My project is built in Elixir, so I implemented the flows where my application has no login screen UI. I just push all unauthenticated users straight to WorkOS. WorkOS and their AuthKit (hosted login page) handles the heavy lifting (User/Pass, Passkey, MFA, SSO, etc) and sends them back to my application with a JWT. I check if the user exists, and if not, just-in-time provisioning kicks in on my side and we're done. Tenant identified, and tenant user authenticated all wrapped up in a single JWT.
Why WorkOS?
Simple... I don't want to be responsible for any authentication headaches. I don't want to self-host or duct tape a bunch of different components together. I'd rather put as much of that control in the client's hands (or WorkOS's if they don't have their own IAM). Plus, I like what WorkOS offers. Documentation is solid, though I still need to figure out their Fine Grained Authorization (FGA) product, formerly known as Warrant. In the end, nothing lives on my side except workos_tenant_id, workos_user_id, and my application data. The tenant has full control over their IAM, all the features of WorkOS via their own admin panel and ultimately who can access my SaaS application.
How's it going so far?
I have exactly zero customers except my development tenant. Everything works as expected so far. Maybe I'll have a different story when I get a customer willing to foot the bill for all the WorkOS bells and whistles in production. But implementation has been smooth, and AuthKit works great for dev/testing as a hosted login page, one-click testing SSO flows, etc.
If I had to re-implement, would I still choose WorkOS?
I probably would've done the same deep research you're doing, hoping to find that needle in a haystack. As a bootstrap developer, I'd try to avoid the paid options and figure out the open source/roll-your-own route. But if I had a plan to afford the paid ones, I'd probably evaluate WorkOS against other paid options properly.