# SuperTokens vs WorkOS

Canonical: https://inetgeek.com/compare/supertokens-vs-workos/

Every value below is read from SuperTokens's and WorkOS's own documentation. See https://inetgeek.com/methodology/ for how.

## At a glance

| Criterion | SuperTokens | WorkOS |
| --- | --- | --- |
| Free tier | Yes | Yes |
| Kind of free offer | Always free | Free tier |
| What the free plan includes | The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users. | The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one. |
| Pricing model | Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit. | No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events. |
| Regions | Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site. | United States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023. |
| Self-hostable | Supported | Not supported — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API |
| Users included | No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor. | 1,000,000 active users free on AuthKit, then $2,500 per additional million. Two orders of magnitude above the other free allowances here. |
| SCIM provisioning | Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself. | Supported |
| Multi-factor authentication | Supported | Supported |
| SOC 2 | Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability. | SOC 2 Type 2 certified. |
| GDPR / data residency | Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there. | WorkOS states it is GDPR compliant. Data residency options are not detailed on this page. |
| Encryption at rest | Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest. | Trust Center control states datastores housing sensitive customer data are encrypted at rest; privileged access to encryption keys is restricted. |
| Role-based access control | Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic. | Fully managed RBAC service: custom roles and permissions defined per organization, enforced through session JWTs, with role assignment from IdP groups. |
| Private networking / VPC | Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering. | All API traffic is HTTPS on port 443 from Cloudflare's published IP ranges; air-gapped environments with no external network connectivity cannot use WorkOS. On-prem deployment guide; firewall rules or ACLs are the documented network control. |

## Where they differ

### Kind of free offer

- SuperTokens: Always free ([source](https://supertokens.com/pricing))
- WorkOS: Free tier ([source](https://workos.com/pricing))

### What the free plan includes

- SuperTokens: The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users. ([source](https://supertokens.com/pricing))
- WorkOS: The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one. ([source](https://workos.com/pricing))

### Pricing model

- SuperTokens: Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit. ([source](https://supertokens.com/pricing))
- WorkOS: No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events. ([source](https://workos.com/pricing))

### Regions

- SuperTokens: Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site. ([source](https://supertokens.com/docs/additional-verification/attack-protection-suite/initial-setup))
- WorkOS: United States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023. ([source](https://workos.com/legal/data-processing-addendum))

### Self-hostable

- SuperTokens: Supported ([source](https://supertokens.com/pricing))
- WorkOS: Not supported — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API ([source](https://workos.com/docs/on-prem-deployment))

### Users included

- SuperTokens: No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor. ([source](https://supertokens.com/pricing))
- WorkOS: 1,000,000 active users free on AuthKit, then $2,500 per additional million. Two orders of magnitude above the other free allowances here. ([source](https://workos.com/pricing))

### SCIM provisioning

- SuperTokens: Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself. ([source](https://supertokens.com/blog/scim-provisioning-explained))
- WorkOS: Supported ([source](https://workos.com/pricing))

### SOC 2

- SuperTokens: Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability. ([source](https://supertokens.com/product))
- WorkOS: SOC 2 Type 2 certified. ([source](https://workos.com/security))

### GDPR / data residency

- SuperTokens: Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there. ([source](https://supertokens.com/pricing))
- WorkOS: WorkOS states it is GDPR compliant. Data residency options are not detailed on this page. ([source](https://workos.com/security))

### Encryption at rest

- SuperTokens: Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest. ([source](https://security.supertokens.com/controls))
- WorkOS: Trust Center control states datastores housing sensitive customer data are encrypted at rest; privileged access to encryption keys is restricted. ([source](https://trust.workos.com/controls))

### Role-based access control

- SuperTokens: Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic. ([source](https://supertokens.com/docs/additional-verification/user-roles/introduction))
- WorkOS: Fully managed RBAC service: custom roles and permissions defined per organization, enforced through session JWTs, with role assignment from IdP groups. ([source](https://workos.com/docs/rbac))

### Private networking / VPC

- SuperTokens: Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering. ([source](https://supertokens.com/docs/deployment/self-host-supertokens))
- WorkOS: All API traffic is HTTPS on port 443 from Cloudflare's published IP ranges; air-gapped environments with no external network connectivity cannot use WorkOS. On-prem deployment guide; firewall rules or ACLs are the documented network control. ([source](https://workos.com/docs/on-prem-deployment))

## Which should you choose?

Pick SuperTokens if Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.

Pick WorkOS if B2B products where the enterprise features are the product requirement — a million users cost nothing and you pay only for the connections your customers actually use.

Consider something else: SuperTokens — The $100 monthly minimum makes it expensive below about 5,000 users, and MFA is a separate per-user charge rather than an included feature.

Consider something else: WorkOS — Those connections are the most expensive here at $125 a month each, so a long tail of small SSO customers costs more than it does at Clerk or Better Auth.

## Documented by only one

- Credit card to start: WorkOS: No
- Entry paid plan: SuperTokens: $100 per month minimum billing on the managed Cloud service; anything from 1 to 4,999 MAU bills at that $100 floor.
- Price per SSO connection: WorkOS: $125 per SSO connection per month for the first 15, falling to $100 at 16–30, $80 at 31–50 and $65 at 51–100. Directory Sync is priced on the same ladder, separately.
- SAML single sign-on: WorkOS: Supported
- Audit logs: WorkOS: Billed rather than bundled: $125 per month per SIEM connection for log streaming, plus $99 per month per million events stored.
- HIPAA: WorkOS: WorkOS can sign a Business Associate Agreement (BAA) for customers on enterprise plans.
- PCI DSS: WorkOS: PCI DSS self-attested via SAQ-D as a service provider since December 2025; the attestation of compliance is available in the Trust Center.
- Customer-managed keys: WorkOS: Vault BYOK lets a customer supply their own CMK as the key-encrypting key, from AWS KMS, Azure Key Vault or Google Cloud KMS. Applies to data handled by WorkOS Vault; other WorkOS datastores use WorkOS-managed keys.

## Questions this comparison answers

**Should I choose SuperTokens or WorkOS?**

Pick SuperTokens if Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.
Pick WorkOS if B2B products where the enterprise features are the product requirement — a million users cost nothing and you pay only for the connections your customers actually use.