Direct answer: at published prices, SSO connections and MAU only, B2B SSO in 2026 costs about: 5 enterprise connections + 2,000 MAU — Cognito 29.25, Clerk 320, WorkOS 625; 25 connections + 10,000 MAU — Cognito 149.25, Clerk 1,670, WorkOS 2,875; 100 connections + 50,000 MAU — Cognito 749.25, Clerk 6,170, WorkOS 8,225 USD per month. The gap comes from the meter: WorkOS/Clerk charge per enterprise connection, Cognito per federated MAU. With few customers, many connections and low MAU, Cognito is cheapest; with very high MAU and few connections, Clerk’s flat connection fee can overtake it; WorkOS includes AuthKit up to 1M users, which fits teams with a large existing user base and a need for SSO + Directory Sync. What Cognito saves in license fees is usually paid back in engineering for the organization model, SCIM and admin portal.
This guide is for product, architecture and procurement teams building B2B SaaS, enterprise portals, partner login and customer identity. Data cut-off: 6 November 2026; prices come from the US pricing pages of WorkOS, Clerk and Amazon Cognito, in USD, excluding tax; all TCOs are editorial calculations, not vendor quotes. The three vendors define “connection”, “MAU” and “user” differently, so official facts, editorial assumptions and non-comparable items are kept separate.
WorkOS: SSO 125/connection/month, 1–15 at list, 16–30 at 100, 31–50 at 80, 51–100 at 65; AuthKit free up to 1M users. Clerk Pro 20/month includes 50k MRU + 1 SSO, extra connections 2–15 at 75, 16–100 at 60, 101–250 at 48. Cognito: SAML/OIDC federation 0.015/MAU, first 50 free, no connection fee. Per connection vs per MAU explains a 10–20× bill difference between 5 and 100 customers.
Three meters: per connection, per connection + plan, per MAU
WorkOS: SSO connections 1–15 at 125 each/month, 16–30 at 100, 31–50 at 80, 51–100 at 65; AuthKit user management is free up to 1M users, then 2,500 per additional 1M/month; Directory Sync also starts at 125/connection; Audit Logs are 0/month, log streaming 125/SIEM connection/month and event retention 99 per million events/month. Clerk: Pro 20/month annual includes 50k MRU and 1 SSO connection; extra connections 2–15 at 75, 16–100 at 60, 101–250 at 48; B2B Authentication enhanced add-on 100/month (85 annual) for unlimited members/organization linking; Directory Sync 75/connection, billed from 1 January 2027; MRU beyond 50k is 0.02/person/month. Cognito: SAML/OIDC federation 0.015/MAU with the first 50 free; direct sign-in Essentials 0.015/MAU (first 10k free), Plus 0.020/MAU (no free tier); no per-connection fee, SMS/email extra.
| Platform | Metered unit | Published price/allowance | Not separately charged |
|---|---|---|---|
| WorkOS SSO | Enterprise connections | 1–15 at 125 each/month; 16–30 at 100; 31–50 at 80; 51–100 at 65 | AuthKit free up to 1M users |
| Clerk Pro | Plan + enterprise connections | 20/month annual includes 50k MRU + 1 SSO; extra 2–15 at 75, 16–100 at 60, 101–250 at 48 | No MAU charge within 50k MRU |
| Amazon Cognito | Federated MAU | SAML/OIDC 0.015/MAU, first 50 free | No per-connection fee |
Sources: WorkOS Pricing, Clerk Pricing and Amazon Cognito Pricing (US). Accessed 6 November 2026; USD, excluding tax; WorkOS/Clerk use annual public prices, Cognito is usage-based; Directory Sync, audit logs, B2B add-on, SMS/email and support are separate.
Three tiers: 29–625 for 5 customers, 749–8,225 for 100
Assuming every MAU signs in through SAML/OIDC, counting SSO + MAU only and excluding Directory Sync: 5 connections/2,000 MAU — Cognito 29.25, Clerk 320, WorkOS 625; 25 connections/10,000 MAU — Cognito 149.25, Clerk 1,670, WorkOS 2,875; 100 connections/50,000 MAU — Cognito 749.25, Clerk 6,170, WorkOS 8,225. Annual: small 351/3,840/7,500; mid 1,791/20,040/34,500; large 8,991/74,040/98,700 (Cognito/Clerk/WorkOS).
| Scenario | WorkOS | Clerk | Cognito |
|---|---|---|---|
| 5 connections + 2,000 MAU | 625.00 | 320.00 | 29.25 |
| 25 connections + 10,000 MAU | 2,875.00 | 1,670.00 | 149.25 |
| 100 connections + 50,000 MAU | 8,225.00 | 6,170.00 | 749.25 |
Editorial calculation, not a quote. WorkOS = sum of tiered connection prices; Clerk = 20 + extra connections (1 included in Pro) + max(0, MRU − 50,000) × 0.02; Cognito = max(0, MAU − 50) × 0.015. Excludes tax, Directory Sync, B2B add-on, audit logs, SMS/email, support, implementation and migration; assumes all MAU use federated login, while Cognito direct sign-in/Plus are separate.
Unit cost: 65–125 per connection, 0.015–0.31 per MAU
Dividing the total by connections or MAU shows the shape of each model: WorkOS per connection 125 / 115 / 82.25 (5/25/100), Clerk 64 / 66.80 / 61.70, Cognito 5.85 / 5.97 / 7.49 (total ÷ connections, not a vendor per-connection charge). Per MAU: WorkOS 0.3125 / 0.2875 / 0.1645, Clerk 0.160 / 0.167 / 0.1234, Cognito 0.014625 / 0.014925 / 0.014985. Cognito’s “per connection” looks tiny because it does not charge per connection; the more connections and the lower the MAU, the bigger that advantage.
| Scenario | WorkOS per connection/MAU | Clerk per connection/MAU | Cognito per connection/MAU |
|---|---|---|---|
| 5 connections + 2,000 MAU | 125.00 / 0.3125 | 64.00 / 0.1600 | 5.85 / 0.014625 |
| 25 connections + 10,000 MAU | 115.00 / 0.2875 | 66.80 / 0.1670 | 5.97 / 0.014925 |
| 100 connections + 50,000 MAU | 82.25 / 0.1645 | 61.70 / 0.1234 | 7.49 / 0.014985 |
Editorial calculation, not a quote. Per connection = monthly total ÷ connections; per MAU = monthly total ÷ MAU; Cognito’s per-connection figure is an allocation, not its billing unit. Excludes tax, add-ons, implementation and support.
Break-even: when Cognito stops being cheaper
Cognito grows linearly with MAU, while Clerk/WorkOS are flat per connection within their allowances. For Clerk: 5 connections at 320/month, Cognito exceeds it at about 21,383 MAU; 25 connections at 1,670, about 111,383 MAU; 100 connections at 6,170, about 411,383 MAU. WorkOS AuthKit includes 1M users, so its corresponding break-evens are about 41,717 / 191,717 / 548,383 MAU. In short, many connections and low MAU (typical B2B enterprise customers) make Cognito very cheap; very high MAU with few connections makes Clerk/WorkOS’s flat connection fees more attractive. None of these numbers includes building the organization model, SCIM, admin portal and operations.
| Connections | Clerk monthly | Cognito break-even MAU | WorkOS monthly | Cognito break-even MAU |
|---|---|---|---|---|
| 5 | 320 | About 21,383 | 625 | About 41,717 |
| 25 | 1,670 | About 111,383 | 2,875 | About 191,717 |
| 100 | 6,170 | About 411,383 | 8,225 | About 548,383 |
Editorial calculation, not a quote. Break-even MAU = monthly fee ÷ 0.015 + 50 (Cognito’s first 50 MAU free); assumes Clerk stays within 50k MRU and WorkOS within 1M AuthKit users, and all MAU use federated login. Recalculate beyond the allowances.
Hidden costs: Directory Sync, B2B add-on, audit and support
WorkOS SSO does not include Directory Sync: it also starts at 125/connection (16–30 at 100, 31–50 at 80, 51–100 at 65); Audit Logs are 0/month, but log streaming is 125/SIEM connection/month and event retention 99 per million events/month. Clerk’s B2B enhanced add-on is 100/month (85 annual) for unlimited members and organization linking; Directory Sync is 75/connection, billed from 1 January 2027; MRU beyond 50k is 0.02/person/month. Cognito has no connection fee, but Plus is 0.020/MAU with no free tier, direct Essentials is free for the first 10k, and SMS/email/M2M tokens are extra; the organization model, SCIM, admin portal, audit and SSO troubleshooting are yours to build. All three exclude tax, implementation, migration and 24/7 support.
| Add-on | WorkOS | Clerk | Cognito |
|---|---|---|---|
| Directory Sync/SCIM | From 125/connection | 75/connection, billed from 1 Jan 2027 | Build your own |
| B2B organization features | AuthKit includes Organizations | 100/month (85 annual) | Build your own |
| Audit/logs | Audit Logs 0; streaming 125/SIEM; retention 99/million events | Pro includes 7-day logs; longer/export extra | Build your own/CloudWatch extra |
| MAU overage | AuthKit free to 1M, then 2,500/million | 0.02/person/month after 50k MRU | 0.015/MAU (federation) |
| Security/compliance | Enterprise contract/SLA separate | Business/Enterprise separate | Plus 0.020/MAU; BAA separate |
Sources: the three official pricing pages (accessed 6 November 2026). Only publicly verifiable items are listed; “separate/build your own” means confirm on the product/contract page and is not guessed here. Excludes tax, implementation, migration and support.
Which option fits which scenario?
5–100 enterprise customers with low MAU (typical B2B): Cognito has the lowest usage price, but add the organization model, SCIM, admin portal, audit and SSO operations; if that needs 1–2 engineers, Cognito’s price advantage disappears quickly. Want turnkey SSO connection management, Directory Sync and an admin portal: WorkOS, 65–125 per connection, AuthKit free up to 1M users, good when you already have many end users. Want full login UI, MFA and organization/member management with fewer than 100 connections: Clerk, Pro 20/month + 1 SSO, extra connections 48–75, usually below WorkOS. Enterprise SLA/private deployment/compliance: all three need an Enterprise quote; list required controls before comparing.
| Scenario | First choice | Why | Check first |
|---|---|---|---|
| 5–100 enterprise customers/low MAU | Cognito | 0.015/MAU, no connection fee | Organization/SCIM/admin/ops effort |
| Turnkey SSO + SCIM + portal | WorkOS | From 125/connection; AuthKit 1M free | Directory Sync, audit, contract |
| Full login UI + org management | Clerk | 20/month includes 1 SSO; extra 48–75 | B2B add-on, MRU overage |
| High MAU/few connections | Clerk/WorkOS | Flat connection fee amortizes | Allowances, break-even |
| Enterprise SLA/private deploy | All three Enterprise | Contract/compliance/residency | BAA, audit, support |
| Add SSO to an existing app | WorkOS SSO | Standalone SSO connections | Existing IdP, migration cost |
Sources: the three official pricing pages (accessed 6 November 2026). This is an editorial decision matrix, not vendor advice; actual login latency, availability, IdP compatibility, migration effort and support response were not tested.
What should procurement and acceptance specify?
At least ten things: enterprise connection count, MAU, organization/member model, Directory Sync/SCIM, SSO protocols (SAML/OIDC), MFA/password policy, admin portal, audit/logs, SLA/support, data residency/compliance. Run a 30-day POC on real logins and record connections, MAU, first-login success rate, IdP compatibility, SCIM sync, failover and the bill; do not compare only “per connection” or “per MAU”.
- Connections: one per enterprise customer; test/sandbox connections, caps and tier breaks.
- MAU: federated/direct/API counting; anonymous, service accounts and M2M.
- Organization: multi-tenancy, member limits, roles/permissions, invitations, domain verification.
- SCIM: user/group sync, deprovisioning, retries, billing start date.
- Protocols: SAML 2.0, OIDC, IdP-initiated/SP-initiated, certificate rotation.
- Security: MFA, password policy, session management, audit, IP restrictions.
- Portal: customer self-service SSO setup, connection testing, error messages.
- Contract: annual/monthly, connection tiers, MAU overage, renewal uplift, early termination.
- Compliance: SOC2/ISO, BAA/HIPAA, data residency, subprocessors.
- POC: 30 days of real logins; record connections, MAU, success rate, SCIM, failover and bill.
FAQ
What is cheapest for 5 enterprise customers and 2,000 MAU?
Cognito 29.25, Clerk 320, WorkOS 625 per month. Cognito charges 0.015/MAU after the first 50 and no connection fee; Clerk is 20 + 4 × 75; WorkOS is 5 × 125. If you do not want to build the organization/SCIM/admin layer, add engineering cost back before comparing.
What about 100 customers and 50,000 MAU?
Cognito 749.25, Clerk 6,170, WorkOS 8,225 per month. Cognito is still lowest, but 100 SSO connections, SCIM, audit and customer support usually need dedicated engineering/operations; Clerk/WorkOS bundle connection management and a portal.
Why is Cognito so cheap?
It charges 0.015 per federated MAU, the first 50 free, with no per-connection fee; 5 connections/2,000 MAU is 29.25. The trade-off: Cognito is identity infrastructure, not a B2B SSO product — the organization model, SCIM, admin portal, audit and IdP troubleshooting are yours to build.
WorkOS or Clerk?
At public connection rates, Clerk is usually lower: 320 vs 625 at 5 connections, 6,170 vs 8,225 at 100. WorkOS’s advantages are AuthKit free up to 1M users and a more turnkey SSO/Directory Sync/audit/admin portal, fitting teams with many users or standalone SSO needs; Clerk fits teams wanting full login UI + organization management.
What is the “SSO tax”?
It refers to charging per enterprise connection for SSO: WorkOS from 125/connection, Clerk 75/60/48, while Cognito charges per MAU instead. At 100 connections WorkOS is 8,225, Clerk 6,170, Cognito 749; the difference is “buy connection management” versus “build it and pay per user.”
Does Clerk’s 20 dollars include SSO?
Pro at 20/month annual includes 50k MRU and 1 SSO connection; the 2nd–15th are 75 each, 16–100 are 60 each, 101–250 are 48 each. The B2B enhanced add-on is 100/month (85 annual) for unlimited members and organization linking; Directory Sync is 75/connection, billed from 1 January 2027.
How is Directory Sync/SCIM charged?
WorkOS Directory Sync starts at 125/connection (same tiers as SSO); Clerk is 75/connection, billed from 1 January 2027; Cognito has no managed SCIM, so you build it or use a third party. SCIM usually comes with SSO, so do not ask only for the SSO price.
What hidden costs should we expect?
Directory Sync, B2B add-on, audit/log streaming, MAU/MRU overage, SMS/email, enterprise SLA/private deployment, BAA/HIPAA, implementation/migration, customer self-service portal, support and tax. Per-connection billing also has test/sandbox connections and tier breaks; per-MAU billing has federated/direct/M2M counting rules.
Research method and limitations
This article separates “official facts” from “editorial modelling”: WorkOS SSO/Directory Sync/AuthKit/audit rates, Clerk Pro/SSO/B2B/Directory Sync/MRU rates and Cognito federated/direct/Plus rates come from the three US pricing pages (accessed 6 November 2026); the 5/25/100-connection and 2,000/10,000/50,000-MAU totals are arithmetic on published unit prices, not vendor quotes. It does not compare actual login latency, availability, IdP compatibility, SCIM quality, migration effort or support response.
Eight limitations: (1) only US public list prices are used, excluding tax, discounts, private pricing, commitments and regional differences; (2) WorkOS/Clerk use annual prices while Cognito is usage-based, and monthly/contract prices may differ; (3) all MAU are assumed to use SAML/OIDC federation; Cognito direct Essentials/Plus have different rates; (4) Directory Sync, B2B add-on, audit logs, SMS/email, M2M tokens and support are excluded; (5) building the organization model, SCIM, admin portal, audit and operations is not costed, and that can change Cognito’s actual TCO significantly; (6) Auth0 and other vendors without public B2B pricing are excluded; (7) IdP compatibility, login latency, failover, data residency and compliance were not tested; (8) prices and terms can change by contract, region and exchange rate. Treat this as a unit-conversion template and replace assumptions with a 30-day real-login POC.
Sources and basis
- WorkOS, Pricing: workos.com/pricing. SSO 1–15 at 125/connection/month, 16–30 at 100, 31–50 at 80, 51–100 at 65; AuthKit free up to 1M users, then 2,500/million; Directory Sync from 125/connection; Audit Logs 0/month, log streaming 125/SIEM/month, event retention 99/million events/month. Accessed 6 November 2026.
- Clerk, Pricing: clerk.com/pricing. Pro 20/month annual includes 50k MRU + 1 SSO; extra 2–15 at 75, 16–100 at 60, 101–250 at 48; B2B enhanced add-on 100/month (85 annual); Directory Sync 75/connection, billed from 1 January 2027; MRU beyond 50k at 0.02/person/month. Accessed 6 November 2026.
- Amazon Web Services, Cognito Pricing: aws.amazon.com/cognito/pricing. SAML/OIDC federation 0.015/MAU (first 50 free); direct sign-in Essentials 0.015/MAU (first 10k free), Plus 0.020/MAU (no free tier); no connection fee; SMS/email/M2M tokens separate. Accessed 6 November 2026.
Data cut-off 6 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.