Aeion Auth vs WorkOS — Identity Without the Per-MAU Tax
WorkOS's $125-per-SSO-connection + per-MAU billing model adds up fast: 50 customer-tenants on enterprise SSO = $6,250/month in connection fees alone, before the MAU multiplier. Aeion Auth ships the same enterprise-SSO surface (SAML 2.0 + OIDC across 10 providers + SCIM 2.0 directory sync) included free with every Aeion deployment. Your billing is your AI provider's costs — full stop.
The WorkOS Pricing Calculus
WorkOS is the de-facto choice for B2B SaaS teams who need to add enterprise SSO + SAML to a customer-tenant for their largest accounts. The pricing model:
When WorkOS Is the Right Choice
WorkOS is purpose-built for one shape of company: a hosted B2B SaaS adding enterprise SSO + SAML to a SINGLE product, where the SaaS provider is the customer of WorkOS and the SaaS's customers are the end-users. If you fit that shape AND:
Code You Actually Run — Setup Comparison
A side-by-side of what it takes to add Google SSO to your product on each platform.
Migration FAQ
Aeion's connection model maps cleanly onto WorkOS's profile + connection model. The OAuth providers themselves don't move (Google still issues the tokens); you swap the broker. Plan ~1-2 sprints to migrate test SSO connections + dual-run before cutover.
Yes — Aeion's generic OIDC provider can point at WorkOS's OIDC endpoints during a transition window so you can move customer-tenants one at a time without breaking active sessions.
Yes — both are included (no per-connection fee). Native SAML 2.0 SSO (Okta, Entra ID, OneLogin, Ping), SCIM 2.0 directory sync for automated user lifecycle, and native PIV/CAC smart-card sign-in for federal / defense deployments.
Yes. MFA (TOTP + WebAuthn/FIDO2), magic links, and audit logs (append-only, 90-day default retention) all ship at no charge with every Aeion deployment. Aeion's revenue model is per business module (commerce, CRM, helpdesk, etc.), not auth primitives.
Aeion's admin UI at `/admin/platform/auth/oauth-connections` exposes per-connection config to platform admins; we don't yet ship a customer-facing white-label AdminPortal equivalent. If self-serve SSO config by your end-customers is critical (e.g., you're selling to mid-market and IT admins want to configure their own SSO), WorkOS still wins this round. Filed as a roadmap item.