{"jtbd":{"id":"enterprise-sso","slug":"enterprise-sso","name":"Enterprise SSO / SCIM","shortName":"Enterprise SSO / SCIM","problemStatement":"Close enterprise deals that require Okta/Azure AD SSO and directory sync."},"pick":{"id":"workos","slug":"workos","name":"WorkOS","tagline":"When your first big customer asks for Okta SSO tomorrow, WorkOS is how you say yes without a rewrite.","website":"https://workos.com","overall":8.49,"scoreBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"scoreLayers":{"editorialPrior":8.49,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"Enterprise SSO/Directory Sync/Audit Log APIs; per-connection and MAU-style packaging.","scores":{"capabilityFit":9.2,"pricePerformance":7.5,"latencyReliability":9,"developerDx":9.4,"privacyPosture":8.8,"lockInRisk":4.5,"maturity":8.5,"overall":8.49,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}},"runnersUp":[{"id":"auth0","slug":"auth0","name":"Auth0 (Okta)","tagline":"Enterprise identity Swiss Army knife. For startups, Clerk/WorkOS usually hurt less.","website":"https://auth0.com","overall":7.93,"scoreBand":{"low":7.3,"mid":7.9,"high":8.5,"halfWidth":0.6,"basis":"editorial_prior","display":"7.3–8.5 (editorial prior)"},"scoreLayers":{"editorialPrior":7.93,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"MAU and enterprise contracts; extensive IdP ecosystem; Okta-owned.","scores":{"capabilityFit":9.2,"pricePerformance":5.5,"latencyReliability":9.2,"developerDx":7.5,"privacyPosture":8.8,"lockInRisk":7,"maturity":9.6,"overall":7.93,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}},{"id":"clerk","slug":"clerk","name":"Clerk","tagline":"Depot default auth for agent products with users. WorkOS when enterprise SSO is the main job.","website":"https://clerk.com","overall":8.23,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.23,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-10-19","pricingNotes":"Bills monthly retained users (MRU: a user who returns at least one day after signing up), not MAU (https://clerk.com/pricing, fetched 2026-10-21): Hobby free up to 50,000 MRU per app; Pro $25/mo and Business $300/mo include 50,000 MRU per app, then graduated $0.02 / $0.018 / $0.015 / $0.012 per MRU; 1 SSO connection included on paid plans, then $75 / $60 each (101+ contact us). B2B Authentication add-on $100/mo; beautiful prebuilt UIs.","scores":{"capabilityFit":9,"pricePerformance":8,"latencyReliability":9,"developerDx":9.8,"privacyPosture":8.2,"lockInRisk":6.5,"maturity":8.5,"overall":8.23,"kind":"curated_estimate","confidence":"high","asOf":"2026-10-19"}},{"id":"stytch","slug":"stytch","name":"Stytch","tagline":"Auth pick when agents/M2M + org SSO matter more than Clerk's consumer UI kit. Watch Twilio integration…","website":"https://stytch.com","overall":8.21,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.21,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"As of 2026-09-14 (stytch.com/pricing B2B): Pay as you go $0 base — 10,000 MAU/agents included, unlimited orgs, 5 SSO/SCIM connections ($125/extra), 1,000 M2M tokens, 10k fingerprints then $0.005 each; brand customization $99/mo. Enterprise quote (99.99% SLA, HIPAA/BAA). Note: Stytch joined Twilio (identity layer) — product/brand still live.","scores":{"capabilityFit":8.6,"pricePerformance":8.8,"latencyReliability":8.4,"developerDx":8.8,"privacyPosture":8.2,"lockInRisk":4.2,"maturity":8,"overall":8.21,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}}],"scoreBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"scoreLayers":{"editorialPrior":8.49,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"whyPickOverHigherScore":{"pickId":"workos","pickName":"WorkOS","pickScore":8.49,"highestScoredCandidateId":"workos","highestScoredCandidateName":"WorkOS","highestScore":8.49,"pickHasLowerCompositeScore":false,"delta":0,"pickLeadsOnDimensions":[],"explanation":"WorkOS (8.49) holds both the highest composite score among ranked candidates and the editorial pick for Enterprise SSO / SCIM: capability SSO/SCIM + dx + privacy."},"cheapest":null,"recommendedWorkloadQuote":null,"representativeQuote":null,"estimatedTaskCost":null,"freeAlternatives":[],"referenceDocs":[],"falsification":{"jtbdId":"enterprise-sso","jtbdName":"Enterprise SSO / SCIM","currentPickId":"workos","currentPickScore":8.49,"challengerId":"auth0","challengerScore":7.93,"currentScoreGap":0.56,"minVerifiedOutcomes":10,"requiredOutcomeMargin":0.71,"requiredSuccessRateDelta":0.15,"maxPickPriceIncreasePct":25,"whatWouldChangePick":["Auth0 (Okta) (auth0) outperforms WorkOS (workos) by >= 0.71 outcome points (or >= 15% worked-rate delta) across >= 10 Countersign-verified production outcomes.","A verified price increase > 25% on WorkOS's representative SKU for enterprise-sso without a corresponding capability gain.","Live caller rail exhaustion (?exhausted=workos) or sustained >= 30% degraded/failed rate in verified production outcomes."],"frozenHoldoutPolicy":{"holdoutSplit":"20% frozen benchmark holdout tasks + 80% live production outcome receipts","requireCountersignReceipt":true,"requiredEvidenceTiers":["outcome_verified","reference_checked"],"minDistinctContributors":2,"antiGamingRule":"Unverified self-reports and seed/editorial rows never mutate picks or scores."},"triggers":[{"kind":"verified_outcomes_outperformance","challengerId":"auth0","minVerifiedOutcomes":10,"requiredOutcomeMargin":0.71,"requiredWorkedRateDelta":0.15},{"kind":"verified_price_increase","providerId":"workos","maxPriceIncreasePct":25},{"kind":"live_rail_exhaustion_or_degradation","providerId":"workos","immediateOverrideUrl":"/api/decide?jtbd=enterprise-sso&exhausted=workos"}],"submissionSpec":{"falsifyEndpoint":"/api/falsify?jtbd=enterprise-sso","outcomesEndpoint":"POST /api/feedback","correctionsEndpoint":"POST /api/corrections","payloadTemplate":{"agentIdentity":"agent:<your-agent-id>","jtbdId":"enterprise-sso","providerId":"auth0","outcome":"worked","detail":"Comparative production evaluation on enterprise-sso (n>=10 tasks) with Countersign receipt.","confidence":"high","receipt":{"countersign":{"claim_id":"cs-00000000","status":"verified","evidence_tier":"outcome_verified","counts_as_verified":true}}}}},"whatWouldChangePick":["Auth0 (Okta) (auth0) outperforms WorkOS (workos) by >= 0.71 outcome points (or >= 15% worked-rate delta) across >= 10 Countersign-verified production outcomes.","A verified price increase > 25% on WorkOS's representative SKU for enterprise-sso without a corresponding capability gain.","Live caller rail exhaustion (?exhausted=workos) or sustained >= 30% degraded/failed rate in verified production outcomes."],"routePlan":{"jtbdId":"enterprise-sso","primary":{"providerId":"workos","name":"WorkOS","overall":8.49,"scoreBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"scoreLayers":{"editorialPrior":8.49,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"primary","reason":"Editorial Depot Pick for Enterprise SSO / SCIM; healthy/eligible under caller constraints."},"fallback":[{"providerId":"auth0","name":"Auth0 (Okta)","overall":7.93,"scoreBand":{"low":7.3,"mid":7.9,"high":8.5,"halfWidth":0.6,"basis":"editorial_prior","display":"7.3–8.5 (editorial prior)"},"scoreLayers":{"editorialPrior":7.93,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"fallback","reason":"Ranked fallback route for Enterprise SSO / SCIM."},{"providerId":"clerk","name":"Clerk","overall":8.23,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.23,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-10-19","role":"fallback","reason":"Ranked fallback route for Enterprise SSO / SCIM."},{"providerId":"stytch","name":"Stytch","overall":8.21,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.21,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"fallback","reason":"Ranked fallback route for Enterprise SSO / SCIM."}],"disqualified":[],"expectedRegret":{"scoreDeltaVsUnconstrainedPick":0,"unconstrainedPickId":"workos","activePrimaryId":"workos","summary":"0.00 score regret: unconstrained editorial pick satisfies all caller constraints."},"evidenceAgeDays":{"editorialScoreAgeDays":43,"pricingVerifiedAgeDays":0,"editorialPriorAsOf":"2026-09-14","pricingLastVerifiedAt":"2026-10-27"},"confidenceBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"constraintsApplied":false,"constraintBundle":{"task":null,"jtbd":"enterprise-sso","quotaExhausted":[],"degraded":[],"healthy":[],"budgetUsd":null,"maxLatencyMs":null,"region":null,"privacy":null,"exit":[],"existing":[]}},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","tie":false,"scoreGap":0.56,"decidingFactor":null,"tieNote":null,"rationale":"capability SSO/SCIM + dx + privacy.","whenNotTopPick":"Consumer-only app — Clerk without enterprise SSO yet.","skipTopPick":false,"skipReason":null,"matchedConstraints":[],"pricingSummary":"Enterprise SSO/Directory Sync/Audit Log APIs; per-connection and MAU-style packaging.","cite":"Depot Pick for enterprise-sso: workos (asOf 2026-09-14). See GET /api/jtbds/enterprise-sso + GET /api/methodology.","nextActions":[{"step":1,"title":"Inspect full JTBD + embeds","href":"/api/jtbds/enterprise-sso?embed=providers","why":"Confirm pick, runners-up, and methodology notes."},{"step":2,"title":"Quote sourced SKUs","href":"/api/quote?jtbd=enterprise-sso","why":"Depot Pick SKUs plus the cheapest sourced SKU whose unit matches this job. Does not change the pick. Does not blend input and output or borrow a chat rate for a non-chat job."},{"step":3,"title":"Open provider detail","href":"/api/providers/workos","why":"Scores, pricingNotes, strengths/weaknesses, communitySignals (claims only)."},{"step":4,"title":"Cite methodology","href":"/api/methodology","why":"Required when publishing a Depot Pick citation."},{"step":5,"title":"Grab badge SVG","href":"/api/badge?type=depot-pick&jtbd=enterprise-sso","why":"Embed in README / agent passport."},{"step":6,"title":"Post production insight","method":"POST","href":"/api/insights","why":"Unverified until curated; never auto-mutates official scores."}],"honesty":["Do not invent scores or benches.","Insights are claims until curated/reviewed; they never silently mutate official scores.","lockInRisk higher = more lock-in (worse).","normalizedUsdPerMillionTokens is set only for a single sourced token row. Otherwise null, with a machine-readable reason. Do not coerce GPU, minute, or per-1k search units.","Runners-up are not Depot Picks.","Depot overall is editorial_weighted, not Arena Elo and not an Artificial Analysis index."],"asOf":"2026-09-14","depth":{"whenNotToUse":{"text":"Consumer-only app — Clerk without enterprise SSO yet.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"auth0","name":"Auth0 (Okta)","overallForJob":7.93,"pickOverallForJob":8.49,"beatsPickOn":["latencyReliability","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":4.5,"runnerUpLockInRisk":7,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":[],"pickNotes":[],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up Auth0 (Okta) (4.5 vs 7).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"citation":{"text":"Agent Provider Depot (v0.12.151), Depot Pick for enterprise-sso: workos, scores as of 2026-09-14, retrieved 2026-10-27. https://getagentdepot.com/jtbds/enterprise-sso","markdown":"[Agent Provider Depot](https://getagentdepot.com/jtbds/enterprise-sso) (v0.12.151) — Depot Pick for `enterprise-sso`: **workos** (scores as of 2026-09-14, retrieved 2026-10-27)","fields":{"publisher":"Agent Provider Depot","version":"0.12.151","role":"depot_pick","jtbdId":"enterprise-sso","providerId":"workos","scoreAsOf":"2026-09-14","retrievedOn":"2026-10-27","page":"https://getagentdepot.com/jtbds/enterprise-sso","api":"https://getagentdepot.com/api/decide?jtbd=enterprise-sso"},"howToCite":"Cite Depot as an editorial, dated recommendation, not a benchmark: name the job, the Depot Pick (or runner-up), the score asOf date and the day you retrieved it, and link the job page. Format: “Agent Provider Depot (v{version}), Depot Pick for {jobId}: {providerId}, scores as of {scoreAsOf}, retrieved {retrievedOn}. {baseUrl}/jtbds/{jobId}”. Quote prices only with their own sourceUrl and asOf. If the pick's score is stale (freshness.pick.score.stale), say so."},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":1,"sourcesReachable":1,"pricingRows":0,"pricingRowsReconfirmed":0,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}},"scoreAsOf":"2026-09-14","editorialPriorAsOf":"2026-09-14","pricingLastVerifiedAt":"2026-10-27","pickLastReviewed":"2026-09-14","runnersUpScoreAsOf":["2026-09-14","2026-10-19","2026-09-14"],"contractAsOf":"2026-10-03","pricingShape":"prose_notes_only","normalizedUsdPerMillionTokens":null,"normalizationStatus":"unavailable","normalizationReason":"no_sourced_price"},"pricingContract":{"normalizedUsdPerMillionTokens":null,"normalizationStatus":"unavailable","normalizationReason":"no_sourced_price","shape":"prose_notes_only","filterable":false,"priceSortEligible":false,"priceSortKeyUsdPerMillionInputTokens":null,"rows":[],"notesExcerpt":"Enterprise SSO/Directory Sync/Audit Log APIs; per-connection and MAU-style packaging.","notesCheck":{"status":"no_known_contradiction","pairs":[],"review":null,"note":null},"lastReviewed":"2026-09-14","scoreAsOf":"2026-09-14","website":"https://workos.com","doNotParse":"Do not parse pricingNotes. Use rows only. normalizedUsdPerMillionTokens is a single number only when this provider has exactly one sourced token row. Input/output, context tiers, and non-token units stay null at this level.","gap":"No sourced price row for this provider. pricingNotes stay prose. See research/gaps.md."},"links":{"jtbd":"/jtbds/enterprise-sso","jtbdApi":"/api/jtbds/enterprise-sso","leaderboard":"/api/leaderboards?jtbd=enterprise-sso","methodology":"/api/methodology","badge":"/api/badge?type=depot-pick&jtbd=enterprise-sso","decide":"/api/decide?jtbd=enterprise-sso","humanPage":"/jtbds/enterprise-sso","alternatives":"/api/alternatives?provider=workos","canonical":"/api/canonical","quote":"/api/quote?jtbd=enterprise-sso","falsify":"/api/falsify?jtbd=enterprise-sso"},"constraintBundle":{"task":null,"jtbd":"enterprise-sso","quotaExhausted":[],"degraded":[],"healthy":[],"budgetUsd":null,"maxLatencyMs":null,"region":null,"privacy":null,"exit":[],"existing":[]},"stackContext":{"host":null,"framework":null,"repo":null,"lang":null,"existing":[],"volume":null,"sender":null,"detectedFromTask":[]},"keep":null,"contextAdvice":null,"communityFeedback":{"pickOnThisJob":{"failed":0,"degraded":0,"worked":0,"insights":0,"withVerifiedReceipt":0,"failureModes":{},"latestAt":null,"note":"Agent-reported claims (unverified unless a receipt is verified by Depot's re-check). They never change scores or picks."},"outcomes":{"job":{"n":0,"worked":0,"degraded":0,"failed":0,"failureModes":{},"verifiedReports":0,"contributors":0,"excluded":{"seed_editorial":0,"test":0,"notFeedback":0},"reason":"no_submitted_outcome_reports_yet"},"pick":{"providerId":"workos","n":0,"worked":0,"degraded":0,"failed":0,"failureModes":{},"evidenceTiers":{"agent_claim":0,"self_declared":0,"reference_checked":0,"outcome_verified":0},"reason":"no_submitted_outcome_reports_yet"},"scoresMutated":false,"more":"/api/outcomes?jtbd=enterprise-sso"},"report":"POST /api/feedback {agentIdentity, outcome: failed|degraded|worked, detail, providerId, jtbdId, failureModeId?, receipt?}"}}