WorkOS review
by WorkOSAuthentication and user management
AuthKit user management free for 1 million monthly active users, with enterprise SSO and directory sync at $125 per connection.
- Free plan
- No card needed
- Self-serve
- Usage-based
- Public prices
What you're paying for
- Saves engineering time (main value)
- Worth the price
Enterprise SSO and directory sync at a published $125 per connection, on top of user management that is free for up to 1 million monthly users.
WorkOS lets a B2B app say yes to an enterprise customer’s SSO or SCIM request without building SAML and directory integrations: each customer is one connection at a published price, with an Admin Portal their IT team configures. AuthKit handles sign-in for everyone else and is free up to 1 million monthly active users, with MFA, passkeys and breached-password rejection on every account.
- SSO and SCIM priced per customerEach enterprise customer is one connection: $125 a month for 1–15, falling to $65 for 51–100, regardless of how many end users it has.Evidence: Pricing page (2026-10-15)
- 1 million monthly users freeAuthKit user management is free up to 1,000,000 monthly active users, then $2,500 a month per additional million.Evidence: Pricing page (2026-10-15)
- Security features on every accountMFA, passkeys, magic auth, RBAC and a password policy that rejects breached passwords are listed as available for all accounts.Evidence: Pricing page and AuthKit docs (2026-10-15)
- Best for
- B2B SaaS teams that are starting to sell to enterprises and want SSO and SCIM priced per customer, with free sign-in for everyone else.
- Good to know
- Every SSO connection costs $125 a month until volume discounts from the 16th, and data is hosted in the US.
How WorkOS compares
Against 3 other products we reviewed in Authentication and user management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | WorkOS | Supabase Auth | Firebase Authentication | Clerk |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeEnterprise SSO and directory sync at a published $125 per connection, on top of user management that is free for up to 1 million monthly users. | Worth the price100,000 monthly active users on the $25 Pro plan, SSO priced per user, and SOC 2, ISO 27001 and a HIPAA BAA on the self-serve Team plan. | Worth the priceSign-in that plugs into Firebase and Google Cloud, free to 50,000 monthly users, with SAML at $0.015 per user and a self-serve Google Cloud BAA. | Saves engineering timeReady-made sign-in and user management, free for 50,000 retained users, with SSO and MFA from $25 a month at published prices. |
| Overall score | 7.9 | 9.3Best | 8.4 | 8.2 |
| Free option | Free plan | Free plan | Free plan | Free plan |
| Card to start | No card needed | –Not measured | No card needed | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $125/SSO connection/mo | $25/mo | $0.0055/MAU above 50,000 | $25/mo |
| Pricing model | Usage-based | Usage-based | Usage-based | Usage-based |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Free plan | 1,000,000 MAU, no card until production | 50,000 MAU; paused after 1 week inactive | 50,000 MAU; Spark capped at 3,000 a day | 50,000 MRU per app, no card |
| Entry paid plan at 10,000 users | $0 (users free up to 1M) | $25/mo (Pro), 100,000 MAU included | $0 (Blaze), 50,000 MAU at no cost | $25/mo (Pro), $20 billed annually |
| Enterprise SSO | $125/mo per connection (1–15), down to $65 at 51–100 | 50 SSO users on Pro, then $0.015 each | 50 SAML/OIDC users free on Blaze, then $0.015 each | 1 connection on Pro, then $75/mo each |
| SOC 2 report | Type II, from the Trust Center on request | Type 2, on Team ($599/mo) | SOC 2 (Google), via Compliance Reports Manager | Type 2, on Business ($300/mo) |
| HIPAA BAA | Enterprise plans | Team plan, paid add-on | Google Cloud BAA, accepted in the console | Enterprise plan |
| Data region | US (per the DPA) | 17 AWS regions, EU included | US only | US only |
| Log retention on the entry paid plan | 90 days of events via the Events API | 7 days of auth audit logs (Pro) | 30 days in Cloud Logging (activity logs, opt-in) | 7 days of application logs (Pro) |
| Bottom line | From its public pages, WorkOS offers the largest free user allowance here and clear per-connection prices for enterprise SSO. Budget $125 a month per SSO customer and check US-only hosting. | From its public pages, Supabase Auth is the least expensive per user of the three and the only one with a BAA on a self-serve plan. It fits best when the rest of your app runs on Supabase. | From its public pages, Firebase Authentication is the least expensive route here to SAML SSO and a self-serve BAA, inside the Firebase platform. Check US-only processing and the protections it does not list. | From its public pages, Clerk offers the largest free allowance here and clear prices from the first user to SSO. Check US-only hosting and the plan that unlocks the SOC 2 report against your customers’ requirements. |
Evidence: WorkOS: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Supabase Auth: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Firebase Authentication: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Clerk: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 9.0 / 10, Excellent
- self-serve prices published up to 5,000,000 users; extra SSO priced; 1 contradiction on the page
- Free tier
- 10.0 / 10, Excellent
- 1,000,000 users
- Price at 10,000 users
- 10.0 / 10, Excellent
- $0/mo (Pay as you go)
- Enterprise SSO
- 3.3 / 10, Fair
- SSO as a paid add-on; +$625/mo for 5 connections (5 connections at $125 each)
- Compliance documents
- 5.0 / 10, Fair
- own SOC 2 Type II, no ISO 27001, HIPAA BAA on enterprise, no region choice
- Security on self-serve plans
- 10.0 / 10, Excellent
- MFA: free plan; passkeys: free plan; bot protection: free plan; breached-password checks: free plan; brute-force protection: free plan
Review
Review from public pages
Written from WorkOS's public pages (pricing, security or privacy, and docs) as read on Oct 15, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read WorkOS's pricing, support-plans and security pages, its Trust Center, DPA and AuthKit docs on Oct 15, 2026; we did not sign up for this review. The pricing FAQ says WorkOS is free to start and a card is needed only when you move to production; every product can be tried in the staging environment at no cost.
The pricing page is a set of sliders, one per product. AuthKit is free up to 1 million monthly active users, counting anyone who signs up, signs in or updates a profile in the calendar month. SSO and Directory Sync are priced per connection, one per enterprise customer. Radar, the fraud and bot engine, is free for the first 1,000 checks. One line needs care: the pay-as-you-go card lists a dedicated Slack channel, while the support section on the same page places the private Slack channel on the Scale support plan.
The docs say the default password policy rejects passwords flagged by haveibeenpwned, MFA uses authenticator-app codes in Hosted AuthKit, and passkeys work only in the hosted UI. On compliance, the security page lists SOC 2 Type 2 and says a HIPAA BAA is available on enterprise plans; we found no ISO 27001 certification or EU hosting option.
Strengths
- Largest free user allowance here
AuthKit is free for up to 1,000,000 monthly active users.
vs Clerk: Clerk’s Hobby plan covers 50,000 retained users and Auth0’s free plan 25,000.
- Published SSO prices without a plan change
SSO is $125 a month per connection with volume steps to $65, and the price does not depend on the number of end users.
vs Auth0: Auth0 needs a B2B plan ($2,100 at 10,000 users) for SSO beyond its free connection.
- Security features without a paid tier
MFA, passkeys and breached-password rejection are on every account; Radar adds bot and brute-force detection with 1,000 free checks.
vs Clerk: Clerk starts MFA and passkeys on its $25 Pro plan.
- Directory sync and audit logs alongside
SCIM directory sync, audit logs with SIEM streaming and an Admin Portal for customer IT teams are priced on the same page.
Things to know
- SSO adds up per customer
Five enterprise customers cost $625 a month in SSO at the 1–15 rate; directory sync is billed separately at the same rate.
- US hosting, no ISO 27001
The DPA names the United States as where transferred data is stored or accessed, and the security page and Trust Center list no ISO 27001 certification.
- BAA on enterprise plans
The security FAQ says WorkOS signs HIPAA business associate agreements for customers on enterprise plans.
- Radar beyond 1,000 checks is paid
Bot and brute-force detection in Radar cost $100 per 50,000 checks after the first 1,000.
Pricing reality
WorkOS bills per product. AuthKit is free up to 1 million monthly active users, then $2,500 a month per additional million. SSO and Directory Sync are $125 per connection a month for 1–15, $100 for 16–30, $80 for 31–50 and $65 for 51–100, each billed separately; beyond that, sales. At 10,000 users with no enterprise customers the bill is $0; with five SSO customers it is $625.
Other charges: audit log streaming at $125 a month per SIEM connection and $99 a month per million stored events, Radar at $100 per 50,000 checks, and a custom domain at $99 a month. Video and Slack support with response SLAs is the Scale support plan at $1,000 a month; annual credits bring a 99.99% SLA and pre-pay discounts through sales.
Exit path
The docs describe importing users, including password hashes, from other services; we did not find a page that describes exporting password hashes out of WorkOS.
Compared with
- Pick WorkOS when
- You expect more than 50,000 monthly users on a free plan, or want MFA and passkeys without a paid plan.
- Pick Clerk when
- You need several SSO connections at the lower price ($75 a month each against $125) and bot protection with no metered checks.
- Pick WorkOS when
- You want published per-connection SSO prices without moving to a B2B plan, and 1 million free users.
- Pick Auth0 when
- You need ISO 27001, a non-US hosting region, or one enterprise connection on a free plan.
- Pick WorkOS when
- You want passkeys, breached-password rejection and bot detection built in, and 1 million free users.
- Pick Firebase Authentication when
- You need SAML for a few users at $0.015 each rather than $125 per connection, ISO 27001, or a self-serve BAA.
Choose it if
- You sell to enterprises that ask for SSO and SCIM, one customer at a time.
- You want sign-in for up to 1 million monthly users at no cost.
- You want MFA, passkeys and breached-password checks without a paid tier.
Look elsewhere if
- User data must be hosted outside the US.
- You need dozens of SSO connections on a tight budget.
- Your customers require ISO 27001 from your identity vendor.
Bottom line
From its public pages, WorkOS offers the largest free user allowance here and clear per-connection prices for enterprise SSO. Budget $125 a month per SSO customer and check US-only hosting.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Free plan | 1,000,000 MAU, no card until production |
| Entry paid plan at 10,000 users | $0 (users free up to 1M) |
| Enterprise SSO | $125/mo per connection (1–15), down to $65 at 51–100 |
| SOC 2 report | Type II, from the Trust Center on request |
| HIPAA BAA | Enterprise plans |
| Data region | US (per the DPA) |
| Log retention on the entry paid plan | 90 days of events via the Events API |
Read from the vendor's public pages on Oct 15, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for WorkOS yet. The access facts above were read from its sign-up and pricing pages on Oct 15, 2026.
We have not published API calls for WorkOS yet.
WorkOS lists 5 plans. The cheapest paid plan, Pay as you go, costs $125/SSO connection/mo.
- WorkOSFreeAuthKit$0/moUp to 1,000,000 monthly active users; $2,500/mo per additional million
- MFA, passkeys, magic auth and social sign-in
- Breached-password rejection
- RBAC and organization policies
- Email and in-dashboard support
- WorkOSEnterprise SSO$125/connection/mo1–15 connections; $100 for 16–30, $80 for 31–50, $65 for 51–100
- SAML and OIDC
- Same price regardless of end users
- Admin Portal included
- WorkOSDirectory Sync$125/connection/moSame volume steps as SSO
- User provisioning and de-provisioning
- Role mapping
- WorkOSRadar$100/50k checksFirst 1,000 checks free
- Bot and brute-force detection
- Impossible travel and repeat sign-up checks
- WorkOSAnnual creditsContact sales
- Pre-pay credit discounts
- 99.99% uptime SLA
- Guided migration and onboarding
- Guaranteed support SLA
Prices as listed, USD, excluding tax; observed 2026-10-15.
Source: workos.com pricing page. Prices change; the observed date above is when our agent read them.