Clerk vs WorkOS.
Last verified 2026-08-19
When Clerk wins
- Fastest Next.js / React DX and default UI components
- Consumer-grade login (SMS OTP, step-up, progressive profiling, bot detection) that WorkOS does not ship
- Organizations in the same SKU, no separate B2B product
- Lower starting price for a small app that is not yet selling SSO
When WorkOS wins
- AuthKit free to 1M MAU, then SSO and Directory Sync billed like enterprise software
- Deeper enterprise federation, SCIM, and Admin Portal than Clerk's common-IdP set
- Native FGA / ReBAC; Clerk still needs OpenFGA or Permify
- ISO 27001 and HIPAA; Clerk's compliance footprint is still thinner
Both win
- Both support WebAuthn passkeys natively
- Both support social login
- Both have SOC 2 Type II
- Neither is the passkey-orchestration leader (Clerk 4/5, WorkOS 4/5)
Pricing comparison
| MAU band | Clerk | WorkOS |
|---|---|---|
| 10,000 MAU | $25/mo | $0/mo |
| 100,000 MAU | $800/mo | $0/mo |
| 500,000 MAU | $2,800/mo | $1,500/mo |
| 1,000,000 MAU | $5,500/mo | $3,500/mo |
Developer experience & lock-in
Editorial 1–5 scores and migration effort, on the same axes for both. Lower migration effort is better (easier to adopt, less lock-in).
| Signal | Clerk | WorkOS |
|---|---|---|
| DX overallDeveloper experience | 5/5 | 5/5 |
| Docs qualityDocumentation | 5/5 | 5/5 |
| Passkey orchestrationPasskey / WebAuthn depth | 4/5 | 4/5 |
| Adoption effortMigrating in | Easy | Easy |
| Lock-in (exit effort)Migrating out | Moderate | Moderate |
Enterprise readiness
Computed across the enterprise pillars from the capability matrix. See the enterprise-ready pillars.
| Pillar | Clerk | WorkOS |
|---|---|---|
| Overall | Enterprise-ready · 81 | Enterprise-ready · 98 |
| Enterprise SSO | 85 | 100✓ |
| Directory sync (SCIM) | 100 | 100 |
| Organizations & tenancy | 100 | 100 |
| RBAC & custom roles | 60 | 100✓ |
| Audit logs & streaming | 80 | 100✓ |
| Compliance certifications | 60 | 100✓ |
| Security posture | 85✓ | 75 |
Side-by-side capability matrix
| Capability | Clerk | WorkOS |
|---|---|---|
| Password authentication | ✓ Yes | ✓ Yes |
| Social login | ✓ Yes | ✓ Yes |
| Magic links | ✓ Yes | ✓ Yes |
| SMS OTP | ✓ Yes | ✕ No |
| Email OTP | ✓ Yes | ✓ Yes |
| TOTP (authenticator app) | ✓ Yes | ✓ Yes |
| Push MFA | ✕ No | ✕ No |
| WebAuthn / passkeys | ✓ Yes | ✓ Yes |
| Biometric | ✓ Yes | ✓ Yes |
| Hardware security keys | ✓ Yes | ✓ Yes |
| SAML SSO | ✓ Yes | ✓ Yes |
| OIDC SSO | ✓ Yes | ✓ Yes |
| OAuth 2.0 SSO | ✓ Yes | ✓ Yes |
| Enterprise federation | ~ Partial | ✓ Yes |
| Passwordless-only flows | ✓ Yes | ✓ Yes |
| Adaptive MFA | ~ Partial | ✕ No |
| Step-up auth | ✓ Yes | ~ Partial |
| Capability | Clerk | WorkOS |
|---|---|---|
| RBAC | ✓ Yes | ✓ Yes |
| ABAC | ✕ No | ~ Partial |
| ReBAC | ✕ No | ✓ Yes |
| FGA engine | ✕ No | ✓ Yes |
| API authorization | ✓ Yes | ✓ Yes |
| Fine-grained permissions | ~ Partial | ✓ Yes |
| Capability | Clerk | WorkOS |
|---|---|---|
| Self-service registration | ✓ Yes | ✓ Yes |
| Progressive profiling | ✓ Yes | ✕ No |
| Self-service account | ✓ Yes | ✓ Yes |
| Bulk user import | ✓ Yes | ✓ Yes |
| Admin user search | ✓ Yes | ✓ Yes |
| Custom user metadata | ✓ Yes | ✓ Yes |
| Organizations / tenants | ✓ Yes | ✓ Yes |
| Multi-tenancy | ✓ Yes | ✓ Yes |
| SCIM provisioning | ✓ Yes | ✓ Yes |
| Capability | Clerk | WorkOS |
|---|---|---|
| REST API | ✓ Yes | ✓ Yes |
| GraphQL API | ✕ No | ✕ No |
| SDKs | 9 listed | 11 listed |
| CLI | ✓ Yes | ✕ No |
| Terraform provider | ✕ No | ✓ Yes |
| Local emulator | ✕ No | ✕ No |
| Extension model | Webhooks + JWT templates | Webhooks |
| Capability | Clerk | WorkOS |
|---|---|---|
| Bot detection | ✓ Yes | ✕ No |
| Breached password detection | ✓ Yes | ✓ Yes |
| Brute-force protection | ✓ Yes | ✓ Yes |
| Anomaly detection | ~ Partial | ~ Partial |
| Log streams | ~ Partial | ✓ Yes |
| Audit logs | ✓ Yes | ✓ Yes |
| GDPR data export | ✓ Yes | ✓ Yes |
| PII minimization | ~ Partial | ~ Partial |
| Post-quantum roadmap | ✕ No | ✕ No |
| Capability | Clerk | WorkOS |
|---|---|---|
| MCP support | ~ Partial | ~ Partial |
| OAuth 2.1 | ✓ Yes | ✓ Yes |
| Dynamic client registration | ✕ No | ✓ Yes |
| Agent vs human token separation | ✕ No | ✕ No |
| Web Bot Auth | ✕ No | ✕ No |
| Capability | Clerk | WorkOS |
|---|---|---|
| SOC 2 Type II | ✓ Yes | ✓ Yes |
| ISO 27001 | ✕ No | ✓ Yes |
| ISO 27018 | ✕ No | ✕ No |
| HIPAA | ~ Partial | ✓ Yes |
| PCI DSS | ✕ No | ✕ No |
| GDPR | ✓ Yes | ✓ Yes |
| CCPA | ✓ Yes | ✓ Yes |
| FedRAMP | ✕ No | ✕ No |
| EU data residency | ✓ Yes | ✓ Yes |
| Capability | Clerk | WorkOS |
|---|---|---|
| Consent management | ✕ No | ✕ No |
| Preference center | ~ Partial | ✕ No |
| Purpose-specific consent | ✕ No | ✕ No |
| Integrates with CMPs | n/a | n/a |
| Capability | Clerk | WorkOS |
|---|---|---|
| Multi-region deployment | ~ Partial | ✓ Yes |
| Data residency control | ~ Partial | ~ Partial |
| Proven at high scale (1M+ MAU) | ~ Partial | ~ Partial |
| Capability | Clerk | WorkOS |
|---|---|---|
| Password-hash import | ✓ Yes | ✓ Yes |
| Lazy / just-in-time migration | ~ Partial | ~ Partial |
| Account linking & dedup | ✓ Yes | ✓ Yes |
| Custom domains per brand | ~ Partial | ~ Partial |
| Per-brand theming of all flows | ~ Partial | ~ Partial |
| Per-brand consent partitioning | ✕ No | ✕ No |
| Deletion webhooks / cascade | ~ Partial | ~ Partial |
| Event streaming / webhooks | ~ Partial | ~ Partial |
| Documented rate limits | ~ Partial | ~ Partial |
FAQ
- Can Clerk replace WorkOS for enterprise SSO?
- For common IdPs (Okta, Entra, Google Workspace) and a modest connection count, Clerk Organizations plus B2B SSO is enough. For the long tail of SAML, per-customer Admin Portal, and Directory Sync as a product, WorkOS still leads. The WorkOS blog's 2026 three-way is vendor copy; Compass's matrix agrees on the B2B depth split and disagrees that Clerk cannot sell upmarket at all.
- Which is cheaper?
- Clerk under ~100k MAU if you are not buying SSO connections. WorkOS at B2B scale, because AuthKit is free to 1M MAU and you pay for SSO/SCIM per org. Model both at your tenant count, not your registered-user count.
- Should a Next.js app start on Clerk or WorkOS?
- Clerk, unless the first ten customers already demand SAML. You can add WorkOS later for the enterprise layer, or you can stay on Clerk Organizations if the IdP set stays common. Starting on WorkOS and then missing consumer UX is the more expensive rewrite.
- Do I need both?
- Some teams run Clerk for login UI and WorkOS for SSO/SCIM. That is a real architecture, not a meme, and it is two vendors to operate. Try Clerk Organizations first. Add WorkOS when a named deal requires Directory Sync or an Admin Portal Clerk will not grow into.
Clerk is how a Next.js team ships login this week. WorkOS is how a B2B team closes the enterprise deal next quarter. The overlap is Organizations. The split is who the user is.
Choose Clerk when the app is React, the first login has to look designed, and enterprise SSO is a later problem. Choose WorkOS when SSO, SCIM, and audit logs are the product requirement, and you can live without Clerk's consumer factor catalog.
If you need both polished login and deep SSO, demo Clerk Organizations before you pay for two platforms. If you need neither and you need passkeys, look at Stytch.
Profiles: Clerk, WorkOS. Three-way: WorkOS vs Auth0 vs Clerk.