WorkOS

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this if you sell to enterprises. Every identity provider quirk absorbed is the product.

SAML is a specification that every vendor implements slightly differently. Then directory synchronisation, which is another protocol with its own inconsistencies, and each customer's identity team expecting their own arrangement to work on the first attempt. That accumulated compatibility is what you are buying, and it is what unlocks larger deals.

WHEN TO KEEP PAYING
- Customers asking for SAML or user provisioning, which is the moment this becomes a revenue question rather than a cost one
- The first enterprise deal, where the integration standing between you and the contract is worth more than the fee

WHEN TO BUILD
- No enterprise customers yet. Then ordinary authentication covers it, and the shape is under Stytch elsewhere in this catalogue
- **OIDC only**, if your customers all use providers that speak it. That is a reviewed library and an afternoon, and it covers a surprising share of modern identity providers

IF YOU IMPLEMENT SAML YOURSELF
- Use a reviewed library. Never parse or validate assertions by hand
- **Validate the signature properly**, on the assertion and not merely the response, and pin the expected certificate per connection. Signature confusion in SAML has produced real authentication bypasses in well-known products
- Check the audience, the recipient, the conditions and the timestamps, and reject replays by tracking assertion identifiers
- One configuration per customer, tested against their actual provider before go-live, because none of them behave identically
- Directory synchronisation as an incremental job with a cursor, idempotent, where a deprovisioned user is deactivated immediately — that path is the one an auditor asks about

WHAT TO BUILD REGARDLESS
An append-only audit log of authentications, provisioning changes and permission changes, exportable. Enterprise customers ask for it, it takes an afternoon, and it cannot be reconstructed later.

THE ONE-LINE VERSION
Start with OIDC. Buy SAML when a customer asks, because by then it is a deal rather than a cost — and never hand-roll assertion validation.