Clerk vs WorkOS vs Kinde: B2B SaaS authentication for Next.js (2026)

The quick answer (2026)

If you are picking a managed authentication provider for a Next.js SaaS in 2026, the three names that keep coming up together are Clerk, WorkOS AuthKit, and Kinde. All three give you hosted or embedded login, social providers, passkeys, MFA, and enterprise SSO, and all three ship an official Next.js App Router SDK. The real decision is not the login box. It is how each one charges you, and which point on the "build vs buy" curve your product is actually on.

• 

  Clerk is the fastest way to get a polished, prebuilt auth UI into a React and Next.js app, and it now bills on retained users, not raw signups. Pick it when developer experience and drop-in components matter most and your user base is consumer-shaped.

• 

  WorkOS AuthKit gives away the first 1,000,000 monthly active users and makes its money on enterprise SSO and Directory Sync connections. Pick it when you are selling to enterprises and the thing you actually need is clean SAML, SCIM, and admin portals.

• 

  Kinde is the predictable flat-tier option that bundles organizations, billing, and unlimited enterprise SSO into a fixed monthly plan. Pick it when you want one bill and no per-connection surprises as you add B2B customers.

If you would rather own the code and self-host, that is a different question, and it is the one we answer in our open-source auth comparison (Better Auth vs Auth.js vs Supabase Auth). This piece is about the three managed providers you would buy.

At a glance (August 2026)

Figures from each vendor's own pricing page, checked August 2026. The columns that decide most real projects are the middle two, so start there.

The one number that actually decides it: how each one charges

Every auth vendor will happily show you a login screen that looks the same. Where they diverge, and where teams get surprised six months in, is the billing unit. In 2026 these three do not even agree on what a "user" is.

Clerk bills on MRU, not MAU. Clerk's free Hobby plan covers 50,000 monthly retained users. An MRU is a user who comes back after their first session, so one-off signups and bots that never return do not count against you the way a raw MAU count would. The Pro plan is $25/mo (or $20/mo billed annually) and keeps the 50,000 allowance, after which each additional retained user is $0.02/mo with volume discounts at scale. This retained-user model is genuinely friendlier for consumer apps with a long tail of dormant accounts, and it is the single most misunderstood line in auth pricing. See Clerk's pricing page for the current tiers.

WorkOS gives away 1,000,000 MAU, then charges for enterprise plumbing. AuthKit is free up to one million monthly active users, and each additional million MAU is $2,500/mo. That headline free tier is enormous, but it is not where WorkOS earns revenue. The money is in enterprise connections: SSO is $125/month per connection for the first 1 to 15 connections, sliding down to $50 each at 101 to 200 and custom above that, and Directory Sync (SCIM) is priced on the same tiered per-connection schedule. So AuthKit is close to free for a self-serve product and scales in cost precisely as you sign enterprise logos. WorkOS pricing lays out the connection tiers in full.

Kinde bills on MAU but sells predictability. The free tier is 10,500 MAU. Paid plans are flat: Pro at $25/mo, Plus at $75/mo, and Scale at $250/mo, each including the same 10,500 MAU with overage from $0.0175/MAU on Pro down to $0.0151/MAU on Scale. The important detail for B2B is that enterprise SSO is unlimited and included from the Plus plan up, with no per-connection fee, and organizations are bundled (50 monthly active organizations included on paid tiers, then $0.50 per extra). Kinde also runs a small transaction fee (0.7% down to 0.5%) if you use its billing features. Kinde's pricing shows the full tier table.

The practical read: a consumer app with lots of dormant accounts is usually cheapest on Clerk's MRU model; an enterprise product that lives or dies on SSO is usually cheapest and cleanest on WorkOS until connection counts explode; and a B2B SaaS that wants unlimited SSO for a fixed, forecastable number is usually happiest on Kinde Plus.

How each one drops into a Next.js app

All three publish an official App Router SDK, and all three have already handled the Next.js 16 change where middleware moves to proxy.ts (Next.js 15 and earlier keep middleware.ts). Where they differ is whether you get embedded components or a hosted redirect, and how much of the UI you own.

Clerk is still the most React-native of the three. You wrap the tree in , drop and `` where you want them, call await auth() in a server component, and you are done. If your team values pixel-level control inside your own layout, Clerk gives you the most without leaving your app.

WorkOS AuthKit takes the hosted approach: getSignInUrl() sends the user to an AuthKit-hosted page, handleAuth() receives the callback, and withAuth() reads the session server-side. You trade some UI ownership for a smaller surface area and for SSO/SCIM that is genuinely first-class rather than bolted on. The @workos-inc/authkit-nextjs SDK is explicitly App-Router-first.

Kinde sits in the middle: a hosted auth page by default, plus and helpers and getKindeServerSession() for server-side reads. Its App Router support is solid, and the organizations and feature-flag primitives are wired into the same SDK, which is part of why it appeals to founders who want fewer moving parts.

Enterprise SSO and B2B organizations: the axis that flips the decision

For a purely consumer product, all three are fine and the pricing model decides it. The moment you sell to businesses, two features dominate: enterprise SSO (SAML, OIDC, and increasingly OIDC-based "enterprise connections") and multi-tenant organizations with roles.

• WorkOS was built for exactly this. SSO, Directory Sync (SCIM), and admin portals are the product, not an add-on, which is why enterprise buyers and their IT teams tend to have the smoothest onboarding. The cost is per connection, so it scales with the number of enterprise customers you land.
• Kinde bundles unlimited enterprise SSO from Plus ($75/mo) upward and includes 50 monthly active organizations on paid tiers. If you expect to onboard many small-to-mid B2B customers who each want SSO, the flat unlimited-connection model is often dramatically cheaper than per-connection pricing.
• Clerk now ships enterprise connections too (EASIE, SAML, OIDC), with one connection included in Pro and additional connections at $75/each, sliding to $15/each at very high counts. Organizations are included (100 monthly active organizations free), with an Enhanced add-on at $100/mo for unlimited members per organization and custom roles.

A useful rule of thumb: count how many distinct SSO connections you realistically expect in twelve months. If it is a handful of large enterprises, WorkOS's per-connection model is clean and its tooling is best-in-class. If it is dozens of smaller B2B tenants each wanting SSO, Kinde's unlimited-on-a-flat-plan model usually wins on cost. Clerk lands in between and is the pick when the React DX is the thing you care about most. For the Auth0-anchored version of this same enterprise question, we go deeper in Clerk vs Auth0 vs WorkOS.

The honest "build" alternative

None of these three is open source. You are renting identity, and you are accepting some lock-in in exchange for not owning the security burden. That is usually the right trade for a small team, but it is worth naming. If data residency, cost at scale, or zero vendor lock-in are hard requirements, the open-source route (Better Auth or Auth.js self-hosted) is a real option, and we compare those head to head separately. The tradeoff there is the mirror image: you own the code and the cost curve, but you also own patching, SSO/SCIM implementation, and compliance work that WorkOS in particular hands you for free.

Where each one loses

No honest comparison is all upside. Here is where each of the three genuinely frustrates teams in 2026.

• 

  Clerk cost can still climb once you exceed the free retained-user allowance and start stacking add-ons (the Enhanced organizations add-on, extra SSO connections). SCIM/Directory Sync is weaker than WorkOS's, so pure-enterprise buyers sometimes outgrow it. The MRU model, while friendly, takes a minute to forecast.

• 

  WorkOS AuthKit hands you less UI control because the auth experience is hosted and redirect-based, which some teams dislike. And the per-connection SSO pricing, while fair for a few big customers, adds up fast if you land many small tenants who each demand SSO.

• 

  Kinde is the youngest and smallest of the three, so its ecosystem, community answers, and third-party integrations are thinner. Some advanced organization and MFA features are gated to Plus and Scale, and the transaction fee on its billing feature is a line item to watch if you lean on it.

So which should you ship?

The mistake to avoid is choosing on the login screen. All three look great. Choose on the billing unit (MRU vs MAU), on whether you need embedded UI or hosted is fine, and on how many enterprise SSO connections you expect in the next year. Get those three right and any of these will serve a Next.js SaaS well in 2026.