WorkOS prices single sign-on by the connection, not the user

The workload

Enterprise buyers who require single sign-on push a specific, bounded task onto a vendor's app: integrate with the buyer's identity provider, typically Okta, Microsoft Entra, or Google Workspace, so that buyer's employees can log in through their own company directory. WorkOS prices this task not by how many people sign in but by how many separate integrations the app supports, a model industry discussion outside WorkOS's own materials has called the "SSO tax." WorkOS's own pricing page, retrieved 16 September 2026, states this verified figure directly: a connection costs "$125/ea" for the first fifteen.

What the documents show

The pricing page's stepped structure is verified vendor fact: $125 per connection for connections 1 through 15, discounting to $100 each for 16 to 30, $80 each for 31 to 50, and $65 each for 51 to 100, with pricing above 100 connections requiring direct contact with WorkOS. A second WorkOS document, its SSO documentation, defines what is priced: a connection is "the method by which a group of users (typically in a single organization) sign in to your application," one per customer organization's identity-provider setup, not per user, confirming the pricing page's own framing that a connection tracks customers, not seats. Separately, the same pricing page states WorkOS's AuthKit product, its general user-management layer rather than SSO specifically, carries a verified allowance of "First 1 million monthly active users free," a figure this entry does not restate as an SSO price since the two are billed on different meters.

The operating cost

For a founder selling to five enterprise customers, each requiring one SSO connection, the published rate is $125 per connection per month, or $625 total before any volume discount applies at the sixteenth connection, a multiplication of the page's own unit price, labelled an estimate only because the five-customer count is illustrative rather than documented. The pricing page does not describe a startup or free-tier program specific to SSO connections; the only stated no-cost allowance belongs to AuthKit's separate MAU-based product.

The stop condition

The per-connection model's own volume discounts mark a stated point for renegotiation: at 16, 31, 51, and 101 connections, the documented price per unit drops or requires a custom quote. Editorially, the more common trigger for a solo operator sits upstream of that schedule: the point at which one enterprise prospect's required connection costs more per month than that customer's own subscription revenue, a comparison the pricing page does not make.

• Does this customer's contract value clear the $125-per-month connection cost before any profit exists?
• Is the requirement genuinely the buyer's own procurement policy, or an assumption about what enterprise buyers need?
• Would AuthKit's free MAU allowance cover authentication needs that do not require a dedicated SSO connection?

WorkOS's own numbers show a fee tied to the number of enterprise identity integrations supported, not to total users, a structurally different bet than the per-MAU models this batch documents for Auth0, Clerk, and AWS Cognito.