WorkOS
- Company typePrivate
- Founded2019
- HeadquartersSan Francisco, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
WorkOS firmographics
Firmographics- Name
- WorkOS
- Legal name
- WorkOS, Inc.
- Website
- https://workos.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Ownership category
- akta.pro rank
WorkOS industry classification
Industry- Product category
- Identity and Access Management (IAM)
- NAICS
- Custom Computer Programming Services (541511)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- IT Workflow Automation & Orchestration Platforms (HDAEALAF)
- akta.pro secondary industries
- Collaboration & Productivity Platforms (M365/Google Workspace, Email, Chat/Meetings) (BPAEAIAD), Workflow-Oriented Integration & Orchestration (HDAEAIAG), HRIS/HCM Implementation Services (BPAEAGAE)
Keywords
Where WorkOS is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Markets served
WorkOS business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Enterprise SSO Connections: Connections-based subscription pricing for SSO: $125/connection for 1–15; $100/connection for 16–30; $80 for 31–50; $65 for 51–100; $50 for 101–200+. First connection free. Discounts applied at higher tiers. Custom enterprise plans available.
- User Management: Subscription pricing based on user count: first 1 million users free; $2,500/month per additional 1M users. Scales with customer growth.
- Radar (Bot Detection): Usage-based pricing: first 1,000 checks free; $100/month per 50,000 checks. Volume-based billing tied to API consumption.
- Audit Logs: Two revenue components: $125/month per SIEM connection (log streaming) and $99/month per million events stored (event retention). Volume-based for stored events.
- Admin Portal: Free for un-branded access; custom branding available via sales-led quote.
- Freemium Across Product Suite: Free tiers exist across SSO, Directory Sync, User Management, Admin Portal, and Radar to drive developer adoption and PLG onboarding, with paid tiers triggered at scale.
- Annual Contracts & Enterprise Plans: Annual discounts, expert guidance, migration support, and custom enterprise plans negotiated via sales for larger deployments and custom scale.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Unit Pricing | Monthly | Enterprise SSO: per-connection pricing with first connection free; tiered discounts from 1–200+ connections. |
| Usage-based | Monthly | User Management: free up to 1M users; $2,500/mo per additional 1M users. |
| Usage-based | Monthly | Radar: first 1,000 checks free; $100/mo per 50k checks. |
| Usage-based | Monthly | Audit Logs: $125/SIEM connection/mo + $99/M events stored/mo. |
| Freemium | Pay-as-you-go | Admin Portal: free for un-branded; custom branding via sales quote. |
Go-to-market motion4 records
Distribution channels5 records
Marketing channels10 records
WorkOS product offering
Product offeringCore offering
WorkOS provides a unified developer platform with modern RESTful APIs, JSON responses, and SDKs (Node.js, Ruby, Python, Go, PHP, Java, .NET) for quickly adding enterprise-ready features to applications via a single integration point. The platform offers a suite of building blocks including Single Sign-On (SAML/OIDC), Directory Sync (SCIM), Role-Based Access Control, Audit Logs, Multi-Factor Authentication, Admin Portal, User Management, Radar (bot/fraud detection), Vault (encryption key management), MCP Auth (OAuth 2.1 for AI agents), and Pipes (third-party integrations), abstracting dozens of enterprise integrations behind one API.
Product overview
WorkOS is a unified developer platform for quickly adding enterprise-ready features to applications, offered as a single product suite with multiple integrated modules. The core platform centers on User Management (powered by AuthKit, WorkOS's customizable hosted authentication UI), and is surrounded by a portfolio of composable products: Enterprise SSO for SAML/OIDC identity provider integration, Directory Sync (SCIM) for automated user provisioning, Admin Portal for self-serve IT admin onboarding, Audit Logs for compliance-grade event tracking, Multi-Factor Authentication, Role-Based Access Control (RBAC), Radar for real-time bot and fraud protection, Vault for encryption key management, MCP Auth for OAuth 2.1 authorization of AI agents on MCP servers, and Pipes for third-party integrations. Together these modules share a single RESTful API, dashboard, and SDKs across Node.js, Ruby, Python, Go, PHP, Java, and .NET, allowing developers to mix and match the building blocks needed to sell into enterprise customers.
Differentiator
Problem solved
Functional benefit
Brands
- AuthKit: Customizable hosted UI for all authentication types, operating under its own domain at authkit.com as the user-facing authentication surface for WorkOS.
- Pipes
Products and services
- User Management A complete authentication, authorization, user management, and provisioning platform for organizations, from first user to enterprise scale. Supports email + password, Single Sign-On, Microsoft and Google OAuth, and Magic Auth. Free up to 1 million users.
- Enterprise SSO Unified SSO integration for any identity provider, supporting SAML and OpenID Connect protocols via a single RESTful API. Supports 20+ identity providers including Okta, Microsoft Entra ID, Google, OneLogin, ADFS, JumpCloud, PingFederate, Auth0, CyberArk, Shibboleth, VMware, and Duo.
- Directory Sync Automatic user and group provisioning via SCIM and HRIS integrations. Supports 12+ directory services including Okta, Entra ID, Google, BambooHR, Hibob, Workday, OneLogin, JumpCloud, Rippling, Fourth, and Breathe. Delivers real-time updates via webhook events.
- Admin Portal Self-serve hosted onboarding interface for enterprise customers' IT admins to set up SSO and Directory Sync without back-and-forth with the customer's support team. Supports custom branding on custom domains (CNAME) and ephemeral portal links.
- Audit Logs Enterprise-grade event logging, auditing, and exporting solution with strongly-typed, customizable events and JSON schema validation. Supports log streaming to SIEM providers including Splunk and Datadog.
- AuthKit A customizable hosted UI for all authentication types, powered by WorkOS and Radix. Enables developers to bring their own frontend for complete control or use AuthKit's hosted UI for a polished, branded authentication experience.
- Multi-Factor Authentication Advanced authentication methods using Time-based One-Time Password (TOTP) authenticator apps and SMS passcodes. Supports re-verification for restricted resources, customizable SMS templates, and flexible authentication flows.
- Role-Based Access Control (RBAC) Enterprise-grade authorization for secure and scalable access management with granular roles and permissions, IdP role sync via SSO/SCIM, custom roles scoped per organization, and permissions embedded in JWT objects.
- Radar Real-time bot, fraud, and abuse protection powered by device fingerprinting analyzing over 20 signals. Detects credential stuffing, brute force attacks, impossible travel, stale account compromise, free trial abuse, and supports SMS challenges and geo-blocking.
- Vault Developer-friendly Encryption Key Management (EKM) for encrypting and optionally storing sensitive data including tokens, passwords, certificates, files, and customer content. Supports Bring-Your-Own-Key (BYOK) with AWS KMS, GCP KMS, Azure Key Vault, and HashiCorp Vault, plus context-based key generation for cryptographic isolation.
- MCP Auth OAuth 2.1 authorization for Model Context Protocol (MCP) servers, with PKCE, scopes, and tool permissions enabling fine-grained authorization for agentic applications and AI workflows. WorkOS Connect can also run as standalone middleware to provide MCP OAuth flows without user migration.
- Pipes Third-party integrations platform for apps and AI agents, with pre-built OAuth flows for 100+ providers, UI widgets, an MCP-native interface, session-scoped credentials stored in Vault with AES-256 encryption, automatic token refresh, and one-call revocation.
Quantifiable outcome
- Reduces Single Sign-On and SCIM implementation time by more than 9 months vs. building in-house.
- +5 more outcomes
Companies that use WorkOS
Customer profileNamed customers31 records
Segments5 records
Ideal customer profiles5 records
WorkOS technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration36 records
AI capability6 records
Feature12 records
WorkOS partnerships and signals
Strategic signalPartnerships
Twelve partnerships are on record, tiered flagship and core.
- StripeflagshipCo-partnered with Cloudflare on agent-friendly account creation and open OAuth standard with WorkOS for agent identity. Stripe announced 288 product launches at Stripe Sessions 2026, including agent-related infrastructure.
- Apollo GraphQLcoreApollo GraphQL joined the Agentic AI Foundation as a Silver member, partnering with companies including Postman, WorkOS, and Canva. Apollo has hosted 20+ developer events and its MCP Server is in production at Block, Wiz, and Yahoo.
- Agentic AI Foundation (AAIF) under Linux FoundationflagshipLaunched by Block, Anthropic, and OpenAI as a vendor-neutral home for open source agentic AI projects. WorkOS is a member/contributor stewarding the Model Context Protocol (MCP) standard alongside dozens of technology companies as platinum, gold, and silver members.
- CloudflareflagshipCloudflare partnered with WorkOS, Auth0, and Stytch to streamline authentication for secure MCP server deployment on Cloudflare's remote Model Context Protocol server. WorkOS has co-developed an open OAuth standard with Cloudflare and Stripe for agent-friendly account creation (May 2026), and Cloudflare has published integration guides for WorkOS MCP Auth.
- Auth0 (Okta)coreCloudflare partnered with Auth0, Stytch, and WorkOS to streamline authentication for AI agent deployment on Cloudflare's MCP server. WorkOS also provides migration guides from Auth0 to WorkOS.
- Stytch (Twilio)coreCloudflare partnered with Stytch, Auth0, and WorkOS for authentication on its remote MCP server. Stytch was acquired by Twilio in November 2025.
- Modulz (acquired by WorkOS)coreWorkOS's first acquisition, completed simultaneously with its $80M Series B. Modulz created Radix UI and StitchesJS, which power WorkOS's AuthKit UI components.
- OktacoreIntegrated as a SAML/OIDC identity provider within WorkOS Enterprise SSO and as an HRIS/directory within Directory Sync (SCIM).
- Microsoft (Entra ID / Azure AD)coreIntegrated across WorkOS Enterprise SSO (Azure OIDC/SAML), Directory Sync (SCIM), and Microsoft OAuth.
- Google Cloud / Google WorkspacecoreIntegrated across WorkOS Enterprise SSO, Directory Sync, and Google OAuth for consumer sign-in.
- GitHubcorePre-built OAuth integration within WorkOS Pipes for source code, repositories, and developer workflows.
- AWS Key Management Service (KMS)coreBYOK integration within WorkOS Vault for enterprise encryption key management.
Scale indicators9 records
Recent moves6 records
Expansion highlights6 records
WorkOS competitors and assessment
Company assessmentDirect peers
- Frontegg: Frontegg is a B2B authentication and user management platform offering self-serve admin portal, SSO, MFA, RBAC, and audit logs for SaaS companies going upmarket. Its feature set maps almost 1:1 to WorkOS's core stack and it is repeatedly listed alongside WorkOS in customizable B2B authentication rankings.
- Descope: Descope is a developer-first CIAM and auth platform offering drag-and-drop flows, SSO, MFA, and passwordless for SaaS applications. It targets the same enterprise-readiness use case as WorkOS and is consistently named in WorkOS competitive set and B2B authentication provider comparisons.
- FusionAuth: FusionAuth is a developer-first authentication, authorization, and user management platform offering SSO, MFA, SCIM, and self-hosted or cloud deployment. It serves the same SaaS/AI customer base and is a frequently cited WorkOS alternative, particularly for self-hosted/regulated deployments.
- Stytch: Stytch is a developer-first authentication and authorization API platform offering passwordless, MFA, SSO, and B2B auth, acquired by Twilio in 2025. It targets the same SaaS/AI customer base as WorkOS with comparable PLG mechanics and is named alongside WorkOS in Cloudflare's MCP authentication partner ecosystem.
- Auth0 (Okta): Auth0 is the incumbent developer-first identity platform acquired by Okta, offering enterprise SSO, universal login, MFA, and user management. WorkOS explicitly positions itself as a modern Auth0 alternative, publishes Auth0 migration guides, and counts Cursor and Indeed as Auth0-to-WorkOS migration wins.
- Clerk: Clerk is a developer-focused authentication and user management platform for modern web apps with strong React/Next.js DX and drop-in UI components. It competes with WorkOS User Management and AuthKit for the same SaaS/AI startup segment, frequently appearing in the same best-of-CIAM comparisons.
Emerging players
- Composio: Composio is an MCP/integrations platform providing pre-built OAuth flows, tool permissions, and managed credentials for AI agents and LLM applications. Its Rube MCP product explicitly uses WorkOS MCP Auth, but its core integrations offering competes with WorkOS Pipes for the same AI-agent customer base.
- Nango: Nango is a developer-first unified API platform for 200+ third-party SaaS integrations with managed OAuth flows, token refresh, and sync, and has expanded into agent/MCP integration support. It directly competes with WorkOS Pipes for the agent-native third-party OAuth use case.
Broad incumbents
- AWS Cognito: AWS-native user identity and data synchronization service for web and mobile apps, supporting SSO, social IdPs, and user pools. Functions as a WorkOS alternative for AWS-centric customers, though typically less developer-friendly than WorkOS's single API abstraction.
- Microsoft Entra External ID (Azure AD B2C): Microsoft's hyperscaler-scale CIAM and identity service, part of the broader Entra ID portfolio including SSO, MFA, and identity protection. Overlaps with WorkOS's SSO/Directory Sync capabilities but as part of a much wider Microsoft identity portfolio rather than a developer-first pure-play.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
WorkOS social profiles
Digital presenceWorkOS compliance and trust
Trust signalCompliance3 records
WorkOS financial estimates
Financial estimateRevenue estimate
Valuation estimate
WorkOS leadership team
Management profileNumber of profiles
Profiles1 record
WorkOS subsidiaries and ownership
Company hierarchySubsidiaries1 record
WorkOS funding detail
Funding detailFunding overview
Funding rounds5 records
Investors13 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
WorkOS M&A and investment
M&A and investmentM&A1 record
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about WorkOS
What does WorkOS do?
WorkOS provides a unified developer platform with modern RESTful APIs, JSON responses, and SDKs (Node.js, Ruby, Python, Go, PHP, Java, .NET) for quickly adding enterprise-ready features to applications via a single integration point. The platform offers a suite of building blocks including Single Sign-On (SAML/OIDC), Directory Sync (SCIM), Role-Based Access Control, Audit Logs, Multi-Factor Authentication, Admin Portal, User Management, Radar (bot/fraud detection), Vault (encryption key management), MCP Auth (OAuth 2.1 for AI agents), and Pipes (third-party integrations), abstracting dozens of enterprise integrations behind one API.
Is WorkOS a public or private company?
WorkOS is a private company. It is classified as venture growth investor backed and is currently operating.
When was WorkOS founded?
WorkOS was founded in 2019. It employs 101 to 250 people.
Where is WorkOS based?
WorkOS is headquartered in San Francisco, United States, in the North America region.
How does WorkOS make money?
Seven revenue lines are on record. Enterprise SSO Connections are the primary driver. The others are user Management, radar (Bot Detection), audit Logs, admin Portal, freemium Across Product Suite and annual Contracts & Enterprise Plans.
Who are WorkOS's main competitors?
Direct peers on record are Frontegg, Descope, FusionAuth, Stytch, Auth0 (Okta) and Clerk. Emerging players are Composio and Nango. Broad incumbents are AWS Cognito and Microsoft Entra External ID (Azure AD B2C).
Does WorkOS have an API?
Yes. WorkOS provides a public RESTful API with JSON responses and normalized objects for developers to integrate enterprise features such as Single Sign-On (SAML and OIDC), Directory Sync (SCIM), Admin Portal, Audit Logs, Multi-Factor Authentication, Role-Based Access Control, User Management, AuthKit, Radar (bot/fraud detection), Vault (encryption key management), and Pipes (third-party integrations) into their applications. The API supports webhooks/events for real-time updates, includes SDKs for Node.js, Ruby, Python, .NET, Go, PHP, Java, and offers OAuth 2.1 with PKCE for AI agent authorization via its MCP Auth product. Developers can obtain an API key via the WorkOS dashboard. Developer documentation is at workos.com/docs.
What industry is WorkOS in?
WorkOS's product category is Identity and Access Management (IAM). Its primary akta.pro industry code is HDAEALAF, IT Workflow Automation & Orchestration Platforms, with a secondary code of BPAEAIAD, Collaboration & Productivity Platforms (M365/Google Workspace, Email, Chat/Meetings). Its NAICS code is 541511 and its SIC code is 7370.