WorkOS
The value is the network, the data or the infrastructure. Keep paying.
Enterprise features as an API: single sign-on, directory sync, audit logs and the rest of what a large customer asks for before they will sign.
Implement SAML yourself only if you have one customer to satisfy. THE HONEST ARITHMETIC - One enterprise customer: implement it, it is a week - Ten identity providers: buy it, because each one differs and the differences are undocumented STACK - A reviewed SAML library for your language. Never parse the assertions yourself WHAT TO GET RIGHT - Validate the signature before reading anything, and reject unsigned assertions outright - Check the audience, the recipient, the conditions window and the InResponseTo value - Reject a replayed assertion by storing seen assertion ids until they expire - These four checks are the difference between single sign-on and an open door DIRECTORY SYNC - SCIM is a second job. Start with just-in-time provisioning from the assertion instead Include the library choice, the four validations and the replay store.
What you lose
- SAML implementations that work against dozens of identity providers, each with its own interpretation of the specification
- Directory sync through SCIM, which is a second protocol with its own edge cases
- Support during a customer's security review, which is when this matters most
If you would rather not build
- A reviewed SAML library plus just-in-time provisioning
- WorkOS itself, if you have several enterprise customers
The escape hatch
open source · no votes, no paid placement
Keycloak
$0Acts as a broker so your app speaks one protocol while it handles the rest.
keycloak/keycloakfree · open source
SuperTokens
$0Self-hosted authentication with an enterprise single sign-on add-on.
supertokens/supertokens-corefree · open source
Why this verdict
our own opinion · changed only by a person
22/100
Verdict no at 22. One customer is a week of work; a dozen identity providers is a product. The four validation checks are non-negotiable either way.
History
tracked since 10 Aug 2026 · nothing is ever overwritten
Nothing recorded yet. This chart fills in once the page has visitors, votes or prompt copies — it will not draw a flat line to look busy.
Questions about WorkOS
answered from the record above
Is WorkOS free?
No — the plan we track is $125 a month. Priced per enterprise connection, from around $125/month per organisation connected.
Can you replace WorkOS by building your own?
KEEP IT. The value is the network, the data or the infrastructure. Keep paying. Replacement score 22 out of 100, build time longer than it saves. Read what you lose before you decide.
How much does WorkOS cost?
$125 a month on Per connection — $1,500 a year. Recorded 10 Aug 2026.
What do you lose by replacing WorkOS?
SAML implementations that work against dozens of identity providers, each with its own interpretation of the specification; Directory sync through SCIM, which is a second protocol with its own edge cases; Support during a customer's security review, which is when this matters most. If any of those carry weight for you, keep paying.
Is there an open-source alternative to WorkOS?
Yes: Keycloak, SuperTokens. The prompt on this page is for when you want it your way instead.
Related entries
same category first, most replaced first
Headway
iLovePDF
HoppscotchEvery week, something stops being worth paying for.
New verdicts, prices that moved, entries added. One email a week. Unsubscribe in one click.
free forever · no tracking pixel · every prompt stays free on the site