The Enterprise Deal Hiding Behind the Login Screen

There is a moment in the life of a young software company when a customer stops asking whether the product works and starts asking who may use it. Can employees sign in with the company’s identity provider? Can IT remove a departing colleague without filing a ticket? Can security see who changed a setting last Tuesday? The questions are dull only until they hold up a contract. WorkOS exists for that moment.

The email app with the wrong admirer

Michael Grinich had already built something people wanted. He co-founded Nylas, whose Nylas Mail was admired for its design and user experience. In his account, that affection concealed a problem: the product had not been built for the enterprise IT administrators who could approve or block adoption. Without the enterprise revenue he had hoped for, the team shut down the mail app and moved the business toward developer infrastructure.

The failure gave Grinich a peculiar business idea. If one well-loved app could be stopped by SAML, provisioning and security reviews, many others could be too. He spent roughly a year and a half examining that suspicion. He interviewed startup founders approaching enterprise customers, product people who had made the journey at companies including Dropbox and Slack, and IT administrators who had to say no to software they could not manage. The last group mattered most. A developer might see single sign-on as a chore. An administrator sees a way to control access after a person leaves the company.

At first, even fellow founders were cool on the idea of enterprise features. Some wanted to stay away from the whole subject. But people who had built those features, and IT teams forced to live without them, recognized the pain. In an interview with First Round Review, Grinich described looking for an idea that seemed uninteresting to outsiders while solving a problem he understood firsthand. SSO is unlikely to get a standing ovation at a product launch. That was part of the opportunity.

“Fall in love with the problem space rather than falling in love with your solution.”Michael Grinich, on the lesson of Nylas Mail

A year of code before a customer

WorkOS began building in early 2019. Grinich wanted more than a thin authentication service. His early list had four pillars: single sign-on, directory sync, audit logs and role-based access control. The team worked for about a year before its first version reached a customer. It invested in the website and documentation as carefully as the API. Grinich called the standard a “minimum awesome product”: enough depth to make a demanding first impression.

The planned debut was a SaaStr conference in March 2020. The pandemic canceled it. WorkOS launched on Hacker News and Twitter instead, then Grinich personally demoed and onboarded 73 companies over three weeks. Those conversations were evidence of interest, not instant revenue: prospective customers still had to place an integration on their roadmap. The distinction matters. A developer tool can be easy to admire and slow to adopt.

The company also learned which of its pillars buyers needed first. Feedback pulled the team toward SSO. For a corporate customer using Okta or Microsoft Entra ID, SSO lets staff sign in through the company’s chosen identity system. Directory Sync follows the employee lifecycle: create an account, change a group, revoke access. Audit Logs record the events that security teams may need to inspect or export. WorkOS makes those systems look more consistent to the SaaS developer even when the providers behind them behave differently.

The invoice changed shape

WorkOS initially charged according to end-user seats. The model sounded familiar, but it was a poor fit for a startup that had just landed its first enterprise prospect and did not yet know how many employees would join. The company moved toward charging by customer organization and, for SSO and Directory Sync, by connection. Its current public material offers AuthKit free up to one million monthly active users, with paid connections and other metered products on top. The exact bill depends on which pieces a company uses.

That structure reveals the market WorkOS chose. A consumer app mostly needs a good login. A B2B product must understand organizations: a person may belong to several, each may have its own security policy, and the buyer may require a different identity provider from the next buyer. WorkOS sits between the app builder and this tangle. Its alternatives include writing and maintaining the connectors in-house, or assembling pieces from authentication vendors such as Auth0, Clerk or AWS Cognito. Its pitch is broad enterprise readiness under one developer platform.

That breadth grew deliberately. In 2022, WorkOS acquired Modulz, whose team had built the open-source Radix UI components. In 2023 it launched AuthKit and User Management, bringing hosted and headless sign-in screens into the same orbit as enterprise SSO. Radar, introduced in 2024, added checks for bots, suspicious logins and abuse. Fine-Grained Authorization extends roles down to resources such as a project or repository, a problem made sharper when software agents act on behalf of people. Each addition shifts WorkOS further from a single integration into the machinery around who may do what.

What the customer really buys

The company’s roster now includes OpenAI, Anthropic, Cursor, Vercel and Webflow; WorkOS says more than 3,000 companies use the platform. Its March 2026 Series C raised $100 million at a reported $2 billion valuation. Those are impressive numbers, but they are not the useful part of the story for a builder. The useful part is the sequence: find the person who can veto adoption, learn their requirements before the deal arrives, and make those requirements cheap enough to deliver that product teams will actually do it.

There are limits to copying it. WorkOS’s launch followed extensive interviews, a founder with prior developer-tool experience, a year of engineering and an appetite for infrastructure that must work every time a user signs in. A team with a small, local product and no enterprise buyer has little reason to imitate that investment. And even with WorkOS, an app still decides what a revoked account means for its own data and permissions. An API can carry the event; it cannot make the product judgment.

The irony is neat. Grinich once spent three days with an electronic musician refining a notification sound for Nylas Mail. WorkOS was born from paying equal attention to a less musical sound: the IT administrator saying no. The login screen is where the user sees the company. The deal is often decided by what happens behind it.