WorkOS review

WorkOS is a hosted API platform and SaaS dashboard for adding identity and enterprise features to an application. It sits between your app and services such as SAML or OIDC identity providers, corporate directories, and SIEM systems. Your application calls WorkOS APIs, handles the returned identity or session data, and can receive directory updates through webhook events.

The product set includes AuthKit for authentication and user management, Enterprise SSO, Directory Sync, Multi-Factor Authentication, role-based access control, fine-grained authorization, Audit Logs and Radar. The hosted Admin Portal gives corporate IT admins a self-serve interface for configuring their organization. WorkOS also lists Vault, MCP Auth, Passport, Airlock and Pipes among its products.

This is infrastructure you integrate into your app, not a replacement application or a self-hosted identity server. You keep your application’s user-facing logic and build around the APIs and hosted components WorkOS provides.

The homepage describes WorkOS APIs as RESTful, with JSON responses and normalized objects. The integration surface includes a dashboard, API keys, webhook events for directory updates, and multiple environments for application development. The homepage names modern SDKs for Node.js, Ruby, Python, .NET and Go; its examples also show PHP, Java and cURL. Confirm support for your framework and the specific product APIs in WorkOS’s documentation.

The SSO example exchanges an authorization code for a profile and access token. The same flow is shown through SDKs and a direct cURL request, so teams can use the REST API when an SDK is not a fit. WorkOS says its SSO integration supports SAML and OIDC identity providers through one integration and supports more than 20 enterprise services.

Documentation feedback is mixed. A Reddit commenter praised WorkOS’s directory and portal features but described its docs as poorly organized, with undocumented functionality and outdated tutorials. Another user asked for clearer examples around organization switching; a WorkOS employee pointed them to the API flow and documentation.

AuthKit is listed at $0 per month for up to 1 million monthly active users. The Pay as you go plan also lists the first 1 million active users free, plus automatic volume discounts. The pricing page does not give a public price for usage above that allowance, so confirm the expected bill with WorkOS before forecasting at scale.

Enterprise SSO and Directory Sync are billed per connection per month. The listed rate is $125 each for 1–15 connections, $100 each for 16–30, $80 each for 31–50, and $65 each for 51–100. Audit Logs lists streaming at $125 per month per SIEM connection and retention at $99 per month per million events stored. Radar includes 1,000 checks free, with an add-on of $100 per 50,000 checks. A custom domain is $99 per month. Annual Credits offers prepay discounts, a 99.99% uptime SLA and support commitments, but its rates are custom. Model connection counts and event volume separately from AuthKit users.

WorkOS is presented as a hosted API and dashboard, not as software you install and operate in your own environment. WorkOS does not publish an open-source licence or a self-hosting option in its product overview. Teams that require source availability or control of the identity service should ask WorkOS directly before making it a core dependency.

The homepage says Audit Logs supports event logging, exporting and streaming. That describes audit events, not necessarily a full export of users, organizations, connections, policies or application state. Ask what data can be exported and in what format. Migration effort will depend on how tightly your application relies on WorkOS sessions, organization identifiers, authorization rules and provider connections. Keep an internal model for users and organizations, and avoid making WorkOS-specific identifiers the only representation of those records.

The pricing page lists a 99.99% uptime SLA for Annual Credits, alongside a guaranteed support SLA. The Pay as you go plan lists a dedicated Slack channel, but the published pricing terms do not assign it the same uptime commitment. Ask for the applicable service terms, rate limits, incident process and data-handling details before routing critical authentication through the service.

Connection-based billing makes organization growth a cost driver even when user counts remain manageable. Audit event storage and SIEM streaming add separate charges; Radar usage has its own check allowance and add-on. Put alerts around connections, event volume and usage so a new enterprise customer does not create an unexpected bill.

Reddit reports are mixed rather than a reliability record. One thread calls WorkOS’s hosted-auth free tier generous, while commenters in another report unclear docs and outdated tutorials. A user asked about organization switching with AuthKit; a WorkOS employee explained the refresh-token and authorization-URL flow. Validate those flows in your own application and keep a fallback support path.