AuthKit is free to 1 million MAUs, but enterprise SSO and Directory Sync are billed per connection ($125 each for the first 15) and a custom domain is $99/month. [2]
Guides · auth · Everyday developer services
WorkOS AuthKit
Sign up for WorkOS, configure an AuthKit application's redirect URIs, and copy the API key and client ID; generate a cookie password locally.
Researched · not yet run liveLast researched 25 October 2026 · WorkOS · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Sign up for WorkOS
The person signs up or signs in on the WorkOS dashboard. verapli never creates the account.
Where: https://dashboard.workos.com/
Configure redirect URIs
In Applications, open the application, Redirects tab, and add the redirect URI (e.g. http://localhost:3000/callback; no wildcards), plus sign-out and initiate login URIs.
Where: https://dashboard.workos.com/
Copy the API key and client ID
Copy the API key and client ID from the dashboard into WORKOS_API_KEY and WORKOS_CLIENT_ID, and generate WORKOS_COOKIE_PASSWORD locally with openssl rand -base64 32.
verapli captures
WORKOS_API_KEYhere by plain code: encrypted in your browser, never shown to AI.Where: https://dashboard.workos.com/
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
WORKOS_API_KEY | secret | WorkOS API key (server-side). | |
WORKOS_CLIENT_ID | not secret | WorkOS client ID. | |
WORKOS_COOKIE_PASSWORD | secret | Password of at least 32 characters used to encrypt session cookies; generated locally. | |
NEXT_PUBLIC_WORKOS_REDIRECT_URI | not secret | Redirect URI; must match the one on the Redirects tab. |
Pricing
- Free tier: AuthKit first 1 million MAUs free.
- Costs: SSO / Directory Sync $125 per connection (1-15), custom domain $99/month.
Source [2]
For agents
The same entry as JSON: /api/v1/entries/workos/authkit · requirements /api/v1/requirements/workos/authkit · terms /api/v1/terms/workos/authkit.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for WorkOS AuthKit, and how long will it take?"
→ tools/call requirements { "provider_id": "workos/authkit" }Sources
- AuthKit Next.js quickstart Env vars WORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_COOKIE_PASSWORD (at least 32 characters, openssl rand -base64 32), NEXT_PUBLIC_WORKOS_REDIRECT_URI; Applications, Redirects tab for redirect, sign-out and initiate login URIs; default redirect has no wildcards and must match code. · accessed 25 October 2026 · official
- WorkOS pricing AuthKit first 1 million MAUs free, then $2,500 per additional 1M; SSO and Directory Sync $125 per connection (1-15) with volume discounts; Custom Domain $99/month. · accessed 25 October 2026 · official
- Stripe Projects provider catalogue WorkOS is listed in the Stripe Projects catalogue as workos/auth (Auth). · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. WorkOS is not affiliated with verapli.