Consider it for
B2B software teams with actual enterprise SSO or provisioning requirements and developers responsible for tenant access controls.
Auth · Written evaluation
WorkOS
Authentication and enterprise identity infrastructure, with enterprise connections priced separately from AuthKit users.
Plan at a glance
Plans & sources ↓AuthKit up to one million active users; Radar’s first 1,000 checks have a separate free allowance.
Limits to check
Enterprise SSO and Directory Sync are separate per-connection charges; standalone SSO does not supply the application’s user database or authorization rules.
Official sources read 9 October 2026. The evaluation below is editorial judgement based on documentation; no hands-on product test was performed.
Research scope & testing evidence
Our evaluation
WorkOS has a clear role when a B2B product needs to satisfy a customer’s enterprise identity requirements without building each provider integration from scratch. The connection-based SSO price is easier to assess against a customer contract than a generic end-user count. It also makes the distinction between free AuthKit users and paid enterprise connections important: one does not include the other. Standalone SSO can preserve an existing authentication stack, but the application still owns organization mapping, roles and access checks. Directory provisioning is another product and another lifecycle to test. Buy against a concrete requirement from an enterprise customer rather than a vague ambition to appear enterprise-ready. A staging identity-provider test should prove both successful login and denied cross-tenant access.
Fit and limits
Fit and limits
Check before committing
Enterprise SSO and Directory Sync are separate per-connection charges; standalone SSO does not supply the application’s user database or authorization rules.
What the documentation confirms
What the documentation confirms
- AuthKit provides a user-management and authentication platform.
- Standalone SSO integrates SAML or OpenID Connect providers with an existing authentication stack.
- Directory Sync supports enterprise provisioning; it is a separately priced product.
Selected official documents read 9 October 2026. Access can depend on plan, region and account.
Price and billing scope
| Plan or charge | Observed price | Billing, allowance and limits |
|---|---|---|
| AuthKit user management | USD 0 for up to 1 million AuthKit MAU | Monthly allowance. Up to one million monthly active users; enterprise SSO, Directory Sync and optional products are separate. Official source ↗ |
| Single Sign-On | USD 125/SSO connection/month for 1–15 connections | Monthly. First 1–15 connections at this rate; each enterprise customer connection is metered, with volume discounts above that band. Official source ↗ |
| Directory Sync | USD 125/Directory Sync connection/month for 1–15 connections | Monthly. Separate from SSO; first 1–15 connections at this rate, with volume pricing for larger counts. Official source ↗ |
These are selected published charges, not a complete account bill. Check eligibility, tax, add-ons and the price shown for your account before paying.
Recorded editorial criteria
Recorded editorial criteria
These are the previously recorded editorial opinions used in the directory. They have no individually recorded assessment date and were not rescored during this documentation refresh. They are not product-test results.
| Functionality | 9/10 |
|---|---|
| Pricing value | 8/10 |
| Ease of use | 8/10 |
| Reliability | 9/10 |
| Founder fit | 8/10 |
Try one complete task
Use the staging mock identity provider to sign in a test organization, map its tenant, deny cross-tenant access and test deprovisioning if Directory Sync is selected; count each required production connection.
Create a trial worksheet →Compare requirements
Edited by Clinton Feyisitan · Evidence policy · Suggest a correction