WorkOS Pricing in 2026: Is It Really Free, and What You Actually Pay

WorkOS bills for enterprise features, not for users. That one fact explains why a solo dev on Reddit can ask "am I missing something?" when they see one million free monthly active users, while a B2B founder two threads over is staring at a four-figure invoice. Same platform, different bill. The difference is connections.

WorkOS is an enterprise-readiness platform: it sells authentication, Single Sign-On, and Directory Sync so B2B apps can close deals with companies that demand SAML and SCIM. Here is what it actually costs in 2026, with the arithmetic worked out.

Is WorkOS really free for 1 million users?

Yes. AuthKit, the WorkOS authentication product (login, sessions, MFA, social providers), is free up to 1 million monthly active users, then $2,500 per additional 1 million users (WorkOS pricing, 2026). That is not a trial or a teaser. A consumer app with 900,000 users pays $0 for auth.

The reason is the business model, not generosity. WorkOS treats free auth as customer acquisition, then earns its revenue on the enterprise features those customers eventually need. As one r/webdev commenter put it, "WorkOS makes its money on SSO etc for the enterprise and b2b, which is why their free MAU tier is up to 1 million." So if you never sell to an enterprise, you may genuinely never pay WorkOS a cent.

The 2026 WorkOS price ladder

Every meter, straight from the pricing page (WorkOS, 2026):

The SSO and Directory Sync per-connection rate falls as you add connections, which WorkOS calls automatic volume discounts (WorkOS vs Auth0, 2026). Each connection is billed at the rate for the bracket your total connection count lands in:

Your WorkOS bill is set by connections, not users

This is the part every per-user mental model gets wrong. On Auth0 or Clerk, more users means a bigger bill. On WorkOS, users are free and each enterprise customer who needs SSO or SCIM is one paid connection.

So the question that actually predicts your invoice is not "how many users do I have?" It is "how many enterprise customers do I have, and do they need SSO, SCIM, or both?" Two apps with identical traffic can differ by thousands of dollars a month based purely on their B2B customer count.

Three real WorkOS bills for 2026

The pre-enterprise app. A product-led B2C app with 300,000 MAU and zero enterprise SSO customers. AuthKit is free under 1M, and there are no connections to bill. Total: $0 per month. This is the honest answer to the Reddit thread: it really is free until you sell to your first enterprise.

The early B2B deal wave. A B2B SaaS with 8 enterprise customers who each require SAML SSO, plus 300,000 MAU. AuthKit is still free. The 8 SSO connections all sit in the 1 to 15 bracket, so 8 times $125 is $1,000 per month. If 5 of those customers also demand SCIM provisioning, add 5 times $125, or $625, for $1,625 per month all in. Compare that to the Reddit founder who "lost 3 enterprise deals because we didn't have SSO" and priced Auth0 at $800 per month for the same job.

The scaling B2B platform. 40 enterprise customers, all on SSO plus Directory Sync, 800,000 MAU. AuthKit is still free. 40 connections lands in the 31 to 50 bracket at $80 each, so SSO is 40 times $80, or $3,200, and Directory Sync is another $3,200. Add one Audit Log stream at $125. Total: about $6,525 per month on Standard support, or roughly $7,525 if you take the $1,000 Scale SLA.

Effective cost per enterprise customer

Because the per-connection rate drops with volume, your cost per enterprise customer falls as you grow. That is the opposite of a per-user model, where the marginal cost climbs.

If those customers pay you thousands per year, a $50 to $125 monthly connection fee is a rounding error against the contract. That is the real reason WorkOS closes: the cost scales with revenue, not with load.

WorkOS vs Auth0 vs Clerk: the honest comparison

WorkOS is not always the cheapest. It wins on specific axes and loses on others.

Against Auth0: Auth0's B2B Professional plan starts at $800 per month and stacks two meters, MAU tiers and connections. It includes 5 enterprise connections, then charges $100 each up to a self-serve cap of 30, and its base price climbs with MAU ($800 at 1K MAU, $1,500 at 5K, $2,400 at 10K) (Auth0 pricing, 2026). WorkOS decouples the two: users are free, connections are metered. For a B2B app with modest MAU and a handful of enterprise customers, WorkOS is dramatically cheaper. Our full Auth0 pricing teardown walks the MAU ladder in detail.

Against Clerk: Clerk has a real free tier (50,000 monthly active users), then Pro at $25 per month plus $0.02 per user over the cap, with enterprise SSO connections at $75 each in the 2 to 15 range (Clerk pricing, 2026). On a pure per-connection basis Clerk is cheaper ($75 vs $125), and for a small app with a couple of enterprise logins it may win outright. But Clerk bills per user, so a high-MAU app pays Clerk for traffic that WorkOS gives away. See the Clerk pricing breakdown for the per-user math.

The short version: Clerk for small or mid apps with few enterprise connections, WorkOS for high-MAU apps and predictable connection-based B2B billing, and Auth0 when you need its deeper consumer-identity feature set and can absorb the double meter. WorkOS also competes with self-managed stacks built on Okta and Microsoft Entra, which trade per-connection fees for integration work.

When WorkOS is worth it, and when it isn't

Worth it when you are B2B and enterprises demand SAML or SCIM, and you would rather pay $125 per connection than build and maintain SAML across Okta, Entra, Google, and OneLogin quirks. Your first few connections are a clear yes: a solid SAML plus SCIM implementation is weeks of engineering plus permanent maintenance, and $125 buys it back instantly. It is also worth it when you have consumer-scale MAU and want free auth.

Not worth it when you are a tiny, cost-sensitive app with one or two enterprise logins, where Clerk's $75 connection or a self-hosted option can undercut it. And once you pass roughly 150 to 200 connections, a $50 rate on 200 connections is $10,000 per month for SSO alone, which starts to rival the cost of a dedicated identity engineer. At that point you negotiate the custom tier or reconsider owning the stack.

Four ways to keep the WorkOS bill down

1. Do not buy Directory Sync until a customer actually asks for SCIM. Plenty of enterprises are fine with SSO plus just-in-time provisioning, and skipping SCIM saves $125 per connection.
2. Stay on Standard support ($0) until you genuinely need the $1,000 per month Scale SLA. Most teams do not need it on day one.
3. Keep it to one connection per enterprise customer. Do not spin up separate connections for every IdP variation if one covers the account.
4. Once you cross about 30 to 50 connections, ask for volume pricing early. The published discounts are automatic, but the custom tier is negotiable well before 201 connections.

Math check: WorkOS is free until your first enterprise SSO connection, then $125 per connection per month falling to $50 at scale. Your bill tracks enterprise customers, not users, so a 900K-user consumer app pays $0 while an 8-customer B2B app pays $1,000. Price the connections, not the crowd.