authentik vs WorkOS
authentik
goauthentik.ioWorkOS
workos.comSide by side
| Figure | authentik | WorkOS |
|---|---|---|
| Price from | $5/mo | $99/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 4 | 10 |
| Spec score · Authentication Software | 8.6 (#4) | 8.5 (#8) |
| Spec score · Identity and Access Management Software | 8.6 (#6) | 8.5 (#13) |
| Spec score · Passkey Authentication Software | 8.7 (#8) | 8.5 (#15) |
| Spec score · Single Sign-On Software | 8.6 (#6) | 8.5 (#10) |
| Authentication | It supports multi-factor authentication with TOTP and WebAuthn/passkeys, including hardware or software authenticators. | Its User Management offering supports SAML and OIDC identity providers, social authentication, and passwordless email codes. |
| Support | The open-source plan lists community Discord and no support; paid support is offered as part of enterprise software subscriptions, with ticket support for Enterprise subscriptions over $1k. | All accounts include email support, in-dashboard web support, API status notifications, documentation, and example apps. |
Plans
authentik
- FreeFree
- Enterprise$5 a month
- Open SourceFree
- Enterprise Plus$20,000 a year
WorkOS
- AuthKitFree
- RadarFree
- Standard SupportFree
- Custom Domain$99 a month
- Audit Logs$125 a month
- Directory Sync$125 a month
- Single Sign-On$125 a month
- Scale Support$1,000 a month
- Annual CreditsPriced on request
- Enterprise SupportPriced on request
In their own words
authentik
authentik is an open-source, self-hostable identity and access management product for workforce single sign-on, customer identity, zero-trust security, legacy application integration and API security. It supports OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM and Kerberos, as well as WS-Federation. MFA options include TOTP, WebAuthn/passkeys, email, SMS, Duo and static tokens. Access policies can consider factors such as user attributes, time and location. Security features include audit logging, session binding, GeoIP and impossible-travel detection, and client certificate authentication with mTLS. It can run on customer infrastructure, including Docker and Kubernetes; the pricing FAQ says there is no hosted version currently. The authentik Agent integrates with Windows, macOS and Linux for local device login and CLI authentication. A free open-source plan includes community Discord support but no product support. Enterprise costs $5 a month, billed annually, at $5 per user per month; external users are $0.02 per month and service accounts have no cost.
WorkOS
WorkOS provides APIs and hosted components for SaaS companies adding enterprise capabilities to applications. Its User Management supports SAML and OIDC identity providers, social authentication, and passwordless email codes. Directory Sync handles SCIM provisioning and HRIS integrations for user lifecycle management. Customer IT administrators can configure identity providers and directories in a hosted Admin Portal with custom branding and a custom domain. Developers get REST APIs, JSON responses, webhooks, and SDKs for Node.js, Ruby, Python, .NET, Go, PHP, and Java. AuthKit includes email and password, magic-code sign-in, MFA, passkeys, organization policies, JIT provisioning, RBAC, and CLI authentication. WorkOS lists API, iOS, and web platforms, plus integrations such as Okta, Microsoft Entra ID, Google Workspace, Salesforce, Slack, and Stripe. Pricing is freemium: free plans exist, while paid products start at $99/mo for Custom Domain and $125/mo for SSO or Directory Sync.