Skip to content
inetGeek

WorkOS pricing and limits

iScore73–82 · ≈#3/8
workos.com · Authentication
SEPT 2026 audit

Enterprise-readiness platform selling SSO, directory sync and audit logs per connection, with user management free to a million users.

Visit WorkOS documentation
Compare WorkOS with

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

RegionsUnited States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023.
Free tierYes
CategoryAuthentication

Reviewed by Palash BagchiUpdated 23 criteria comparedSources last checked

WorkOS pricing at a glance

Pricing model
No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection… source ↗
What the free plan includes
The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one source ↗

First line of each sourced value. The full text is in WorkOS pricing below.

01.Evaluation guide

Who it suits

B2B products where the enterprise features are the product requirement — a million users cost nothing and you pay only for the connections your customers actually use.

Consider something else if…

Those connections are the most expensive here at $125 a month each, so a long tail of small SSO customers costs more than it does at Clerk or Better Auth.

Editorial · Palash Bagchi · approved

Machine-derived signals

Not sourced facts — counts and matches read by a script, not a person. See each line for where it comes from.

WorkOS's own site (workos.com) self-detects as: hosting — US hosting, Cloud Hosting, Server Location, Cloud PaaS · CDN — Edge Delivery Network · DNS — Enterprise DNS, TLD Redirects (category-level via BuiltWith, not a named vendor)

Each value below links to the page it was read from, with the sentence it came from. Criteria WorkOS does not publish are not listed.

WorkOS pricing

5 criteria
Free tierYes
Sources (1) →
  • Pricing — WorkOS ↗

    “AuthKit User management with social auth, MFA, RBAC, and more [...] Up to 1 million users Free [...] First 1 million active users free”

    Read 2026-09-06 · official pricing · Report a correction

Kind of free offerFree tier
Sources (1) →
  • Pricing — WorkOS ↗

    “AuthKit User management with social auth, MFA, RBAC, and more [...] Up to 1 million users Free [...] First 1 million active users free”

    Read 2026-09-06 · official pricing · Report a correction

What the free plan includesThe first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one.
Sources (1) →
Credit card to startNo
Sources (1) →
  • WorkOS Pricing ↗

    “WorkOS is free to get started and you don't need to add a credit card until you are ready to move to production.”

    Read 2026-09-13 · official pricing · Report a correction

Pricing modelNo monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events.
Sources (1) →
  • Pricing — WorkOS ↗

    “First 1 million active users free [...] $125 / ea [...] Log streaming Per SIEM connection $125 / mo Event Retention Per million events stored $99 / mo”

    Read 2026-09-06 · official pricing · Report a correction

Infrastructure

2 criteria
RegionsUnited States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023.
Sources (1) →
  • Data Processing Addendum ↗

    “What countries will Subscriber Personal Data that is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom be stored in or accessed from? If this varies by region, please specify each country for each region. [...] Answer: United States of America.”

    Read 2026-09-13 · official site · Report a correction

Uptime SLA99.99% on the annual-credits plan. Pay-as-you-go, the entry, publishes no uptime commitment.
Sources (1) →

Observability

1 criteria
Self-hostableNot supported — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API
Sources (1) →

Auth

6 criteria
Users included1,000,000 active users free on AuthKit, then $2,500 per additional million. Two orders of magnitude above the other free allowances here.
Sources (1) →
Price per SSO connection$125 per SSO connection per month for the first 15, falling to $100 at 16–30, $80 at 31–50 and $65 at 51–100. Directory Sync is priced on the same ladder, separately.
Sources (1) →
  • Pricing — WorkOS ↗

    “Single Sign-On [...] Number of connections 1-15 $125 / ea 16-30 20% off $100 / ea 31-50 36% off $80 / ea 51-100 48% off $65 / ea”

    Read 2026-09-06 · official pricing · Report a correction

SAML single sign-onSupported
Sources (1) →
SCIM provisioningSupported
Sources (1) →
Multi-factor authenticationSupported
Sources (1) →
Audit logsBilled rather than bundled: $125 per month per SIEM connection for log streaming, plus $99 per month per million events stored.
Sources (1) →
  • Pricing — WorkOS ↗

    “Audit Logs Capture and export compliance events from your app [...] Log streaming Per SIEM connection $125 / mo Event Retention Per million events stored $99 / mo”

    Read 2026-09-06 · official pricing · Report a correction

Support

1 criteria
Support on entry paid planA dedicated Slack channel on pay-as-you-go; the annual-credits plan adds a guaranteed support SLA.
Sources (1) →
  • WorkOS Pricing ↗

    “first 1 million active users free deploy in minutes dedicated Slack channel [...] pre-pay credit discounts 99.99% uptime SLA guided migration and onboarding guaranteed support SLA”

    Read 2026-09-14 · official pricing · Report a correction

Compliance

8 criteria
SOC 2SOC 2 Type 2 certified.
Sources (1) →
HIPAAWorkOS can sign a Business Associate Agreement (BAA) for customers on enterprise plans.
Sources (1) →
GDPR / data residencyWorkOS states it is GDPR compliant. Data residency options are not detailed on this page.
Sources (1) →
PCI DSSPCI DSS self-attested via SAQ-D as a service provider since December 2025; the attestation of compliance is available in the Trust Center.
Sources (1) →
  • PCI DSS Certification | WorkOS ↗

    “WorkOS is now PCI DSS (self-attested via SAQ-D). [...] This self-attestation demonstrates that WorkOS meets the PCI DSS requirements applicable to our services, supporting customers who operate in payment-regulated environments. Our attestation of compliance is available at our Trust Center, under Resources”

    Read 2026-09-13 · official site · Report a correction

Encryption at restTrust Center control states datastores housing sensitive customer data are encrypted at rest.
Sources (1) →
Customer-managed keysVault BYOK lets a customer supply their own CMK as the key-encrypting key, from AWS KMS, Azure Key Vault or Google Cloud KMS. Applies to data handled by WorkOS Vault; other WorkOS datastores use WorkOS-managed keys.
Sources (1) →
  • Bring Your Own Key (BYOK) – Vault – WorkOS Docs ↗

    “Bring Your Own Key (BYOK) allows your customers to use their own customer-managed keys (CMKs) with WorkOS Vault instead of relying solely on WorkOS-managed keys. [...] Your customers must have compatible key management systems (AWS KMS, Azure Key Vault, Google Cloud KMS)”

    Read 2026-09-13 · official docs · Report a correction

Role-based access controlFully managed RBAC service: custom roles and permissions defined per organization, enforced through session JWTs, with role assignment from IdP groups.
Sources (1) →
  • Role-Based Access Control – WorkOS Docs ↗

    “WorkOS Role-Based Access Control (RBAC) is an authorization system designed for managing access to applications using a flexible roles and permissions model. [...] Fully managed authorization service for defining and enforcing access controls across your application [...] Support for enterprise features like organization-scoped roles and IdP role assignment via SSO and Directory Sync”

    Read 2026-09-13 · official docs · Report a correction

Private networking / VPCAll API traffic is HTTPS on port 443 from Cloudflare's published IP ranges; air-gapped environments with no external network connectivity cannot use WorkOS. On-prem deployment guide; firewall rules or ACLs are the documented network control.
Sources (1) →
  • Using WorkOS with On-prem Customers – WorkOS Docs ↗

    “All requests use HTTPS on port 443 [...] All authentication requests originate from Cloudflare's published IP ranges [...] For customers operating in air-gapped environments with no external network connectivity, cloud-based authentication services like WorkOS cannot be utilized as they require API connectivity.”

    Read 2026-09-13 · official docs · Report a correction

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

WorkOS in the news

Headlines from other publications, not checked by us · collected

Selected by a search on this company, refreshed weekly. Nobody here has verified these claims — where something material is confirmed, it is written into the page above with its source, the way every other fact on this site is.

WorkOS pricing questions

How does WorkOS charge?

No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events.

Pricing — WorkOS · read

Does WorkOS have a free tier?

Yes. The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one.

WorkOS Pricing · read

Do you need a credit card to start on WorkOS?

No.

WorkOS Pricing · read

What uptime does WorkOS guarantee?

99.99% on the annual-credits plan. Pay-as-you-go, the entry, publishes no uptime commitment.

WorkOS Pricing · read

Can you self-host WorkOS?

No — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API.

Using WorkOS with On-prem Customers – WorkOS Docs · read

Compare WorkOS withAll alternatives, ranked →
WorkOS vs Clerk
WorkOS vs Auth0
WorkOS vs Better Auth
WorkOS vs Stytch
WorkOS vs Kinde
WorkOS vs SuperTokens

Comments

Every page here is sourced and dated.