tiered | Yes | Partly public |
| Stytch | Free | usage-based | Yes | Partly public |
| SuperTokens | Free tier + custom | usage-based | Yes | Not disclosed |
| Frontegg | Free tier + custom | usage-based | Yes | Not disclosed |
Is WorkOS still actively developed?
Last significant update: July 2026. Radar (bot and fraud protection) now works with custom AuthKit UIs built directly on the User Management APIs, not just the hosted AuthKit UI. WorkOS support has to activate it on your account first.
Top WorkOS alternatives
WorkOS FAQ
Is WorkOS free?+
The core AuthKit/User Management product is free for the first 1 million monthly active users. Past that, each additional 1M MAUs costs $2,500/month. Enterprise features like SSO and directory sync are priced separately.
How much does SSO cost with WorkOS?+
SSO is priced per identity provider connection: $125/month each for your first 15 connections, dropping in steps to $65/month per connection once you reach 51-100 connections. More than 100 connections requires talking to sales for custom pricing.
Does WorkOS have a free trial?+
There's no separate trial period listed on the pricing page. The free tier for AuthKit (up to 1M MAUs) lets you build and ship before you pay anything.
What counts as an SSO or directory sync 'connection'?+
Each connection is one identity provider integration for one customer organization, for example one Okta tenant or one Azure AD tenant you set up SSO or SCIM sync against.