SuperTokens vs WorkOS
SEPT 2026 auditA comparison of SuperTokens and WorkOS built from values read directly from each provider's own documentation, with the source recorded against every figure.
The short answer
Choose SuperTokens if…
Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.
Editorial · Palash Bagchi · approved
Choose WorkOS if…
B2B products where the enterprise features are the product requirement — a million users cost nothing and you pay only for the connections your customers actually use.
Editorial · Palash Bagchi · approved
Consider something else if…
- SuperTokens: The $100 monthly minimum makes it expensive below about 5,000 users, and MFA is a separate per-user charge rather than an included feature.
- WorkOS: Those connections are the most expensive here at $125 a month each, so a long tail of small SSO customers costs more than it does at Clerk or Better Auth.
12 sourced criteria separate them — see where, with sources, below.
Pick the criteria you care about. The chart counts how many of them lean toward each provider — the same read as scanning the bars below, just totalled for the ones you chose.
SuperTokens 0
WorkOS 0
At a glance.
| Criterion | SuperTokens | WorkOS |
|---|---|---|
| Pricing | ||
| Free tier | Yes | Yes |
| Kind of free offer | Always free | Free tier |
| What the free plan includes | The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users. | The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one. |
| Pricing model | Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit. | No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events. |
| Infrastructure | ||
| Regions | Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site. | United States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023. |
| Observability | ||
| Self-hostable | Supported | Not supported — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API |
| Auth | ||
| Users included | No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor. | 1,000,000 active users free on AuthKit, then $2,500 per additional million. Two orders of magnitude above the other free allowances here. |
| SCIM provisioning | Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself. | Supported |
| Multi-factor authentication | Supported | Supported |
| Compliance | ||
| SOC 2 | Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability. | SOC 2 Type 2 certified. |
| GDPR / data residency | Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there. | WorkOS states it is GDPR compliant. Data residency options are not detailed on this page. |
| Encryption at rest | Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest. | Trust Center control states datastores housing sensitive customer data are encrypted at rest; privileged access to encryption keys is restricted. |
| Role-based access control | Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic. | Fully managed RBAC service: custom roles and permissions defined per organization, enforced through session JWTs, with role assignment from IdP groups. |
| Private networking / VPC | Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering. | All API traffic is HTTPS on port 443 from Cloudflare's published IP ranges; air-gapped environments with no external network connectivity cannot use WorkOS. On-prem deployment guide; firewall rules or ACLs are the documented network control. |
Where they differ.
Kind of free offer
- SuperTokens
- Always free
- WorkOS
- Free tier
Sources (2) →Sources ↓
- SuperTokens Pricing ↗
“Self hosting the open source features is free without any limits!”
Read 2026-09-13 · official pricing
- Pricing — WorkOS ↗
“AuthKit User management with social auth, MFA, RBAC, and more [...] Up to 1 million users Free [...] First 1 million active users free”
Read 2026-09-06 · official pricing
What the free plan includes
- SuperTokens
- The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users.
- WorkOS
- The first 1 million monthly active users of AuthKit are free; Single Sign-On and Directory Sync are billed per connection from the first one.
Sources (2) →Sources ↓
- SuperTokens Pricing ↗
“In self hosted, you can use the open source features of SuperTokens for free at any scale and pay only for the paid features mentioned in "Scale". [...] free for first 3 users”
Read 2026-09-13 · official pricing
- WorkOS Pricing ↗
“Pricing up to 1 million users free per additional 1M users $2,500 / mo”
Read 2026-09-13 · official pricing
Pricing model
- SuperTokens
- Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit.
- WorkOS
- No monthly platform fee and no per-user charge below a million: WorkOS gives user management away and bills per enterprise connection instead — SSO and Directory Sync at $125 each per month, audit log streaming at $125 per SIEM connection, event retention at $99 per million events.
Sources (2) →Sources ↓
- Pricing & Features for SuperTokens ↗
“Cloud Self-hosted $0.02 per MAU [...] Multi-factor Authentication $0.01 / MAU [...] Account Linking $0.005 / MAU [...] Number of Dashboard users (3 free users) $20 / user / month”
Read 2026-09-13 · official pricing
- Pricing — WorkOS ↗
“First 1 million active users free [...] $125 / ea [...] Log streaming Per SIEM connection $125 / mo Event Retention Per million events stored $99 / mo”
Read 2026-09-06 · official pricing
Regions
- SuperTokens
- Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site.
- WorkOS
- United States: the DPA's transfer impact assessment names the USA as the only country where subscriber personal data is stored or accessed from. From Exhibit B of the Data Processing Addendum, updated June 27, 2023.
Sources (2) →Sources ↓
- Initial setup - SuperTokens Docs ↗
“To use the service, send requests to the appropriate regional endpoint based on your location: [...] US Region (N. Virginia) [...] APAC Region (Singapore)”
Read 2026-09-13 · official docs
- Data Processing Addendum ↗
“What countries will Subscriber Personal Data that is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom be stored in or accessed from? If this varies by region, please specify each country for each region. [...] Answer: United States of America.”
Read 2026-09-13 · official site
Self-hostable
- SuperTokens
- Supported
- WorkOS
- Not supported — WorkOS on-prem guide covers your app running on-prem and still calling the WorkOS cloud API
Sources (2) →Sources ↓
- Pricing — SuperTokens ↗
“Cloud Self-hosted $0.02 per MAU [...] Self hosted (You Host)”
Read 2026-09-06 · official pricing
- Using WorkOS with On-prem Customers – WorkOS Docs ↗
“For customers operating in air-gapped environments with no external network connectivity, cloud-based authentication services like WorkOS cannot be utilized as they require API connectivity.”
Read 2026-09-13 · official docs
Users included
No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor.
1,000,000 active users free on AuthKit, then $2,500 per additional million. Two orders of magnitude above the other free allowances here.
Sources (2) →Sources ↓
- Pricing — SuperTokens ↗
“$0.02 per MAU Number of unique logged in users that are on your prod [...] if you have 5,000 MAUs, that will be ( $0.02 + $0.005 ) * 5000 = $125”
Read 2026-09-06 · official pricing
- Pricing — WorkOS ↗
“Up to 1 million users Free [...] Per additional 1M users $2,500 / mo”
Read 2026-09-06 · official pricing
SCIM provisioning
- SuperTokens
- Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself.
- WorkOS
- Supported
Sources (2) →Sources ↓
- SCIM Provisioning Explained: The Definitive Guide for Enterprise SaaS (2026) ↗
“SuperTokens does not provide SCIM out of the box, but you can implement SCIM endpoints on top of it for full control and flexibility.”
Read 2026-09-13 · official site
- Pricing — WorkOS ↗
“Directory Sync User provisioning, de-provisioning, and role mapping [...] 1-15 $125 / ea”
Read 2026-09-06 · official pricing
SOC 2
- SuperTokens
- Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability.
- WorkOS
- SOC 2 Type 2 certified.
Sources (2) →Sources ↓
- SuperTokens - Modular User Management Suite ↗
“SOC2 100+ controls and tests.”
Read 2026-09-13 · official site
- WorkOS Security ↗
“SOC 2 Type 2 certified.”
Read 2026-09-11 · official site
GDPR / data residency
- SuperTokens
- Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there.
- WorkOS
- WorkOS states it is GDPR compliant. Data residency options are not detailed on this page.
Sources (2) →Sources ↓
- Pricing & Features for SuperTokens ↗
“Supertokens Auth0 AWS Cognito Keycloak Firebase [...] Compliance (SOC2, GDPR) Yes Yes Yes Self hosted - so not required Yes”
Read 2026-09-13 · official pricing
- WorkOS Security ↗
“Yes, WorkOS is GDPR compliant.”
Read 2026-09-11 · official site
Encryption at rest
- SuperTokens
- Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest.
- WorkOS
- Trust Center control states datastores housing sensitive customer data are encrypted at rest; privileged access to encryption keys is restricted.
Sources (2) →Sources ↓
- SuperTokens Trust Center - Controls ↗
“Data encryption utilized [...] The company's datastores housing sensitive customer data are encrypted at rest.”
Read 2026-09-13 · official site
- Controls — WorkOS Trust Center ↗
“Data encryption utilized [...] The company's datastores housing sensitive customer data are encrypted at rest.”
Read 2026-09-13 · official site
Role-based access control
- SuperTokens
- Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic.
- WorkOS
- Fully managed RBAC service: custom roles and permissions defined per organization, enforced through session JWTs, with role assignment from IdP groups.
Sources (2) →Sources ↓
- Introduction - SuperTokens Docs ↗
“SuperTokens provides a way to set different levels of authorization control through the User Roles feature. With it, you can create roles and permissions, assign them to your users and limit access based on your application logic.”
Read 2026-09-13 · official docs
- Role-Based Access Control – WorkOS Docs ↗
“WorkOS Role-Based Access Control (RBAC) is an authorization system designed for managing access to applications using a flexible roles and permissions model. [...] Fully managed authorization service for defining and enforcing access controls across your application [...] Support for enterprise features like organization-scoped roles and IdP role assignment via SSO and Directory Sync”
Read 2026-09-13 · official docs
Private networking / VPC
- SuperTokens
- Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering.
- WorkOS
- All API traffic is HTTPS on port 443 from Cloudflare's published IP ranges; air-gapped environments with no external network connectivity cannot use WorkOS. On-prem deployment guide; firewall rules or ACLs are the documented network control.
Sources (2) →Sources ↓
- Self-host SuperTokens - SuperTokens Docs ↗
“Core and PostgreSQL on private networks reachable only by trusted backend services; never expose either directly to a browser or any client you do not trust. [...] Run the Core on a private network or subnet that only your backend can reach. This is the primary protection and applies regardless of any other setting.”
Read 2026-09-13 · official docs
- Using WorkOS with On-prem Customers – WorkOS Docs ↗
“All requests use HTTPS on port 443 [...] All authentication requests originate from Cloudflare's published IP ranges [...] For customers operating in air-gapped environments with no external network connectivity, cloud-based authentication services like WorkOS cannot be utilized as they require API connectivity.”
Read 2026-09-13 · official docs
When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.
Documented by only one.
These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing.
Questions this comparison answers.
Should I choose SuperTokens or WorkOS?
Pick SuperTokens if Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.
Pick WorkOS if B2B products where the enterprise features are the product requirement — a million users cost nothing and you pay only for the connections your customers actually use.