Learn how WorkOS adds SSO, SCIM directory sync, and user management to SaaS apps, plus pricing from $125 per connection, features, pros, cons, and FAQs.
WorkOS is a developer platform that lets business-to-business software companies add the security and identity features enterprise buyers demand, including single sign-on, directory sync, audit logs, and role-based access control, without building each of those systems from scratch.
Founded in 2018 by Michael Grinich and based in San Francisco, WorkOS was built around a common problem for growing SaaS startups: a promising enterprise deal stalls in security review because the buyer requires SAML SSO, SCIM provisioning into their identity provider, multi-factor authentication, and audit logging, features that can otherwise take months of engineering time to build correctly.
WorkOS has become especially popular with AI-native companies selling developer tools and applications into large enterprises, with publicly disclosed customers including OpenAI, Anthropic, xAI, Cursor, Perplexity, Replit, and Vercel.
Single Sign-On provides a unified API for SAML 2.0 and OpenID Connect that works across major identity providers such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, Ping Identity, and ADFS, so engineering teams write integration code once rather than per provider.
Directory Sync implements SCIM 2.0 to automate user provisioning and deprovisioning from a customer's identity directory, and AuthKit supplies a prebuilt, themeable authentication interface covering passwords, social login, magic links, multi-factor authentication, and multi-tenant organizations.
Additional modules include Audit Logs for compliance-ready event tracking, fine-grained authorization for granular permission models, and Radar for detecting bot traffic and account-takeover fraud, letting a single integration cover most enterprise-readiness requirements.
WorkOS uses a connection-based pricing model rather than charging per end user: each enterprise customer a company onboards through SSO or Directory Sync is billed as one connection, regardless of whether that customer has 10 or 10,000 employees behind it.
List pricing starts at 125 US dollars per connection per month, with automatic volume discounts as a company adds more enterprise customers, stepping down to roughly 100 US dollars per connection at 16 to 30 connections, 80 US dollars at 31 to 50, and 65 US dollars at 51 to 100.
AuthKit includes a generous free tier based on monthly active users, so early-stage companies can use core authentication for free and only start paying once they need enterprise SSO or directory sync for larger customers.
WorkOS lets B2B SaaS companies add enterprise-required features like single sign-on, SCIM directory sync, audit logs, and role-based access control through APIs instead of building each one internally.
WorkOS charges a flat fee per enterprise customer connection for SSO and Directory Sync, starting at 125 US dollars per connection per month, with automatic volume discounts as more connections are added; AuthKit includes a free tier for monthly active users.
WorkOS was founded in 2018 by Michael Grinich, who previously co-founded Nylas, and is headquartered in San Francisco, California.
WorkOS supports SAML and OIDC single sign-on with providers including Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, Ping Identity, and ADFS, plus SCIM directory sync with dozens of HR and identity directories.
AuthKit is WorkOS's prebuilt, themeable authentication UI that handles passwords, social login, magic links, multi-factor authentication, and multi-tenant organizations out of the box.
Publicly disclosed WorkOS customers include OpenAI, Anthropic, xAI, Cursor, Perplexity, Replit, and Vercel, among many other B2B SaaS and AI companies.
Yes. AuthKit offers a free tier based on monthly active users, letting companies use core authentication at no cost before they need paid SSO or Directory Sync connections.
WorkOS focuses specifically on making B2B applications enterprise ready with connection-based pricing, while Auth0 and Okta offer broader identity platforms often priced per monthly active user or per employee seat.