WorkOS Pricing (2026): SSO Connection Costs and Fine Print

Short answer: WorkOS pricing has two parts. AuthKit user management is free for the first 1 million monthly active users, then $2,500 per month for each additional million. Enterprise SSO and Directory Sync (SCIM) cost $125 per connection per month for the first 15 connections, with volume rates down to $65, and custom pricing past 100.

WorkOS plans and prices

WorkOS does not sell user seats. It sells a free-to-start authentication layer (AuthKit) plus per-connection enterprise features and usage-based add-ons. For other single sign-on products, including workforce SSO platforms, see the single sign-on software hub.

WorkOS prices, checked September 22, 2026 (USD, from workos.com/pricing):

Watch out: WorkOS publishes no monthly minimum or annual commitment on its pricing page, but it also publishes no contract terms at all. Confirm billing basis, invoicing and term length with sales before you sign anything above the self-serve level.

What WorkOS costs for your SaaS

WorkOS costs scale with how many enterprise customers switch on SSO. The bands are graduated: the cost calculator on the WorkOS pricing page bills the first 15 connections at $125, connections 16 to 30 at $100, and so on, rather than repricing every connection once you cross a band (checked September 22, 2026).

Formula: sum of (connections in each band x band price) x 12 months. AuthKit is assumed to stay under 1 million MAUs, so it adds nothing.

All totals are estimates at list price, before tax and any negotiated discount.

The per-customer view matters most for pricing your own product. At list, one enterprise customer on SSO costs $1,500 a year in the first band, and $3,000 a year if that customer also wants SCIM provisioning. Many SaaS vendors put SSO in a higher tier to cover this, which is the "SSO tax" customers complain about.

What each WorkOS product includes

AuthKit and User Management

AuthKit is WorkOS's hosted login and user management layer. The pricing page lists email and password, social login, passkeys, MFA and magic auth as part of AuthKit, free to 1 million monthly active users. WorkOS defines a monthly active user as any user who signs up, signs in or updates their profile within a calendar month (WorkOS pricing page, checked September 22, 2026). Enterprise SSO through AuthKit is still billed per connection.

Single Sign-On

WorkOS Single Sign-On lets your customers' IT teams connect their identity provider (Okta, Microsoft Entra ID, Google Workspace and others) to your app over SAML or OIDC. WorkOS defines a connection as "the relationship between WorkOS and any group of end users authenticating via an identity provider." In practice, each customer organization with its own IdP is one connection.

Directory Sync

Directory Sync handles SCIM and directory-based provisioning, so your customers can create, update and remove users in your app from their IdP. It uses the same per-connection tiers as SSO and is billed as a separate connection.

Audit Logs, Radar and custom domain

Audit Logs costs $125 a month per SIEM streaming connection plus $99 a month per million retained events. Radar screens sign-ups and sign-ins for bots and fraud, with 1,000 checks free and $100 a month per 50,000 more. A custom domain for hosted auth pages is $99 a month.

Costs beyond the license

The line items outside SSO and Directory Sync that can change a WorkOS budget:

• Support: Standard support is free. Scale support is $1,000 a month and adds video call support, technical onboarding and a 1 business hour P1 response (Monday to Friday, 6 AM to 5 PM Pacific). Enterprise support is custom-priced and adds a 1-hour, 24x7 P1 response and 24x7 response-time SLAs. The 99.99% uptime SLA is listed with the custom Annual Credits plan and Enterprise agreements.
• Custom domain: $99 a month if you want login pages on your own domain.
• Audit log streaming: $125 a month for each customer SIEM you stream to, which adds up if enterprise customers each ask for their own stream.
• Engineering time: WorkOS removes most of the protocol work, but your team still builds the settings pages, tier gating and onboarding flow around it.

Free plan and trial

WorkOS has no time-limited trial because the core product is free until it reaches production. AuthKit is free to 1 million MAUs, and staging environments are free for testing, with only production environments billed (WorkOS pricing page, checked September 22, 2026). You pay for SSO or Directory Sync from the first production connection. WorkOS says you do not need to add a credit card until you move to production.

Discounts and contract terms

The only published discounts are the volume bands on SSO and Directory Sync: 20% off list at 16 to 30 connections, 36% at 31 to 50 and 48% at 51 to 100. Above 100 connections pricing is custom. WorkOS publishes no startup, nonprofit or education discount on its pricing page, and no contract term, auto-renewal or cancellation terms there. Treat all of those as "not published" and ask in writing.

Renewal pricing

WorkOS does not publish renewal terms or any first-year promotional rate, so list prices are also the renewal reference. No announced increase to the $125 per-connection list price was found in the WorkOS changelog or pricing page during research on September 22, 2026. For custom-priced contracts above 100 connections, renewal terms depend on your agreement.

WorkOS price history

No other dated, vendor-published price change was found.

How WorkOS pricing compares

WorkOS is not the cheapest per SSO connection. Clerk, Stytch and Auth0's B2B plans all publish lower connection fees at small counts, though each also has plan or usage fees. List prices checked September 22, 2026, connection fees only (plan fees excluded):

Clerk also charges a plan fee (Pro from $25 a month, or $20 a month billed annually) and sells a B2B Authentication add-on at $100 a month, and it counts users as monthly retained users rather than MAUs (Clerk pricing page, checked September 22, 2026). Stytch includes 10,000 MAUs and 5 SSO or SCIM connections free (Stytch pricing page, checked September 22, 2026). Auth0 also charges its plan fee, from $150 a month for 500 MAUs on B2B Essentials, and its B2C plans include no enterprise connections (Auth0 pricing, checked September 22, 2026).

For how the password manager market prices the same SSO features for internal teams, the business password manager pricing index shows the per-seat side of the SSO tax.

Is WorkOS worth the price?

WorkOS fits B2B SaaS teams whose enterprise deals are large enough that $1,500 to $3,000 a year per customer is a small fraction of contract value. For those teams, the free AuthKit tier to 1 million users and one vendor for SSO, SCIM, audit logs and admin setup keep the cost predictable per deal.

WorkOS fits less well when many small customers want SSO. Two Hacker News threads from 2024 carry the same complaint: one commenter said the per-organization price means "most SMBs (my clients) can't afford it" (HN, January 4, 2024), and a current WorkOS customer wrote that "the pricing means we have to charge our customers more for it" (HN, June 21, 2024). In the first thread, a commenter who described WorkOS customers as "our customers" replied that customers bundle the cost into their own plans and preferred per-organization pricing to per-user pricing.

If most of your SSO customers are small, model Clerk or Stytch at your real connection count first. If you sell to large enterprises and also need Directory Sync and audit log streaming, WorkOS's price is easier to recover in each contract.

Bottom line

WorkOS is priced for B2B SaaS companies selling to enterprise buyers: free for sign-in, and $125 a month per customer for SSO, with SCIM billed again on top. Run the connection math on your own customer list before choosing, and if many small customers want SSO, compare Clerk's and Stytch's included connections. To match WorkOS against workforce SSO tools and your own requirements, start from the SSO shortlist builder.