Cloud Parts

WorkOS

APIs that make a SaaS app “enterprise-ready”: SSO over SAML and OIDC, SCIM directory sync, a hosted login (AuthKit), audit logs and authorization.

What it is
Authentication
Type
Commercial product
Made by
WorkOS, Inc.
License
Proprietary (SDKs and AuthKit UI MIT)
Facts checked
6 October 2026
Website

What it is

When a startup’s app starts selling to large companies, their IT teams ask for the same list: staff must sign in through the company’s identity provider (single sign-on), accounts must be created and removed from the company directory (SCIM provisioning), and security teams want audit logs. WorkOS sells each of these as an API. Its SSO service speaks SAML and OIDC to any identity provider but presents your app with one OAuth-style flow: redirect the user to WorkOS, get back a code, swap it for a normalised user profile. Directory Sync turns SCIM and HR-system feeds into users, groups and webhook events, and the Admin Portal is a hosted setup page where the customer’s IT admin configures their own connection, so your engineers don’t have to on a call.

On top of that sits User Management with AuthKit, a hosted, customisable login page with passwords, social logins, magic links and MFA, plus organisations, roles, fine-grained authorization and audit logs. The pricing splits the same way: User Management is free up to 1 million monthly active users, then $2,500 a month per extra million, while SSO and Directory Sync are charged per customer connection, $125 a month each for the first 15 with volume discounts after that.

Why teams pick it

  • Built around B2B needs: SAML and OIDC SSO, SCIM provisioning and audit logs behind one API
  • The Admin Portal lets each customer’s IT admin set up their own SSO and directory connection
  • Free hosted login up to 1 million monthly active users
  • Per-connection pricing maps to revenue: you pay for SSO when an enterprise customer needs it, regardless of how many of their users sign in

Watch out for

  • Connection fees add up for many mid-sized customers: 15 SSO connections cost $1,875 a month at list price, and Directory Sync is billed separately
  • A hosted, closed-source service; your login depends on WorkOS being up, and leaving means migrating users and connections
  • Custom domains for AuthKit and the Admin Portal are an extra $99 a month

Alternatives

What all authentication have in common →
Auth0CommercialA hosted login and user-management service: your app redirects to Auth0, which signs users in with passwords, social accounts, passkeys or enterprise SSO and hands back tokens.

How it fits with other technologies

Start SSO for a customer organisation, then exchange the code for a profile (Node SDK) · ts

import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS(process.env.WORKOS_API_KEY);
const clientId = process.env.WORKOS_CLIENT_ID;

// 1. Send the user to their company's identity provider (SAML or OIDC)
const url = workos.sso.getAuthorizationUrl({
  organization: 'org_test_idp',
  redirectUri: 'https://app.example.com/callback',
  clientId,
});

// 2. In the callback: swap the one-time code (valid 10 minutes) for the user's profile
const { profile } = await workos.sso.getProfileAndToken({ code, clientId });
if (profile.organizationId !== 'org_test_idp') throw new Error('wrong org');

See it in a real stack

No architecture uses WorkOS yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2019–2023

Michael Grinich co-founded Nylas, whose email app, Nylas Mail, users loved but large companies wouldn’t adopt: it had never been built for the enterprise IT admins who actually buy software, with their requirements for single sign-on, provisioning and audit logs. Nylas shut the app down and pivoted to infrastructure for sales tools. Grinich later gave a talk called “Crossing the Enterprise Chasm” to warn other startups, and in 2019 started WorkOS to sell those enterprise features as an API, which he described as “Stripe for enterprise-ready features”.

WorkOS launched in 2020 and quietly raised a $15 million Series A that year, led by Lachy Groom, an early Stripe employee; it announced the round in March 2021, by which time more than 100 apps, including Webflow and Hopin, were built on it. In November 2023 it moved into general authentication with AuthKit, an open-source login UI built on Radix with a hosted version free up to one million users, a market where it already pitched itself as an alternative to Auth0.

Why it’s built this way

One API in front of every identity provider
Each enterprise customer brings a different IdP, often over SAML. Normalising them behind one OAuth-style flow and one profile shape means an app integrates once instead of once per customer.
Let the customer’s IT admin configure the connection
Setting up SAML or SCIM usually means certificates and URLs exchanged over email or calls. The hosted Admin Portal gives IT admins step-by-step guides for their own provider, taking the app’s engineers out of the loop.
Charge per connection, give login away
Enterprise features are worth most when an enterprise deal closes. Pricing SSO per connection ties the cost to that revenue, while free AuthKit up to a million users draws in apps before they need it.

Timeline

  1. 2019

    Michael Grinich starts WorkOS

  2. 2020

    WorkOS launches; raises a $15M Series A led by Lachy Groom

  3. 2021

    Announces the Series A; over 100 apps, including Webflow and Hopin, use it

  4. 2023

    Launches AuthKit and User Management, free up to 1 million users

Sources10 · facts checked 6 October 2026

Improve this page on GitHub