WorkOS review

WorkOS provides APIs and tools for adding enterprise identity features to applications. It is aimed at developers building apps that need to handle business customers’ logins, users, and organizations—not a replacement identity provider for a company’s own employees.

Its products cover SAML and OIDC single sign-on, user and organization management, directory syncing through SCIM and HRIS integrations, multi-factor authentication, and access control. The hosted Admin Portal lets a customer’s IT team configure WorkOS for its organization. Developers can also use WorkOS to manage policies and permissions, including role-based access and finer-grained authorization for app resources.

The practical pitch is one integration for features that B2B customers may expect from different enterprise identity providers. That can simplify the product work, but it does not make each enterprise connection free: SSO and Directory Sync are priced per connection.

The clearest value is AuthKit’s published free allowance: up to 1 million monthly active users. WorkOS also lists the first 1 million active users as free on its usage-based Pay as you go plan. That gives an app room to add user management and authentication before the bill grows with its user count. A commenter on r/nextjs also praised WorkOS’s free tier and mentioned directory sync and the self-serve portal, though that is one user’s view, not a pricing guarantee.

WorkOS groups useful B2B building blocks together: SSO, Directory Sync, user and organization management, MFA, and access control. The hosted Admin Portal gives customers’ IT admins a place to configure the integration rather than requiring every setup step to happen in your app. The pricing page lists automatic volume discounts and a dedicated Slack channel on Pay as you go. Annual Credits adds prepay discounts, guided migration and onboarding, a 99.99% uptime SLA, and a guaranteed support SLA; its rates are not published.

For teams selling to businesses, this is a credible way to offer enterprise identity features without pricing user authentication by default from the first active user.

The free user allowance does not mean enterprise connections are free. The pricing page lists SSO at $125 per connection per month for connections 1–15, $100 for 16–30, $80 for 31–50, and $65 for 51–100. Directory Sync has the same rates. So an app with several enterprise customers can face a meaningful bill even while AuthKit users remain within the free allowance. The listed $65 rate applies only at the 51–100 connection tier, not to the first connection.

There are other charges to account for: each additional 1 million AuthKit users is listed at $2,500 per month; a custom domain is $99 per month; audit-log streaming is $125 per month per SIEM connection; and audit-event retention is $99 per million events stored. Annual Credits rates are not published, which makes that option hard to compare without a quote.

Documentation is another reported concern. Several commenters on r/nextjs said they struggled to find examples or navigate the docs. Those are individual reports, but they matter when your team needs to implement organization switching or framework-specific flows. One Reddit user described needing an API call and callback-based silent authentication to switch organizations.

WorkOS has free authentication, but enterprise identity is priced by connection. AuthKit is listed at $0 for up to 1 million monthly active users; each additional million is $2,500 per month. Pay as you go also includes the first 1 million active users free, but the rates beyond that are not published here.

Single Sign-On and Directory Sync each list rates of $125 per connection per month for 1–15 connections, falling to $100 for 16–30, $80 for 31–50, and $65 for 51–100. That is not a flat-rate SSO plan: budget against your connection count, and confirm how the tier rates apply to your account before forecasting costs.

Add-ons can change the bill: a custom domain is $99 per month; Audit Log streaming is $125 per month per SIEM connection, and retention is $99 per million events stored. Radar includes 1,000 checks free, then costs $100 per 50,000 checks. Annual Credits offers prepay discounts, but its rates are not published.

Switching to WorkOS means planning beyond the login screen. Its products can handle SSO, user and organization management, directory syncing, and access control, so inventory which of those your app uses before moving. Map existing users, organizations, roles, identity-provider connections, and directory lifecycle flows, then decide what must move and what can stay in place. That is migration planning, not a guarantee that every setup transfers automatically.

The published product and pricing information does not specify data-export formats, migration tooling, or an exit process. Get those answers before making WorkOS a core dependency, especially if you rely on its directory sync or authorization rules. The published material also includes no Reddit posts or comments, so we can’t substantiate claims about why customers leave or how difficult their migrations were. Ask WorkOS about export access, SSO connection changes, and support during a move; Annual Credits lists guided migration and onboarding, but its pricing is custom and unpublished.