WorkOS security review cost for trusting the SSO session

WorkOS security review cost is $2,400 once for one app whose customers sign in through a WorkOS SSO connection. $1,200 starts the work. The report is due 48 hours after a test user can sign in. You own the PDF. There is no subscription.

WorkOS issues the session. Your API decides whether it believes the organization on it.

Short answer: WorkOS security review cost is $2,400 once, with $1,200 to start, for one app that signs customers in with WorkOS SSO. I check the organization on the session, the role, and the API those pages already call, then write the report 48 hours after access works. You own it. A WorkOS connection bill and a multi-week pentest are different products. The offer is the web application security review.

What does a WorkOS security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying a WorkOS connection, a scanner seat, or a stamp I do not hold.

WorkOS pricing lists AuthKit free for the first 1 million monthly active users, then $2,500 a month per extra million. Single Sign-On is $125 per connection for 1–15 connections, $100 for 16–30, $80 for 31–50, and $65 for 51–100. A connection is the link between WorkOS and one identity provider group, such as Okta or Microsoft Entra. Directory Sync is the same ladder, billed separately. Staging is free. Production connections are what they bill.

What you are buying	2026 price	What you actually get
One WorkOS SSO connection	$125/mo for the first 15	The IdP link. Not a test of your API
AuthKit user management	$0 up to 1M MAU, then $2,500/mo per extra million	Sign-in product. Still their controls
This WorkOS review	$2,400 once, $1,200 to start	One app, organization on the session, the API the UI calls, report in 48 hours, one retest
Web app test, market	$5,000–$30,000	Longer calendar, often packaged for a compliance conversation

Synack’s June 2026 pricing guide puts a typical web application test in that $5,000 to $30,000 band.

One connection at $125 a month is $3,000 over 24 months and $4,500 over 36. Three passes of this review, a year apart, are $7,200. The connection bill stays separate.

The same $2,400 is on pricing. An Auth0 tenant is a different vendor and a different token check, covered in Auth0 security review cost.

What does that $2,400 actually open?#

I sign in as the organizations you already sell and record which records those sessions can reach. WorkOS issues the session. Your API has to match the organization on it to the route. Your API key stays out of the browser and out of this engagement.

WorkOS’s session docs and SSO guide are the bar I write against:

• The access token is a JWT. Their docs say the backend should validate it on each request. Claims include the user, the session, the organization selected at sign-in, the role, the permissions, and an expiry. The issuer is https://api.workos.com/ unless you set a custom auth domain.
• A refresh can ask for a different organization. WorkOS returns a new token only when that session may access it. I record whether the API still serves organization A after the UI is on organization B. I do not ship a recipe.
• On the SSO callback, WorkOS says to match the profile’s organization id to the organization you authenticated. Email domain is not a safe stand-in, because guests can sit outside the corporate domain.
• The authorization code is valid for 10 minutes. I note whether a late callback is rejected. The PDF names the path. It does not print a token.

The document shape is the sample pentest report. No client names.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a WorkOS dashboard audit, a Directory Sync mapping review, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

I do not configure the customer’s Okta or Entra connection, and I do not test WorkOS’s own infrastructure.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not read organization ids.

How does the review run from access to the PDF?#

You authorize one URL, I use the test logins you send, and the clock starts when that login works. WorkOS issues the session. Your API decides whether it believes the organization. I do not patch production inside this price.

Step	What happens
Trigger	A customer SSO connection is live, or a buyer asked whether one organization can read another
Action	I walk the live UI as each test organization and compare that session to the API those pages already call
System of record	The app, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization, a test user, and a second organization when tenants must stay apart. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if I cannot legally open the app, or if a buyer named a certificate this offer does not include. Get a URL and two organizations first. A pass with no login is a homepage skim.

I will not guess a WorkOS app from a dashboard screenshot. Wait if nobody can sign in through the connection today. Hire the firm that holds CREST if the questionnaire requires that name. If the login is not WorkOS, the same web application security review covers auth and the API. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, two organizations, and one sentence on what is public. I can start without a tour of the WorkOS dashboard. I cannot start without a login that behaves like production, or a public page becomes a false finding.

Before you pay, confirm these:

• The production or staging URL I am allowed to open, in writing.
• One test user in organization A and one in organization B, or a single org if you truly have no tenants.
• Which records organization A must never see.
• That the WorkOS API key is server-only.
• The role that should fail a write, if you sell more than one role.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.