WorkOS

WorkOS

Unclaimed verified 24 aug 2026
[  score · 47  ]

Your app, Enterprise Ready.

Pricing: Paid - $99/mo (custom domain); connections from ~$125/ea with discounts; 1M MAU free Company: WorkOS Founded: 2019 Last verified: 2026-08-24
Visit Website
Updated

TL;DR

WorkOS is an API-first enterprise identity platform for B2B SaaS companies that need SSO, Directory Sync/SCIM, authentication, organizations, RBAC, audit logs, and enterprise onboarding. Its key differentiator is reducing the engineering effort required to support many enterprise identity providers through unified APIs, SDKs, webhooks, and tools such as Admin Portal and AuthKit.

What Users Actually Pay

No user-reported pricing yet.

Our Take

WorkOS occupies a focused position between general-purpose authentication platforms and enterprise identity infrastructure. It is especially well suited to SaaS companies whose customers require SAML, OIDC, SCIM, domain verification, organization-aware authentication, or customer-managed identity settings.

Alternatives

Ranked by Revuo score — paid tiers never affect order.
Supabase Auth

Supabase Auth

Built-in user management
Auth0

Auth0

Secure AI agents, humans, and whatever comes next
Descope

Descope

Reduce user friction, prevent account takeover, and get a 360° view of your customer and agentic identities with the Descope External IAM platform.
Clerk

Clerk

More than authentication, Complete User Management
Okta

Okta

Secure Identity for Employees, Customers, and AI
OneLogin

OneLogin

Access without friction. Security without compromise.

Pros

  • + Fast implementation of enterprise SSO and directory integrations, with reviewers frequently praising the SDKs and documentation.
  • + Reduces the need to build and maintain separate integrations for providers such as Okta, Microsoft Entra ID, Google, and others.
  • + Strong developer-oriented support, including broad SDK coverage and reports of responsive assistance.
  • + Good fit for B2B and multi-tenant applications through organizations, Admin Portal, Directory Sync, RBAC, and audit-log capabilities.
  • + Transparent product structure with free User Management usage up to 1 million MAU and connection-based pricing for enterprise features.

Cons

  • - Connection-based SSO and Directory Sync pricing can be difficult to justify for low-priced SaaS plans or small customers.
  • - Some authorization and session-management requirements remain application-side rather than being fully provided out of the box.
  • - Some reviewers and Reddit participants have requested deeper documentation, more framework-specific examples, and clearer coverage of edge cases.
  • - Users have requested broader provider coverage, additional identity attributes, and more customization in certain Directory Sync workflows.
  • - WorkOS is primarily an identity infrastructure platform rather than a broad no-code automation marketplace, with no clearly established first-party Zapier, Make, or n8n ecosystem identified in the reviewed material.

Agent Readiness

73/100

WorkOS is highly suitable for autonomous AI-agent usage because it provides a structured REST API, OpenAPI support, broad SDK coverage, signed webhooks, staging environments, a local API emulator, CLI tooling, and MCP-related capabilities. Agents can use it to provision organizations, manage users and memberships, configure identity workflows, consume directory events, and generate integration code. Production identity-provider configuration, role changes, API-key operations, and user deletion should remain approval-gated because they are security-sensitive. The main ecosystem limitation is the lack of clearly documented first-party Zapier, Make, and n8n connectors.

API Surface100
Public APIRESTGraphQLFree TieropenApi
Protocol Support55
MCP (127 tools)
SDK Availability70
npm: @workos-inc/node (official)npm: @workos-inc/authkit-nextjs (official)npm: workos (official)npm: @workos/authkit-session (official)npm: @workos/emulate (official)npm: @workos/oagen-emitters (official)npm: @convex-dev/workos-authkit (official)npm: @workos/authkit-tanstack-react-start (official)npm: @workos-inc/authkit-react-router (official)npm: @workos/openapi-spec (official)pypi: workos (official)
Integration Ecosystem25
WebhooksOktaMicrosoft Entra IDGoogleOneLoginPing IdentityJumpCloudBambooHRWorkdaySalesforceSlackStripeBubbleMCP
Developer Experience100
Docs: goodSandboxVersioningChangelogStatus Page

Last checked Aug 23, 2026

MCP Integrations

3 servers127 tools
WorkOS
WorkOSworkos
smitheryVerifiedRemoteHigh match

Enterprise-ready authentication and user management. Manage organizations, users, SSO connections, directory sync, audit logs, fine-grained authorization, and feature flags.

127 tools
  • api_keys.validations.createValidate an API key value and return the API key object if valid.
  • audit_logs.actions.listGet a list of all Audit Log actions in the current environment.
  • audit_logs.actions.schemas.listGet a list of all schemas for the Audit Logs action identified by `:name`.
  • audit_logs.actions.schemas.createCreates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created.
  • audit_logs.events.createCreate an Audit Log Event. This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource. To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions. Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key.
  • audit_logs.exports.createCreate an Audit Log Export. Exports are scoped to a single organization within a specified date range.
  • audit_logs.exports.getGet an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.
  • auth.factors.getGets an Authentication Factor.
  • auth.factors.deletePermanently deletes an Authentication Factor. It cannot be undone.
  • authorization.organization_memberships.check.createCheck if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.
  • authorization.organization_memberships.resources.listReturns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?" You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.
  • authorization.organization_memberships.role_assignments.listList all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles.
  • authorization.organization_memberships.role_assignments.createAssign a role to an organization membership on a specific resource.
  • authorization.organization_memberships.role_assignments.by_organization_membership_id.deleteRemove a role assignment by role slug and resource.
  • authorization.organization_memberships.role_assignments.deleteRemove a role assignment using its ID.
  • authorization.organizations.roles.listGet a list of all roles that apply to an organization. This includes both environment roles and organization-specific roles, returned in priority order.
  • authorization.organizations.roles.createCreate a new custom organization role. When slug is omitted, it is auto-generated from the role name.
  • authorization.organizations.roles.getRetrieve a role that applies to an organization by its slug. This can return either an environment role or an organization-specific role.
  • authorization.organizations.roles.updateUpdate an existing custom organization role. Only the fields provided in the request body will be updated.
  • authorization.organizations.roles.deleteDelete an existing custom organization role.
  • authorization.organizations.roles.permissions.createAdd a single permission to an organization role. If the permission is already assigned to the role, this operation has no effect.
  • authorization.organizations.roles.permissions.updateReplace all permissions on a role with the provided list.
  • authorization.organizations.roles.permissions.deleteRemove a single permission from an organization role by its slug.
  • authorization.organizations.resources.getRetrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.
  • authorization.organizations.resources.updateUpdate an existing authorization resource using its external ID.
  • authorization.organizations.resources.deleteDelete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.
  • authorization.organizations.resources.organization_memberships.listReturns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.
  • authorization.permissions.listGet a list of all permissions in your WorkOS environment.
  • authorization.permissions.createCreate a new permission in your WorkOS environment. The permission can then be assigned to environment roles and organization roles.
  • authorization.permissions.getRetrieve a permission by its unique slug.
  • authorization.permissions.updateUpdate an existing permission. Only the fields provided in the request body will be updated.
  • authorization.permissions.deleteDelete an existing permission. System permissions cannot be deleted.
  • authorization.resources.listGet a paginated list of authorization resources.
  • authorization.resources.createCreate a new authorization resource.
  • authorization.resources.getRetrieve the details of an authorization resource by its ID.
  • authorization.resources.updateUpdate an existing authorization resource.
  • authorization.resources.deleteDelete an authorization resource and all its descendants.
  • authorization.resources.organization_memberships.listReturns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".
  • authorization.roles.listList all environment roles in priority order.
  • authorization.roles.createCreate a new environment role.
  • authorization.roles.getGet an environment role by its slug.
  • authorization.roles.updateUpdate an existing environment role.
  • authorization.roles.permissions.createAdd a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.
  • authorization.roles.permissions.updateReplace all permissions on an environment role with the provided list.
  • connect.applications.listList all Connect Applications in the current environment with optional filtering.
  • connect.applications.createCreate a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.
  • connect.applications.getRetrieve details for a specific Connect Application by ID or client ID.
  • connect.applications.updateUpdate an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.
  • connect.applications.deleteDelete an existing Connect Application.
  • connections.listGet a list of all of your existing connections matching the criteria specified.
  • connections.getGet the details of an existing connection.
  • connections.deletePermanently deletes an existing connection. It cannot be undone.
  • directories.listGet a list of all of your existing directories matching the criteria specified.
  • directories.getGet the details of an existing directory.
  • directories.deletePermanently deletes an existing directory. It cannot be undone.
  • directory_groups.listGet a list of all of existing directory groups matching the criteria specified.
  • directory_groups.getGet the details of an existing Directory Group.
  • directory_users.listGet a list of all of existing Directory Users matching the criteria specified.
  • directory_users.getGet the details of an existing Directory User.
  • events.listList events for the current environment.
  • feature_flags.listGet a list of all of your existing feature flags matching the criteria specified.
  • feature_flags.getGet the details of an existing feature flag by its slug.
  • feature_flags.disable.updateDisables a feature flag in the current environment.
  • feature_flags.enable.updateEnables a feature flag in the current environment.
  • feature_flags.targets.createEnables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations.
  • feature_flags.targets.deleteRemoves a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations.
  • organization_domains.createCreates a new Organization Domain.
  • organization_domains.getGet the details of an existing organization domain.
  • organization_domains.deletePermanently deletes an organization domain. It cannot be undone.
  • organization_domains.verifyInitiates verification process for an Organization Domain.
  • organizations.listGet a list of all of your existing organizations matching the criteria specified.
  • organizations.createCreates a new organization in the current environment.
  • organizations.external_id.getGet the details of an existing organization by an [external identifier](/authkit/metadata/external-identifiers).
  • organizations.getGet the details of an existing organization.
  • organizations.updateUpdates an organization in the current environment.
  • organizations.deletePermanently deletes an organization in the current environment. It cannot be undone.
  • organizations.audit_log_configuration.getGet the unified view of audit log trail and stream configuration for an organization.
  • organizations.audit_logs_retention.getGet the configured event retention period for the given Organization.
  • organizations.audit_logs_retention.updateSet the event retention period for the given Organization.
  • organizations.api_keys.listGet a list of all API keys for an organization.
  • organizations.api_keys.createCreate a new API key for an organization.
  • organizations.feature_flags.listGet a list of all enabled feature flags for an organization.
  • portal.generate_link.createGenerate a Portal Link scoped to an Organization.
  • radar.attempts.createAssess a request for risk using the Radar engine and receive a verdict.
  • radar.attempts.updateYou may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.
  • radar.lists.createAdd an entry to a Radar list.
  • radar.lists.deleteRemove an entry from a Radar list.
  • sso.profile.listExchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
  • user_management.email_verification.getGet the details of an existing email verification code that can be used to send an email to a user for verification.
  • user_management.invitations.listGet a list of all of invitations matching the criteria specified.
  • user_management.invitations.createSends an invitation email to the recipient.
  • user_management.invitations.by_token.getRetrieve an existing invitation using the token.
  • user_management.invitations.getGet the details of an existing invitation.
  • user_management.invitations.accept.createAccepts an invitation and, if linked to an organization, activates the user's membership in that organization.
  • user_management.invitations.resend.createResends an invitation email to the recipient. The invitation must be in a pending state.
  • user_management.invitations.revokeRevokes an existing invitation.
  • user_management.organization_memberships.listGet a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses.
  • user_management.organization_memberships.createCreates a new `active` organization membership for the given organization and user. Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s).
  • user_management.organization_memberships.getGet the details of an existing organization membership.
  • user_management.organization_memberships.updateUpdate the details of an existing organization membership.
  • user_management.organization_memberships.deletePermanently deletes an existing organization membership. It cannot be undone.
  • user_management.organization_memberships.deactivate.updateDeactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation. - Deactivating an `inactive` membership is a no-op and does not emit an event. - Deactivating a `pending` membership returns an error. This membership should be [deleted](/reference/authkit/organization-membership/delete) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.
  • user_management.organization_memberships.reactivate.updateReactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon successful reactivation. - Reactivating an `active` membership is a no-op and does not emit an event. - Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](/authkit/invitations) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.
  • user_management.users.listGet a list of all of your existing users matching the criteria specified.
  • user_management.users.createCreate a new user in the current environment.
  • user_management.users.external_id.getGet the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).
  • user_management.users.getGet the details of an existing user.
  • user_management.users.updateUpdates properties of a user. The omitted properties will be left unchanged.
  • user_management.users.deletePermanently deletes a user in the current environment. It cannot be undone.
  • user_management.users.email_change.confirm.createConfirms an email change using the one-time code received by the user.
  • user_management.users.email_change.sendSends an email that contains a one-time code used to change a user's email address.
  • user_management.users.email_verification.confirm.createVerifies an email address using the one-time code received by the user.
  • user_management.users.email_verification.sendSends an email that contains a one-time code used to verify a user’s email address.
  • user_management.users.identities.listGet a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
  • user_management.users.sessions.listGet a list of all active sessions for a specific user.
  • user_management.users.feature_flags.listGet a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a member of.
  • user_management.users.authorized_applications.listGet a list of all Connect applications that the user has authorized.
  • user_management.users.authorized_applications.deleteDelete an existing Authorized Connect Application.
  • user_management.users.connected_accounts.getRetrieves a user's [connected account](/reference/pipes/connected-account) for a specific provider.
  • user_management.users.connected_accounts.deleteDisconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
  • user_management.users.data_providers.listRetrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](/reference/pipes/connected-account) information where applicable.
  • user_management.users.auth_factors.listLists the [authentication factors](/reference/authkit/mfa/authentication-factor) for a user.
  • user_management.users.auth_factors.createEnrolls a user in a new [authentication factor](/reference/authkit/mfa/authentication-factor).
  • webhook_endpoints.listGet a list of all of your existing webhook endpoints.
  • webhook_endpoints.createCreate a new webhook endpoint to receive event notifications.
  • webhook_endpoints.updateUpdate the properties of an existing webhook endpoint.
  • webhook_endpoints.deleteDelete an existing webhook endpoint.
com.workos/mcpcom.workos/mcp
officialRemoteHigh match

Manage your WorkOS workspace in plain language: orgs, users, SSO, Directory Sync, and AuthKit.

com.thenetworkos/networkoscom.thenetworkos/networkos
officialRemote

Your professional network in Claude — search contacts, log notes, and send warm intros.

Last checked Jul 24, 2026

[ features ]

Geostrategic Position

Information on which part of the world this product / vendor belongs to, i.e. the country of their headquarters primarily, but also their hosting options etc.

Headquarter Region

Find which geostrategic world region the headquarter is located in. Relevant for compliance questions (e.g., CLOUD Act) or risk of cut-off in case of conflicts. For example, some EU companies are worried about the US and would definitely not host their customer with Chinese or Russian companies.

United States
Hosting Provider

The hosting provider that is used to host this product, if any.

[  Amazon AWS  ]
Hosting Locations

The available hosting locations, if you can choose

[  United States  ]

Compliance & Security

Security certifications, compliance features, and access control capabilities.

SOC 2

SOC 2 Type I or Type II certification.

Type II
ISO 27001

ISO 27001 information security certification.

no
GDPR Tools

Built-in tools for GDPR compliance (data export, deletion, consent).

no
Audit Trail

Complete audit log of all data changes.

[  yes  ]
Role-Based Access Control

Granular permissions based on user roles.

[  yes  ]
SSO Support

Single Sign-On integration support.

Both

Developer Experience

Tools and abstractions easing agent development and iteration.

Visual Builder

No-code/low-code UI for designing agent workflows.

no
OpenAI Compatibility

OpenAI API-compatible endpoints or SDKs.

no
Open Source

Available as open-source with community contributions.

no
SDK Languages

Programming languages with official SDK support.

[  Python  ] [  JavaScript/TypeScript  ] [  Other  ]
Pre-built UI Components

Ready-to-use, customizable UI elements for auth flows.

[  yes  ]
Admin Portal

Self-service admin dashboard for customers to manage users/orgs.

[  yes  ]
Framework Integrations

Supported frontend frameworks with dedicated guides/components.

[  React  ] [  Next.js  ]

Authentication Methods

Core authentication flows and options supported by the platform.

Passwordless Auth

Supports passwordless authentication via magic links, passkeys, or biometrics.

[  yes  ]
Social Providers

Supported third-party social login providers.

[  Google  ] [  GitHub  ] [  Apple  ] [  GitLab  ] [  LinkedIn  ]
MFA Methods

Supported multi-factor authentication methods.

[  SMS  ] [  TOTP  ]
Bot Detection

Built-in protection against bots and automated attacks during auth.

[  yes  ]

Enterprise Integrations

Protocols and tools for integrating with enterprise identity systems.

SCIM Provisioning

Supports SCIM for automated user provisioning and deprovisioning.

[  yes  ]
Directory Sync

Supports syncing users/groups from directories like HRIS or IdPs.

[  yes  ]
Supported IdPs

Compatible identity providers for federation.

[  Okta  ] [  Entra ID/Azure AD  ] [  Google Workspace  ] [  OneLogin  ] [  Ping Identity  ] [  Rippling  ]
JIT Provisioning

Just-In-Time user provisioning from SAML/OIDC assertions.

[  yes  ]

Pricing & Free Tier

Free tier limits and overall pricing structure.

Free Tier MAU Limit

Maximum Monthly Active Users allowed on the free tier.

1000000
Billed Metrics

Key usage metrics that incur costs.

[  Connections  ]

Compare With

Supabase Auth

Compare with Supabase Auth

49 →
Auth0

Compare with Auth0

49 →
Descope

Compare with Descope

48 →
Clerk

Compare with Clerk

47 →
Okta

Compare with Okta

47 →

Reviews

0 reviews
Write a Review

No reviews yet. Be the first to review WorkOS!