WorkOS
WorkOS sells enterprise authentication building blocks, including a hosted sign-in product (AuthKit), SAML and OIDC single sign-on, SCIM directory sync, and audit logs.
Free tier for user management up to a high monthly-active-user threshold, then usage-based; enterprise SSO and directory sync billed per connection per month with volume discounts, plus an optional prepaid annual credits plan.
Proprietary
Appears in 1 guide
Where it ranks
Guides that include WorkOS.
Security headers
What WorkOS's website sends to your browser.
Scanned 2026-08-25. Grade headers D, scoring 40 out of 100.
+
Content-Security-Policy is set
−
No Strict-Transport-Security, so browsers may still attempt plain HTTP
−
No X-Content-Type-Options, so MIME sniffing is not disabled
+
X-Frame-Options is set
−
No Referrer-Policy, so full URLs may leak to third parties
−
No Permissions-Policy, so powerful browser features are not restricted
−
No Cross-Origin-Opener-Policy
−
No Cross-Origin-Resource-Policy
+
No server-version or X-Powered-By disclosure
This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.