whichdevtool? Search tools /
Menu
DirectoryFree tiersCompareStacksCalculatorsChanges
VPS and cloud servers 25 App hosting and PaaS 27 Managed databases 31 Transactional email APIs 30 Email marketing and newsletters 32 Domain registrars 27 CDN, DNS and edge security 32 Monitoring, uptime and error tracking 28 Auth and identity 32

Hosted auth with enterprise SSO · by WorkOS

WorkOS AuthKit

Hosted user management free up to one million MAU, with enterprise SSO, SCIM directory sync and audit logs sold per connection for B2B SaaS.

Visit workos.com ↗ Alternatives Free tier
§1

Overview

WorkOS started as an API for enterprise single sign-on and now also sells AuthKit, a full user management product with hosted login UI. AuthKit handles email and password, social providers, passkeys, MFA and six-digit email codes, and it is free for the first one million monthly active users, which is far above most competitors' free tiers.

The business model is per-connection pricing for enterprise features. Each SAML or OIDC SSO connection costs $125 a month for the first 15, with discounts down to $65 each past 50 connections, and SCIM or HRIS directory sync connections are priced the same way. The Admin Portal lets your customer's IT team set up their own connection, which saves support time.

Extras such as a custom auth domain ($99 a month), audit log streaming and Radar bot protection are billed separately, and faster support costs $1,000 a month. For a consumer or early product the bill can be zero; for B2B, cost tracks the number of enterprise customers, which usually aligns with revenue.

§2

Pricing and plans

checked 28 Sept 2026

Free tier

AuthKit user management free for the first 1 million MAU: email and password, social login, passkeys, MFA and magic auth; staging environments free; 1,000 Radar bot checks

Plan Price What you get
AuthKit Free First 1M MAU; each further 1M MAU $2,500/mo
SSO connection $125/mo Per connection for 1-15; $100 (16-30), $80 (31-50), $65 (51-100)
Directory Sync connection $125/mo Same volume tiers as SSO
Custom domain $99/mo Add-on
Audit Logs $125/mo Per SIEM stream; retention $99/mo per 1M events
Annual Credits Custom Pre-pay discounts, 99.99% SLA, guided migration

Pay-as-you-go; only production environments are billed. Radar bot and fraud protection: first 1,000 checks free, then $100/mo per 50,000. Support: Standard free, Scale $1,000/mo, Enterprise custom. The pricing page does not say whether a card is needed to start. Compliance certifications and data-residency options were not listed on the pages read, so they are left empty and euRegion is false.

Source: workos.com/pricing · prices as published, excluding tax.

§3

What it does

AuthKit
Hosted, customisable login UI and user management with passwords, social, passkeys, MFA and magic auth.
Enterprise SSO
One integration supports any SAML or OIDC identity provider such as Okta or Microsoft Entra.
Directory Sync
SCIM provisioning from Okta, Entra ID and others, plus HRIS integrations like BambooHR and Rippling, with webhook events.
Admin Portal
Hosted setup flow where customer IT admins configure SSO and directories themselves, with step-by-step guides.
Audit Logs
Store, query and export audit events and stream them to a customer's SIEM.
Radar
Bot and fraud checks on sign-ups and logins, 1,000 free checks then usage pricing.
§4

Strengths and limitations

Strengths

  • First one million MAU free
  • Mature enterprise SSO and SCIM with a self-serve Admin Portal
  • Published per-connection pricing with volume discounts
  • SDKs for most back-end languages

Limitations

  • Each SSO or directory connection costs $125/mo at low volume
  • Custom domain is a $99/mo add-on
  • Phone and video support requires the $1,000/mo Scale plan
  • Hosted only; no self-hosting
§5

Who it suits

Good for

  • B2B SaaS preparing to sell to enterprises
  • Apps with large user counts that want free hosted login
  • Teams replacing an in-house SAML implementation

Look elsewhere if

  • Apps that need many low-revenue SSO customers, where per-connection fees add up
  • Teams that must self-host identity
§6

Alternatives to WorkOS AuthKit

Tool From Free option Stages
Amazon Cognito Cloud user directory and auth service
Usage-based Free tier
Asgardeo Hosted CIAM (with open-source self-hosted option)
$20/mo Free tier
Authgear Open-source CIAM (cloud, VPC or one-time self-host licence)
$50/mo Free tier
Firebase Backend platform with document and realtime databases
Usage-based Free tier
FusionAuth Self-hostable CIAM server
$162/mo Free tier
Stytch Hosted auth API (B2B and consumer)
$125/mo Free tier

All auth and identity →

§7

Questions

Is WorkOS AuthKit free?

Yes, for the first one million monthly active users. Each additional million costs $2,500 a month.

How much does WorkOS SSO cost?

$125 per connection per month for the first 15 connections, with lower per-connection prices at higher volumes.

What counts as a WorkOS connection?

The link between WorkOS and one group of users signing in through an identity provider, typically one enterprise customer's Okta or Entra tenant.

Does WorkOS charge for staging?

No. Staging environments are free; only production is billed.

Sources read for this page