WorkOS AuthKit and Logto both cover consumer sign-in, organizations, and enterprise SSO. Logto adds enterprise SSO at $48 per connector per month, a choice of cloud data region, an open-source core, and self-hosting.
WorkOS started with standalone Enterprise SSO and Directory Sync APIs, then launched AuthKit in November 2023. AuthKit is now a full authentication platform. It supports hosted or custom sign-in, user management, organizations, and roles. It also includes MFA, passkeys, and session controls. The differences are in pricing, deployment, and control. WorkOS charges separately for production enterprise connections, its public materials describe a US-based hosted service, and its User Management backend is not publicly documented as a self-hosted product.
| Motivation | What it looks like in practice |
|---|---|
| A large free MAU allowance with paid production add-ons | AuthKit includes email and password, social OAuth, and Magic Auth for up to 1M monthly active users. MFA and passkeys are included too. A production Custom Domain add-on for hosted AuthKit costs $99 per month. Enterprise SSO, Directory Sync, and SIEM streaming are priced separately, so a team can start paying for production and enterprise requirements before its usage exceeds the MAU allowance. |
| Enterprise costs rise with each connection | Enterprise SSO starts at $125 per production connection per month for 1–15 connections. Directory Sync uses the same published tiers and is billed separately. At the entry tier, one SSO connection plus one Directory Sync connection costs $250 per month. WorkOS lowers the rate as volume rises, reaching $50 per connection for 101–200. Logto Enterprise SSO is a $48-per-connector monthly add-on on Pro. |
| Different boundaries for hosting and control | AuthKit covers core authentication flows, session controls, and native OAuth or PKCE flows. WorkOS manages its user store and authentication service. Logto covers B2C and B2B authentication through an open-source core that can run in Logto Cloud, Private Cloud, or your own environment. |
| Public materials describe a US-based hosted service | WorkOS on-prem guidance covers customer applications that still communicate with WorkOS APIs. Air-gapped applications need a separate authentication path. Logto Cloud offers tenant data regions in Europe, West US, Australia, and Japan. Logto Private Cloud provides a dedicated Azure deployment, with target-region availability confirmed case by case. Self-hosting keeps the service on your infrastructure. |
| The hosted authentication backend is proprietary | WorkOS publishes AuthKit frontend examples, SDKs, and an OpenAPI specification. Its User Management and authentication backend is proprietary, and no self-hosted AuthKit backend is publicly documented. Public user API responses omit password hashes, with no documented export endpoint. Logto publishes its core authentication platform, backend, and sign-in UI under an open-source license. Logto Cloud uses the same core with added managed services. |
Logto supports passwords, passkeys, social sign-in, and MFA for personal accounts. The same tenant can also include organizations, organization roles, per-organization enterprise SSO, and just-in-time provisioning. Account-level API roles and organization roles can coexist in one authorization model.
Pro starts at $24 per month and has no fixed MAU limit, subject to fair-use policies. It includes 50K access tokens per month and one custom domain. Enterprise SSO costs $48 per connector per month. MFA and Organizations are separate $48-per-tenant monthly add-ons. Token overages and other add-ons still affect the bill.
The managed service uses the same open-source authentication core available for self-hosting. Choose Europe, West US, Australia, or Japan as the tenant data region. Private Cloud provides a dedicated Azure deployment, with target-region availability confirmed case by case. Self-hosting keeps the service on your infrastructure.
We believe in honest positioning. Logto isn't the perfect fit for every WorkOS customer.
| Logto | WorkOS | |
|---|---|---|
| Key differences | ||
| Authentication scopeConsumer, business, and enterprise authentication | B2C and B2B authentication in one tenant | AuthKit platform plus standalone enterprise APIs |
| Free tierWhat the free plan includes | Up to 50K MAU and 50K access tokens per monthone custom domain | Up to 1M MAUsorganizations, roles, MFA, and passkeys included |
| Custom domainServing hosted sign-in from your own domain | One included on Free and Pro | Hosted AuthKit add-on: $99 per month |
| Enterprise SSO pricingThe cost of each enterprise identity provider connection | $48 per connector per month on Pro | Starts at $125 per production connection per month for 1–15 |
| Pricing modelHow the plans are billed | Pro starts at $24 per monthno fixed MAU limitaccess-token usage and add-ons apply | Up to 1M MAUs free$2,500 per additional 1Menterprise products priced separately |
| B2B multi-tenancyModel business customers as organizations with roles | Organizations with roles, per-organization SSO, and JIT provisioning | Organizations, roles, and JIT includedSSO and Directory Sync priced per production connection |
| Sign-in UI controlBranding, wording, and languages of the sign-in experience | Editable translations15 built-in languages plus 113 additional language tagsBring Your UI | Hosted UI in about 90 locales with custom copy and CSScustom frontends through APIs |
| Open sourceWhat source is public and what can run on your infrastructure | Core auth platform, backend, and sign-in UICloud adds managed services | Frontend examples, SDKs, and OpenAPI are publichosted backend is proprietary |
| Backend self-hostingRun the user store and authentication service on your infrastructure | Supported with the open-source platform | No publicly documented self-hosted AuthKit or User Management backend |
| Deployment and data residencyWhere the authentication service can run | Cloud tenant data regions in EU, US, AU, and JPPrivate Cloudself-hosted | Public materials describe US-based hostingon-prem customer apps still call WorkOS APIs |
Based on publicly available information as of July 2026. Please verify with the respective vendor for the latest details.
WorkOS documents how to import password hashes into AuthKit. Public Get User and List Users responses omit hashes, and no password-hash export endpoint is publicly documented. Confirm available export options with WorkOS before finalizing the migration plan.
WorkOS exposes paginated APIs for users and organizations. Map compatible records into Logto with scripts that call the Management API. User creation is one record at a time and rate-limited. Plan separate work for memberships and roles, linked identities and MFA factors, plus SSO and Directory Sync settings.
If hashes are unavailable, password users need a reset or a staged migration. Social and passwordless accounts avoid password-hash migration, but users may still need to sign in again or relink an identity. Test account matching and session cutover before launch. Contact us if you want help reviewing the plan.
Read the user migration guide →Every migration is a little different. If the guide doesn't cover your case, talk to us and tell us what you need.
AuthKit is WorkOS's authentication product. It covers hosted and custom sign-in, user management, and sessions. It also includes organizations, roles, MFA, and OAuth or OIDC flows. WorkOS offers standalone Enterprise SSO, Directory Sync, and Audit Logs APIs for products that keep an existing authentication system. Some enterprise features are priced per production connection.
AuthKit is free for up to 1M MAUs per calendar month. It includes email and password, social OAuth, and Magic Auth. MFA and passkeys are included too. A production Custom Domain add-on for hosted AuthKit costs $99 per month. Enterprise SSO starts at $125 per production connection per month for 1–15 connections. Directory Sync is billed separately at the same published tiers. SIEM streaming costs $125 per SIEM connection per month. For usage above 1M MAUs, WorkOS lists $2,500 per month for each additional 1M MAUs.
WorkOS publishes AuthKit frontend examples, SDKs, and an OpenAPI specification. Its hosted User Management and authentication backend is proprietary. No self-hosted AuthKit backend is publicly documented. Public user API responses omit password hashes, with no documented export endpoint. Logto publishes its core authentication platform, backend, and sign-in UI under an open-source license. Logto Cloud uses the same core with added managed services.
Logto fits teams that want B2C and B2B authentication with an open-source backend, regional cloud choices, self-hosting, and lower per-connector SSO pricing. WorkOS fits teams that want to add Enterprise SSO and Directory Sync to an existing authentication system or prefer WorkOS's managed enterprise integration suite. Auth0 and Stytch are other common options.
WorkOS documents support for customer applications deployed on-premises, but those applications still communicate with WorkOS APIs. Air-gapped applications need a separate authentication path. WorkOS does not publicly document a self-hosted AuthKit or User Management backend. Logto supports self-hosting for its open-source authentication platform.
WorkOS and AuthKit are trademarks of WorkOS, Inc. Feature comparisons are based on publicly available information as of July 2026. Please verify with the respective vendor for the latest details.
