This comparison is part of our MCP comparisons, within The MCP Guide. Facts are checked against each vendor's own documentation and pricing pages on the date shown.
Pick Scalekit if you want a dedicated MCP auth layer with a client registry, per-request event log and one-click revocation at a flat monthly price. Pick WorkOS if you expect many users and want AuthKit's free tier of 1 million monthly active users, or you already use WorkOS for enterprise SSO. Both act as the OAuth server for your MCP server and both can keep your existing login.
Checked against: Scalekit's MCP Auth page and WorkOS AuthKit MCP docs on 28 October 2026. eSEOspace did not test either product.
Both vendors fill the authorization server role from the MCP authorization spec. Your MCP server stays the resource server and checks tokens. The differences are in admin tooling, enterprise features and how you pay.
Key Takeaways
- Scalekit describes MCP Auth as an OAuth 2.1 layer that works with your existing login; WorkOS offers the same pattern as Standalone Connect.
- Both support Client ID Metadata Documents (CIMD) and Dynamic Client Registration (DCR); WorkOS ships CIMD off by default.
- Scalekit lists a client registry, an event timeline that can stream to a SIEM, and one-click grant revocation.
- Scalekit's MCP Auth comes with the $99 per month SaaSKit Growth plan, or as a $99 add-on to BYOA Growth.
- WorkOS AuthKit is free to 1 million MAUs and does not list a separate MCP price.
At a glance
| Scalekit MCP Auth | WorkOS AuthKit MCP Auth | |
|---|---|---|
| Role | OAuth 2.1 authorization server | OAuth authorization server |
| Keep existing login | Yes, bring your own auth | Yes, Standalone Connect |
| Client types | Dynamic, CIMD and pre-registered | CIMD (off by default) and DCR |
| Enterprise IdP access | Cross-App Access (XAA), Enterprise plan | Cross App Access, early access |
| Client registry and event log | Yes, events can stream to a SIEM | Audit Logs product, priced separately |
| Revocation | One-click per grant | Not documented on the MCP page |
| Deployment | Cloud managed, VPC or on-prem | Hosted service |
| Free tier | SaaSKit Free (MCP Auth not listed) | AuthKit free to 1M MAUs |
| Paid entry with MCP | $99/mo Growth | No separate MCP price listed |
Where Scalekit is stronger
MCP-specific admin tools. Scalekit's MCP Auth page lists a client registry that shows which clients connect and how often. Its event timeline records each auth request, including requester, method, consent and token issuance, and can stream to a SIEM. Any grant can be revoked in one click. These map well to MCP audit logging needs.
Bring your own auth by default. Scalekit says your current login, whether SSO, password or magic link, stays in place. Users are redirected to your login page, and your backend returns a subject ID to get a token. Scalekit then handles consent, token lifetime and refresh.
Deployment choices. The page lists cloud managed, VPC deployment and on-prem options. That can matter for regulated teams.
Gateway-friendly tokens. Scalekit says its RS256-signed JWTs can be validated at gateways without a live call to Scalekit.
Predictable entry price. See Pricing below.
Where WorkOS is stronger
Free tier for scale. WorkOS's pricing page says "First 1 million monthly active users free" for AuthKit. Scalekit's SaaSKit Free plan has a hard cap of 25,000 MAUs.
Detailed resource-server docs. The AuthKit MCP docs explain resource indicators, which set the token audience to your MCP endpoint. They also show the WWW-Authenticate header with a resource_metadata URL for 401 responses. Wildcard resource indicators are supported.
Broader identity suite. WorkOS also sells SSO, Directory Sync and Audit Logs. If your SaaS app already uses them, MCP sign-in reuses the same platform.
Cross App Access. WorkOS lists it as early access, using ID-JAG token exchange by default. It is not supported with Standalone MCP Auth. See enterprise-managed authorization.
Pricing
Prices from each vendor's pricing page on 28 October 2026.
Scalekit (Auth for SaaS pricing):
- SaaSKit Free: $0, 25,000 MAUs (hard cap), 25 organizations, 1 SSO and 1 SCIM connection. MCP Auth is not listed.
- SaaSKit Growth: $99 per month, 100,000 MAUs, then $0.05 per extra user. Includes "MCP Auth with your branding."
- BYOA Growth: $99 per month, with MCP Auth as a $99 per month add-on.
- Enterprise: custom.
- The MCP Auth page says "a free plan is available," but the pricing table does not show MCP Auth on Free, so confirm with Scalekit.
WorkOS (pricing):
- AuthKit: free to 1 million MAUs, then $2,500 per month per extra million.
- SSO: $125 per connection per month for 1 to 15 connections.
- Audit Logs: $125 per month per SIEM connection and $99 per month per million retained events.
- No separate MCP Auth or Connect price is listed.
A simple rule of thumb from these numbers: under 100,000 users, Scalekit's flat $99 with MCP Auth included is easy to budget. WorkOS can cost nothing for sign-ins, but SSO connections and audit log streaming add up if you need them.
Security and admin controls
Scalekit. The registry, event timeline and one-click revocation give admins a direct view of which AI clients have access. Scalekit says CIMD helps prevent phishing at registration. Cross-App Access lets customers' identity providers authorize agents, set up once by an admin, on the Enterprise plan.
WorkOS. The WorkOS security page says it is "SOC 2 Type 2 certified" and "GDPR & CCPA compliant," and can sign HIPAA business associate agreements on enterprise plans. Turn CIMD on, since the docs say it "is off by default."
Your server's job either way. Verify issuer, audience, expiry and scopes on every request, and never pass client tokens through to upstream APIs. Read MCP token passthrough.
Which to choose
Pick Scalekit if:
- You want MCP-focused admin tools: client registry, event timeline and revocation.
- You need VPC or on-prem deployment.
- You prefer a flat monthly price with MCP Auth included.
Pick WorkOS if:
- You expect a large number of users and want AuthKit's free MAUs.
- You already use WorkOS for SSO or Directory Sync.
- You want detailed resource-indicator controls, including wildcards.
Compare Auth0 too if your server must call third-party APIs for users. See WorkOS vs Auth0 for MCP.
Next step
Before you pick, list how many users, which AI clients and which enterprise customers your server will serve. eSEOspace helps teams set this up through MCP development and our MCP readiness audit. See all MCP comparisons.
Frequently asked questions
Do Scalekit and WorkOS both support CIMD?
Yes. Scalekit's MCP Auth page lists Dynamic, CIMD and pre-registered clients. WorkOS supports CIMD and DCR, with CIMD off by default. The 2026-07-28 MCP spec deprecated DCR in favor of Client ID Metadata Documents.
Can I keep my current login with either one?
Yes. Scalekit calls it bring your own auth, and WorkOS calls it Standalone Connect. In both, users sign in on your login page and the vendor issues the MCP tokens.
Is MCP Auth free on Scalekit?
The MCP Auth page says a free plan is available, but the pricing table we opened lists MCP Auth only on SaaSKit Growth ($99 per month) and as a $99 add-on for BYOA Growth. Ask Scalekit what the Free plan includes.
Which is better for enterprise customers?
Both list Cross App Access, which lets a customer's identity provider authorize agents. Scalekit puts it on the Enterprise plan, and WorkOS lists it as early access. Ask each vendor which identity providers they support today.
