WorkOS is the cheat code for "we need enterprise SSO" without rebuilding your auth stack. Free for the first 1M users on SSO and free indefinitely for the basics, it's specifically priced to remove the wedge that holds B2B SaaS back from selling into enterprise. The trade is that WorkOS solves the enterprise surface, not your full auth flow, most teams use it alongside Clerk, Better Auth, or their own user model. For B2B teams going upmarket, WorkOS is the right shape.
- Free for the first 1M SSO users, explicit "remove enterprise wedge" pricing
- SCIM + SSO + audit logs + RBAC in one API
- AuthKit gives a customizable hosted sign-in UI when you want one
- MCP Auth (2026) for session-scoped agent authorization
- Pairs cleanly with Clerk, Better Auth, or your own user model
- Solves the enterprise edges, not your full auth flow
- Need to bring your own primary auth (Clerk, Better Auth, etc.)
- Per-connection pricing kicks in for paid features
- Newer surfaces (Radar, FGA, MCP Auth) still maturing
- Dashboard is utilitarian, less polished than Clerk's
WorkOS is the “enterprise readiness” layer for B2B SaaS, SSO, SCIM directory sync, audit logs, fine-grained authorization, and MCP Auth, all behind a single API. The business model is deliberately backwards: free for the basics so startups can ship enterprise features on day one without procurement-blocking costs, then paid for advanced features and scale.
Where it fits
WorkOS is the right pick when your B2B customers start asking for SSO, SAML, or SCIM and you don’t want to build it. Drop WorkOS in alongside your existing auth (Clerk, Better Auth, your own user model) and the enterprise surface lights up, SAML for Okta, Azure AD, Google Workspace; SCIM provisioning from any major IdP; audit logs that satisfy SOC2 reviewers.
For agentic SaaS, MCP Auth (shipped March 2026) is the new wedge , session-scoped OAuth that lets an agent act on a user’s behalf for a bounded time, then expire. This is a real primitive that doesn’t exist cleanly anywhere else.
For greenfield apps that don’t already have auth, WorkOS is not the place to start, AuthKit can serve as primary auth but the ergonomics still trail Clerk and Better Auth meaningfully.
Pricing in practice
SSO is free for the first 1M users, the explicit pitch is “no revenue wedge for enterprise readiness.” Directory Sync, Magic Link auth, and basic user management are free for unlimited users. Audit Logs are free for the first 1M events. Paid features kick in for FGA, Radar (fraud protection), MCP Auth scale, and multiple SSO connections beyond the included tier.
The pricing is built to remove the moment a startup says “we can’t afford to ship enterprise SSO yet”, startup-friendly upfront, scales with usage on the features only larger customers need.
How it compares
Auth0, Full identity platform with enterprise protocol coverage in the same product. Pick when you want one vendor for all auth, not a primary + bridge.
Clerk, Modern auth-as-a-service with drop-in React components. Pair Clerk + WorkOS for the best DX + enterprise readiness combo.
Kinde, Affordable auth-as-a-service with simpler pricing. Pick when you don’t yet need enterprise surfaces and want one vendor.
What changed recently
WorkOS shipped MCP Auth in March 2026 for session-scoped authorization of AI agents, formalizing the “delegate-then-expire” pattern across the MCP ecosystem. Agent Experience tooling shipped the same week with terminal-native dev workflows. The Enterprise Readiness Checklist (May 2026) consolidated SSO, SCIM, MCP, audit logs, and RBAC into a reference architecture for B2B SaaS. Project Horizon (internal code factory) reflects WorkOS’s investment in AI-generated SDK maintenance across languages.
Sources
- WorkOS Blog, workos.com, May 2026
- WorkOS Pricing, workos.com
- MCP Auth, workos.com, March 2026
- Enterprise Readiness Checklist, workos.com