WorkOS vs. Duende IdentityServer
WorkOS is a hosted platform of enterprise-readiness APIs for SaaS products: AuthKit for sign-in and user management, SSO connections to your customers' identity providers, Directory Sync (SCIM), and an Admin Portal for customer IT teams. Duende IdentityServer is an OpenID Connect and OAuth framework you host in your own ASP.NET Core application, with SAML and user management as first-party options. Choose WorkOS for fast enterprise SSO and SCIM without running identity infrastructure. Choose Duende IdentityServer for a token server, user experience, and user data that you own as part of your .NET system.
WorkOS is a hosted service. Your application calls the WorkOS API, and WorkOS handles the handshake with each customer's identity provider over SAML or OIDC. Its standalone SSO API leaves your user database to you, while AuthKit adds sign-in and user management if you want WorkOS to hold the users too. Duende IdentityServer sits at a different layer. It is the authorization server that issues the tokens your own apps and APIs trust, hosted in your own ASP.NET Core identity host. It can also sign users in through your customers' OIDC or SAML identity providers using dynamic providers, so the products overlap on enterprise SSO but have different architectures.
This comparison was updated November 10, 2026, against the current WorkOS pricing page and documentation (WorkOS does not publish version numbers for its hosted service). Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do WorkOS and Duende IdentityServer Compare?
| Capability / Specification | WorkOS | Duende IdentityServer |
|---|---|---|
| Operating model | Hosted service; you call its API | Self-hosted in an ASP.NET Core host you own |
| Primary role | OpenID Connect and OAuth server that issues tokens for your apps and APIs | |
| Login UI | You build the login UI yourself (SDK APIs plus samples) | |
| Enterprise SSO with customer IdPs | SAML and OIDC connections, priced per connection | |
| SCIM / directory provisioning | Directory Sync, priced per connection | Inbound SCIM 2.0 service provider in User Management |
| Customer self-serve IT setup | Admin Portal for domains, SSO, and Directory Sync | Not part of IdentityServer; build or integrate separately |
| User store | AuthKit, or your own database with the SSO API | Your database (such as ASP.NET Core Identity) or User Management |
| MFA / passwordless | AuthKit: passkeys, MFA, Magic Auth | User Management: passkeys, TOTP, OTP, recovery codes |
| Tokens for your own apps and APIs | WorkOS Connect: OAuth and M2M applications | Core product: OAuth/OIDC token issuance, clients, scopes, and resources |
| MCP authorization | AuthKit as authorization server; Client ID Metadata Documents and DCR | Code-first quickstart; pre-registration and DCR (DCR in Standard and Advanced) |
| Authorization model | Scopes and claims you issue; policy lives in your APIs | |
| Audit logs | Audit Logs with export and SIEM streaming; 30-day default retention; extended retention priced per 1M events | Security events sent to sinks you choose; you own storage and retention |
| Sender-constrained tokens (DPoP / mTLS) | Not verified in the WorkOS docs reviewed | |
| Signing keys | Managed by WorkOS | Automatic key management (included in Advanced; add-on for Standard) |
| Pricing model | Usage-based: SSO and Directory Sync per connection; AuthKit free to 1M MAUs | Lite, Standard, Advanced, and Custom plans by capacity; not priced per SSO connection (pricing) |
WorkOS charges $125 per connection for connections 1 to 15, falling to $65 for connections 51 to 100. AuthKit is free for the first 1 million monthly active users, then $2,500 per additional 1 million monthly active users. Duende plans are based on Connected Apps (OAuth/OIDC clients and SAML service providers), production deployments, and User Management identities; dynamic upstream IdPs do not count as Connected Apps. Development and testing are free. Community Edition is free for for-profit organizations with under $1M USD projected annual gross revenue and under $3M USD in capital access, or non-profits with a published annual budget under $1M USD; it covers running IdentityServer on your own infrastructure for your own applications, including serving your own customers, but not redistribution or building identity for an end customer's infrastructure.
How Do WorkOS Concepts Map to Duende IdentityServer?
| WorkOS | Duende IdentityServer | Notes |
|---|---|---|
| Organization | Your tenant model, or multi-tenancy | You model organizations in your own data; the Multi-Tenancy add-on (multiple issuers) is Advanced and Custom only |
| SSO connection (SAML or OIDC) | One stored configuration per customer IdP; dynamic providers are Advanced; SAML is included in Advanced and an add-on for Standard | |
| Directory (Directory Sync) | Inbound only; users and groups are stored in User Management | |
| Admin Portal | Admin UI you build or integrate | Back-end code can use the User Management admin interfaces |
| AuthKit | Your login UI plus User Management | Hosted UI or UI you own through the AuthKit API, versus UI you own and host |
| Connect OAuth application | Client using authorization code flow | Redirect URIs, secrets, and allowed scopes are client settings |
| Connect M2M application | Client using client credentials | Machine-to-machine access for partner or customer services |
| RBAC roles and permissions | Claims and scopes you issue | Role data comes from your user store and profile service |
When Is WorkOS the Right Fit for You?
WorkOS is the faster path for a SaaS team that needs to say yes to enterprise customers. A customer's IT team can verify its domain and configure SAML or OIDC SSO and Directory Sync through the Admin Portal without high-touch support from your team. WorkOS documents integrations for providers such as Okta, Workday, and Google Workspace. It also suits teams that do not want to run identity infrastructure, or whose backend is not .NET. A customer admin portal is not part of IdentityServer, so you would build or integrate one.
Duende IdentityServer fits when your team works in .NET and wants an authorization server that is part of your own system: an ASP.NET Core project, configured in code, tested with your test suite, and deployed by your pipeline. It issues tokens for all your apps and APIs, and it runs wherever you deploy it, which matters when data location or compliance rules out a shared hosted service.
How Do You Migrate to Duende IdentityServer?
WorkOS releases password hashes only on request: you email WorkOS support and receive a CSV through a secure file transfer. Passwords set in WorkOS are bcrypt at cost 10, and imported hashes keep their original format, including bcrypt, scrypt, argon2, or PBKDF2. SSO-only, social, and Magic Auth users have no hash. Implement a custom IPasswordHashAlgorithm for those formats, and User Management can re-hash to your preferred algorithm on the next login. Each customer SSO connection becomes a dynamic provider configuration, and each customer's IT team must repoint its identity provider. SCIM directory connections can be repointed at an inbound SCIM endpoint; API-based integrations such as Workday need replacement connectors. The migration approaches post has more details.