What does 'kavachOS' mean?

kavachOS is a portmanteau of 'kavach' (Sanskrit for 'armor') and 'OS' (operating system). The name describes the library's role: an operating layer that shields every identity, call, token, and delegation in an application.

How is 'kavach' pronounced?

Ka-vach. In Sanskrit (कवच), it means 'armor': the layered, protective armor warriors wore into battle.

A TypeScript library for authentication and authorization, covering both AI agents and human users. It provides identity, permissions, delegation chains, audit trails, and MCP OAuth 2.1 in a single package. MIT licensed, edge-native.

00/kavachOS vs WorkOS

KavachOS vs WorkOS

WorkOS has a polished enterprise auth API and strong DX. KavachOS covers the same enterprise ground — SSO, SCIM, organizations — and adds agent identity and MCP OAuth 2.1 without per-connection fees.

Managed SaaSkavachOS · MIT

01/Why people land on this page

What usually triggers the switch from WorkOS.

We pulled the three reasons teams give us most often when they contact us.

Enterprise SSO at $125/connection/month adds up fast
WorkOS AuthKit is free up to 1 million MAU, but each enterprise SSO connection costs $125/month. A mid-size B2B SaaS with 20 enterprise customers is paying $2,500/month just for SSO connections. KavachOS includes enterprise SSO on the Growth plan at $79/month.
No agent identity or MCP OAuth
WorkOS focuses entirely on human authentication and enterprise provisioning. There is no AI agent token primitive, no delegation chain, and no MCP OAuth 2.1 support. These are core KavachOS features, not roadmap items.
WorkOS is not open source
WorkOS is a proprietary SaaS with no self-hosting option. KavachOS is MIT-licensed — self-host it on your own infrastructure or use KavachOS Cloud. Either way, you are not locked into a single vendor.

02/Where they beat us

WorkOS wins these. We are saying so out loud.

If any of these matter more than the reasons above, stay on WorkOS. The migration will still be here when the trade-off flips.

WorkOS is better at

WorkOS has a longer track record

WorkOS has been in production at more companies for more years. If that history is load-bearing for your buyer, weigh it heavily.

WorkOS is better at

Their docs and community are larger

More Stack Overflow answers, more third-party tutorials, more hiring pool who already know it.

03/Side by side

The facts on one row each.

No checkmark theater. Each row is a value you can verify against the public docs on either side.

Row

kavachOS

WorkOS

AI agent identity
WorkOS has no agent token primitive
Yes
No
MCP OAuth 2.1
KavachOS is spec-compliant; WorkOS has no MCP support
Yes
No
Agent delegation chains
Yes
No
Agent permission scoping
Yes
No
Agent audit log
Yes
No
Self-hosting
WorkOS is SaaS-only
Yes
No
Open source (MIT)
WorkOS is proprietary
Yes
No
Social / OAuth providers (27+)
Yes
Yes
Passkeys / WebAuthn
Yes
Yes
Magic link
Yes
Yes
Multi-factor authentication
Yes
Yes
Enterprise SSO (SAML, OIDC)
WorkOS charges $125/connection/month for SSO
Yes
Yes
SCIM provisioning
WorkOS includes SCIM but charges per connection
Yes
Yes
Organizations / multi-tenancy
WorkOS organizations are a core feature
Yes
Yes
Machine-to-machine tokens
WorkOS focuses on human auth, not M2M
Yes
No
Custom domains
Yes
Yes
Custom email templates
Yes
Yes
Brute force protection
Yes
Yes
Breach password detection
Yes
No
Free tier
WorkOS AuthKit free up to 1M MAU, but SSO costs extra
Yes
Yes
Cloudflare Workers runtime
Yes
No

04/Pricing

Run the number you actually care about.

Everyone argues about pricing in the abstract. Pick the MAU count that matches next quarter and compare the two columns. Ignore the rest.

WorkOS

WorkOS AuthKit is free up to 1 million MAU for human auth (social, magic link, MFA). The catch is enterprise features: each SSO connection costs $125/month, each SCIM directory sync connection also costs $125/month, and fine-grained authorization (FGA) is priced separately. A B2B product with 10 enterprise customers is paying $1,250/month in connection fees before any other costs.

AuthKit
1,000,000 MAU
Social, magic link, MFA. No SSO or SCIM included
$0
Enterprise SSO
Unlimited MAU
Per SAML or OIDC connection. Scales linearly with customer count
$125/connection/mo
Directory Sync (SCIM)
Unlimited MAU
Per directory connection on top of SSO costs
$125/connection/mo
Enterprise
Custom MAU
Volume discounts, SLA, dedicated support
Custom

kavachOS

KavachOS Cloud includes enterprise SSO and SCIM in the flat monthly tier — no per-connection fees.

Free
1,000 MAU
Full feature access, no credit card
$0
Starter
10,000 MAU
Agent identity included
$29/mo
Growth
50,000 MAU
SSO, SCIM, priority support
$79/mo
Scale
200,000 MAU
SLA, dedicated support
$199/mo
Enterprise
Unlimited MAU
On-prem, custom contracts
Custom

05/Migration

Most of the port is an import path change and a middleware swap.

Before · WorkOS

// Your existing WorkOS integration
// See the full comparison on the rewritten
// pages for a code-level diff.

After · kavachOS

import { kavachos } from "kavachos";

export const auth = kavachos({
  adapter: /* your db */,
  providers: [/* same set you already had */],
});

Step 01

Export your WorkOS users using the WorkOS Users API

Export your WorkOS users using the WorkOS Users API. KavachOS accepts the exported JSON through the import CLI command — social login connections migrate without requiring users to re-authenticate.

Step 02

Replace the WorkOS SDK with `kavachos` in your project

Replace the WorkOS SDK with `kavachos` in your project. Both follow OAuth 2.0 / OIDC conventions for SSO and session management, so the integration pattern is familiar.

Step 03

Re-create your SSO connections in the KavachOS dashboard

Re-create your SSO connections in the KavachOS dashboard. Copy the SAML metadata or OIDC discovery URLs from your existing IdP configurations — the same identity providers are supported.

Step 04

Update your environment variables — swap `WORKOS_API_KEY` and related config for the KavachOS project key and API URL from the dashboard

Update your environment variables — swap `WORKOS_API_KEY` and related config for the KavachOS project key and API URL from the dashboard.

Step 05

Migrate your SCIM directory sync connections by updating the provisioning endpoint URLs in your customers' IdP admin panels from the WorkOS endpoint to your KavachOS project endpoint

Migrate your SCIM directory sync connections by updating the provisioning endpoint URLs in your customers' IdP admin panels from the WorkOS endpoint to your KavachOS project endpoint.

06/Decide in thirty seconds

Two columns. Honest test.

Stay on WorkOS

workos has a longer track record
their docs and community are larger

Switch to kavachOS

enterprise sso at $125/connection/month adds up fast
no agent identity or mcp oauth
workos is not open source

07/FAQ

Questions people actually ask before they switch.

Short answers. Link to the docs if the long version matters.

WorkOS AuthKit is free up to 1 million MAU. KavachOS free tier caps at 1,000. Why is KavachOS cheaper?

WorkOS AuthKit's free tier is a customer acquisition tool for their enterprise SSO product. The moment you need SAML, you are paying $125 per connection per month — and that scales directly with your customer count. KavachOS charges a flat monthly fee that includes SSO. For a product with more than one enterprise customer, KavachOS is typically less expensive.

Does KavachOS match WorkOS on enterprise SSO and directory sync quality?

KavachOS supports SAML and OIDC enterprise SSO and SCIM directory provisioning. WorkOS has been doing this longer and has a larger set of tested IdP integrations. If deep IdP compatibility is your primary concern, evaluate both carefully. KavachOS is a younger product that is catching up quickly.

Is KavachOS open source like WorkOS is not?

Yes. KavachOS is MIT-licensed and the full source is on GitHub. WorkOS is a closed proprietary API. If you need to inspect the code, run it on your own infrastructure, or avoid vendor lock-in, KavachOS is the only option between the two.

WorkOS has a great developer experience. How does KavachOS compare?

KavachOS ships with a TypeScript-first SDK, generated types, a clean dashboard, and CLI tooling. The DX is a priority, not an afterthought. WorkOS deserves credit for setting a high bar in this space, and we have taken notes.

What is agent identity and why does it matter for B2B products?

As AI features ship inside B2B products, the agents running those features need their own identities. You need to know which agent accessed which customer data, revoke individual agent tokens, and enforce per-agent permission scopes. WorkOS has no primitive for this — you end up using API keys, which have no delegation model and no audit trail. KavachOS gives each agent a proper cryptographic identity.

Can I use KavachOS just for agent auth and keep WorkOS for human auth?

You can, but running two auth systems doubles the integration surface and means the delegation chain between humans and their agents is split across two products. Most teams consolidate on KavachOS so everything is visible in one place.

Try the WorkOS → kavachOS migration on a branch first.

Switch story · WorkOS → kavachOS

The library is MIT so there's no vendor meeting involved. Install it, run the migration on a scratch branch, keep the diff small, decide on evidence.

Join early access Read the migration guide Read the source Back to all comparisons