WorkOS
- Free allowance
- AuthKit user management free for the first 1 million monthly active users; staging environments are free; the production environment needs a payment method on file
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- cardcard required, phone unknown
- Binding limit
- write-gateda payment method is required to activate the production environment; staging environments are free
- Evidence
- documented43 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-03checked 2026-11-02 (live); stale on 2026-12-03
| Free tier | AuthKit user management free for the first 1 million monthly active users; staging environments are free; the production environment needs a payment method on file unit users; metered on identity-count; An MAU is a user who signs up, signs in or updates a profile in a calendar month. AuthKit covers email and password, social login, passkeys, MFA, magic auth and enterprise SSO. SSO and Directory Sync connections cost USD 125 each for the first 15, a custom domain USD 99 a month; Radar includes 1,000 checks. A production environment activates only after a payment method is added, even when usage stays inside the free allowance. |
|---|---|
| Price | none stated |
| Limits |
|
| Binding | write-gated The 1 million MAU allowance applies in a production environment, which activates only after a payment method is added; without one the account has staging only. |
| Identity | card The sign-up page asks for an email address or a Google sign-in and states no credit card is required, and staging needs none; the production environment activates only after a payment method (card details and cardholder name, billing address) is added. Whether a later step of the dashboard sign-up asks for a phone number is unverified: behind a sign-up. |
| Egress | not applicable: an authentication API; no traffic allowance or egress term is published |
| Per-object cap | metadata on a user or an organization: up to 10 key-value pairs, each key up to 40 characters and each value up to 600 characters, ASCII only |
| Retention | Audit Log events are kept 30 days by default and then deleted; longer retention is priced per 1M events (30 days) |
| Interface | rest REST API at https://api.workos.com with a Bearer API key (a GET /events without a key answered 401); hosted AuthKit sign-in pages; an events API; WorkOS Connect serves OAuth authorization server metadata at /.well-known/oauth-authorization-server and an OpenID configuration at /.well-known/openid-configuration on the AuthKit domain. endpoint: https://api.workos.com |
| Tooling | WorkOS SDKs for Node, Ruby, Python and other languages, the WorkOS CLI (npx workos@latest), or any HTTP client with a Bearer key. |
| Composes with | A staging environment for building and testing sign-in at no cost; production sign-in for real users needs a card on file. |
| Reliability | Email sent through the shared WorkOS provider (Magic Auth, verification, password reset) can be temporarily limited for unusual volume or spam patterns; a 429 may carry Retry-After. |
| Notes | Provisioning through Stripe Projects (stripe projects add workos/auth) creates a sandbox environment with no account form or credit card prompt; production is a second configuration of the same command. Stripe states that a payment method is added to Stripe once and handed to the provider as a Shared Payment Token when a paid plan is selected, and WorkOS states that production environments require a payment method added in the WorkOS Dashboard; whether the production configuration provisioned through Stripe Projects needs a payment method on the WorkOS team as well is unverified: behind a sign-up. |
| Evidence note | documented Every value is quoted from first-party pricing, docs, billing and sign-up pages; the API host was probed and answered 401 without a key. An authenticated call in a staging environment would move it to measured. |
| Parsed numbers |
|
Evidence 43
| date | source | what it proved |
|---|---|---|
| 2026-10-30 | workos.com/pricing | the first 1 million MAUs are free |
| 2026-10-30 | workos.com/pricing | AuthKit is free for the first 1M MAUs |
| 2026-10-30 | workos.com/pricing | AuthKit covers password, social, passkeys, MFA, magic auth and SSO |
| 2026-10-30 | workos.com/pricing | an MAU is a user who signs up, signs in or updates a profile in a month |
| 2026-10-30 | workos.com/pricing | staging environments are free; only production is billed |
| 2026-10-30 | workos.com/pricing | SSO and Directory Sync connections cost USD 125 each for the first 15 |
| 2026-10-30 | workos.com/pricing | a custom domain costs USD 99 a month |
| 2026-10-30 | workos.com/pricing | Radar includes 1,000 checks |
| 2026-10-30 | workos.com/pricing | longer audit log retention is priced per 1M events |
| 2026-10-30 | workos.com/docs/authkit/environments | staging is free |
| 2026-10-30 | workos.com/docs/authkit/environments | production needs billing information even inside the free allowance |
| 2026-10-31 | workos.com/docs/dashboard/billing | a payment method is required for production |
| 2026-10-31 | workos.com/docs/dashboard/billing | the payment method is a card |
| 2026-10-31 | workos.com/docs/dashboard/billing | the payment form asks for a billing address |
| 2026-10-30 | workos.com/docs/authkit/platforms | production needs a payment method; without one only sandbox environments exist |
| 2026-10-30 | workos.com/blog/workos-joins-stripe-projects | the Stripe Projects route asks no account form or card |
| 2026-10-30 | workos.com/blog/workos-joins-stripe-projects | the Stripe Projects route provisions a sandbox environment |
| 2026-10-30 | workos.com/blog/workos-joins-stripe-projects | a WorkOS CLI exists |
| 2026-10-30 | workos.com/docs/reference/rate-limits | all requests are limited to 6,000 per 60 seconds per API key |
| 2026-10-30 | workos.com/docs/reference/rate-limits | AuthKit limits apply per environment |
| 2026-10-30 | workos.com/docs/reference/rate-limits | AuthKit reads are limited to 1,000 per 10 seconds |
| 2026-10-30 | workos.com/docs/reference/rate-limits | AuthKit writes are limited to 500 per 10 seconds |
| 2026-10-30 | workos.com/docs/reference/rate-limits | shared-provider email can be temporarily limited |
| 2026-10-30 | workos.com/docs/reference/rate-limits | part of the text of Reliability, above |
| 2026-10-31 | workos.com/docs/audit-logs | audit log events are kept 30 days by default |
| 2026-10-31 | workos.com/docs/reference/events | the API is served at api.workos.com |
| 2026-10-31 | workos.com/docs/reference/events | the API takes a Bearer key |
| 2026-10-31 | workos.com/docs/reference/events | a Node SDK exists |
| 2026-10-31 | workos.com/signup | the sign-up asks for an email address or a Google sign-in |
| 2026-10-31 | workos.com/signup | the sign-up page states no credit card is required |
| 2026-10-31 | probe: https://api.workos.com/events | api.workos.com/events answers 401 without a key |
| 2026-11-01 | workos.com/docs/authkit/metadata | WorkOS documents up to 10 key-value pairs of metadata on an organization or user |
| 2026-11-01 | workos.com/docs/authkit/metadata | a metadata key is up to 40 characters and a value up to 600 characters, ASCII only |
| 2026-11-01 | raw.githubusercontent.com/workos/openapi-spec/main/spec/open | the WorkOS OpenAPI specification sets maxProperties 50 and a key length of 40 on the metadata of a user |
| 2026-11-01 | docs.stripe.com/projects | Stripe hands the provider a Shared Payment Token for a selected paid plan |
| 2026-11-01 | docs.stripe.com/projects | the payment method of Stripe Projects is added to Stripe once |
| 2026-11-01 | docs.stripe.com/cli/projects.md | Stripe requires its payment method before a paid plan tier is provisioned |
| 2026-11-01 | workos.com/docs/authkit/platforms | WorkOS requires a payment method added in its Dashboard before a platform can create production environments |
| 2026-11-01 | workos.com/blog/workos-joins-stripe-projects | production through Stripe Projects is the same command with the production configuration |
| 2026-11-01 | workos.com/signup | the sign-up page states no credit card is required |
| 2026-11-01 | workos.com/docs/reference/workos-connect/metadata | WorkOS Connect serves an OpenID configuration discovery endpoint |
| 2026-11-01 | workos.com/docs/reference/workos-connect/metadata | the OpenID configuration is served at /.well-known/openid-configuration on the AuthKit domain |
| 2026-11-01 | workos.com/docs/reference/workos-connect/metadata | the OAuth authorization server metadata is served at /.well-known/oauth-authorization-server on the AuthKit domain |