Overview
WorkOS started as an API for enterprise single sign-on and now also sells AuthKit, a full user management product with hosted login UI. AuthKit handles email and password, social providers, passkeys, MFA and six-digit email codes, and it is free for the first one million monthly active users, which is far above most competitors' free tiers.
The business model is per-connection pricing for enterprise features. Each SAML or OIDC SSO connection costs $125 a month for the first 15, with discounts down to $65 each past 50 connections, and SCIM or HRIS directory sync connections are priced the same way. The Admin Portal lets your customer's IT team set up their own connection, which saves support time.
Extras such as a custom auth domain ($99 a month), audit log streaming and Radar bot protection are billed separately, and faster support costs $1,000 a month. For a consumer or early product the bill can be zero; for B2B, cost tracks the number of enterprise customers, which usually aligns with revenue.
Pricing and plans
checked 28 Sept 2026Free tier
AuthKit user management free for the first 1 million MAU: email and password, social login, passkeys, MFA and magic auth; staging environments free; 1,000 Radar bot checks
| Plan | Price | What you get |
|---|---|---|
| AuthKit | Free | First 1M MAU; each further 1M MAU $2,500/mo |
| SSO connection | $125/mo | Per connection for 1-15; $100 (16-30), $80 (31-50), $65 (51-100) |
| Directory Sync connection | $125/mo | Same volume tiers as SSO |
| Custom domain | $99/mo | Add-on |
| Audit Logs | $125/mo | Per SIEM stream; retention $99/mo per 1M events |
| Annual Credits | Custom | Pre-pay discounts, 99.99% SLA, guided migration |
What it does
- AuthKit
- Hosted, customisable login UI and user management with passwords, social, passkeys, MFA and magic auth.
- Enterprise SSO
- One integration supports any SAML or OIDC identity provider such as Okta or Microsoft Entra.
- Directory Sync
- SCIM provisioning from Okta, Entra ID and others, plus HRIS integrations like BambooHR and Rippling, with webhook events.
- Admin Portal
- Hosted setup flow where customer IT admins configure SSO and directories themselves, with step-by-step guides.
- Audit Logs
- Store, query and export audit events and stream them to a customer's SIEM.
- Radar
- Bot and fraud checks on sign-ups and logins, 1,000 free checks then usage pricing.
Strengths and limitations
Strengths
- First one million MAU free
- Mature enterprise SSO and SCIM with a self-serve Admin Portal
- Published per-connection pricing with volume discounts
- SDKs for most back-end languages
Limitations
- Each SSO or directory connection costs $125/mo at low volume
- Custom domain is a $99/mo add-on
- Phone and video support requires the $1,000/mo Scale plan
- Hosted only; no self-hosting
Who it suits
Good for
- B2B SaaS preparing to sell to enterprises
- Apps with large user counts that want free hosted login
- Teams replacing an in-house SAML implementation
Look elsewhere if
- Apps that need many low-revenue SSO customers, where per-connection fees add up
- Teams that must self-host identity
Alternatives to WorkOS AuthKit
| Tool | From | Free option | Stages |
|---|---|---|---|
| Amazon Cognito Cloud user directory and auth service | Usage-based | Free tier | |
| Asgardeo Hosted CIAM (with open-source self-hosted option) | $20/mo | Free tier | |
| Authgear Open-source CIAM (cloud, VPC or one-time self-host licence) | $50/mo | Free tier | |
| Firebase Backend platform with document and realtime databases | Usage-based | Free tier | |
| FusionAuth Self-hostable CIAM server | $162/mo | Free tier | |
| Stytch Hosted auth API (B2B and consumer) | $125/mo | Free tier |
Questions
Is WorkOS AuthKit free?
Yes, for the first one million monthly active users. Each additional million costs $2,500 a month.
How much does WorkOS SSO cost?
$125 per connection per month for the first 15 connections, with lower per-connection prices at higher volumes.
What counts as a WorkOS connection?
The link between WorkOS and one group of users signing in through an identity provider, typically one enterprise customer's Okta or Entra tenant.
Does WorkOS charge for staging?
No. Staging environments are free; only production is billed.
Sources read for this page