WRNexus
WRNexus 1.0 is here — by the WorkRoot team

Identity, billing, and
workspaces, already shipped.

WRNexus is the WorkRoot platform shell modern SaaS teams reach for — a production-grade auth, workspaces, RBAC and billing stack you wire up in an afternoon instead of building from scratch over a quarter.

Sign-in, MFA, OAuth, workspaces, invites, billing, an audit log and a staff console — every layer your auditor and your users expect, all behind one SDK and one bill.

Start for free See pricing

Free Starter tier No credit card required 12,400+ workspaces in production

Trusted by product teams shipping with WorkRoot

  • Northwind Studios
  • Loomwave
  • Bluefin Robotics
  • Polaris Labs
  • Verdant Health
  • Quill & Cipher
Why teams switch

The three problems WRNexus actually solves

Every team we onboard arrives with the same three complaints. Here is how the platform answers each one — not as marketing copy, but as the implementation that ships on day one.

Problem

Rebuilding auth on every new product

How WRNexus solves it

Drop in one SDK and inherit a verified identity across every WorkRoot product in your account. Password resets, MFA enrollment and OAuth flows are already wired.

Problem

Audit log requests that block the next release

How WRNexus solves it

Every sensitive action is recorded with actor, IP, prev_hash and metadata — filterable, exportable, and good enough for SOC 2.

Problem

Billing webhooks that silently drop on retry

How WRNexus solves it

Idempotent Stripe handlers, signed payload verification, Customer Portal and prorated upgrades are already in production for us — and now for you.

The platform shell

Every layer of your SaaS plumbing — already wired

Eight product surfaces. One opinionated platform. Each card links to its long-form deep-dive on the features page.

SSO & identity

Email + password, magic links, OAuth (Google, GitHub, Microsoft), TOTP, passkeys and SAML SSO behind a single SDK — no five-vendor stitching required.

Learn more

Workspaces

Personal and team workspaces coexist on every plan. Switch contexts instantly without logging out — billing and audit trails stay scoped to each tenant.

Learn more

RBAC

Owner, admin, member and viewer roles ship out of the box. Build custom roles on Team and Enterprise tiers without touching a permissions library.

Learn more

Audit log

Every sensitive action lands in a tamper-evident, hash-chained, exportable audit trail your auditors will actually accept.

Learn more

Billing

Stripe Checkout, Customer Portal, signed webhooks, proration and Stripe-Tax automation — never write another invoice.paid handler.

Learn more

Integrations

Webhooks, Slack, Linear, SCIM 2.0 and a typed TypeScript + Python client. Wire WRNexus into the tools your team already runs.

Learn more

Usage analytics

Sign-in funnels, MFA adoption and seat utilisation in a workspace dashboard — plus warehouse streaming on Enterprise.

Learn more

Security defaults

Argon2id, HIBP password checks, signed cookies, per-IP brute-force limits and instant cross-region session revocation — on day one.

Learn more
How it works

Sign-up to production traffic in three steps

  1. Create a workspace

    Sign up with email, Google or GitHub. Your personal workspace is provisioned the moment you verify your address.

  2. Drop in the SDK

    Install @wrnexus/auth-client and resolve sessions on every request. The typed guard helpers ship for both TypeScript and Python.

  3. Ship to production

    Switch the SDK key from sandbox to live and you are done. Audit, billing and admin surfaces light up the moment your first user signs in.

platform uptime · trailing 90 days
99.97%
median session-validation latency
< 80 ms
integrations in the marketplace
38+
workspaces in production today
12,400+
Integrations

Plays nicely with the tools you already run

Need something not listed? Browse the full marketplace →

Built for every shape of team

One platform. Three very different teams.

For Startups

Ship your MVP without auth on the critical path

Wire up signup, OAuth and billing in an afternoon, then spend the rest of the quarter on the parts only you can build.

  • Free Starter tier
  • Google + GitHub OAuth
  • Stripe Checkout in 1 line
See Starter plan

For Agencies

Ship every client project on the same battle-tested shell

Spin up a tenanted workspace per client, hand them a Customer-Portal link for billing, and bill your retainer with confidence.

  • Tenant-per-client workspaces
  • Customer-Portal for clients
  • Audit trail per tenant
Read the agency story

For Enterprise

Pass the security review on the first attempt

SAML SSO, SCIM 2.0, tenant-isolated VMs and a SOC 2-ready audit trail — out of the box, not as a six-figure custom build.

  • SAML 2.0 + SCIM provisioning
  • Custom data residency
  • 1-hour Sev-1 SLA
Talk to sales
Pricing

Three tiers. No surprises.

Move from Starter to Team to Enterprise at your own pace — same code path, same dashboards, same audit trail. Just more controls as your team grows.

Starter

$0 / user / mo

Personal workspace, magic-link auth, basic audit log. Forever free.

Start free
Most popular

Team

$12 / user / mo

Unlimited members, OAuth, MFA, API keys and 1-year audit retention.

Try Team free

Enterprise

Custom

SAML SSO, SCIM, custom retention, dedicated support and security review.

Talk to sales

Compare all features Read pricing FAQs

From the field

The teams shipping faster with WRNexus

“WRNexus replaced three internal services for us in a weekend. The audit log alone shaved weeks off our SOC 2 prep.”
Lena Mwangi Head of Platform · Northwind Studios
“Passkeys, magic links and Google OAuth, all behind a single API key. The first thing our auditors asked for was already there.”
Tariq El-Hassan Staff Engineer · Loomwave
“We migrated 14,000 users off a homegrown auth shim with zero downtime. The runbook in the WRNexus docs is genuinely best-in-class.”
Mei Tanaka CTO · Bluefin Robotics
“The SCIM endpoint plugged into Okta in under an hour. Our IT team finally stopped emailing us about deprovisioning.”
Akira Watanabe Director of IT · Polaris Labs
Top questions

The questions we hear most

The full bilingual FAQ lives on /faq — these are the questions that come up before every pricing call.

What exactly is WRNexus?

WRNexus is the WorkRoot platform shell — a production-grade identity, workspaces, RBAC, audit log and billing stack that drops into your product behind a single SDK. Instead of stitching together five vendors (auth, MFA, SSO, billing, audit) you wire up one platform on day one and inherit the same primitives across every product your team ships.

Can I change plans at any time?

Yes. Upgrades are prorated to the day and take effect immediately, so you never lose access to a feature you just paid for. Downgrades take effect at the end of your current billing period and never destroy data — anything outside your new plan limits is simply made read-only.

How is my data secured at rest and in transit?

Every WRNexus service speaks TLS 1.3, and we encrypt sensitive fields (TOTP secrets, OAuth refresh tokens, API keys) with AES-GCM using a per-tenant key. Postgres backups are encrypted with the same scheme before they leave the VM. Passwords are hashed with Argon2id and checked against the HIBP k-anonymity API on signup and rotation.

Is there a free trial on paid plans?

Team includes a 14-day free trial with no credit card required. Enterprise plans include a tailored proof-of-concept after a 30-minute security and architecture review with our team.

What integrations ship out of the box?

WRNexus ships 38+ first-party connectors — Google, GitHub, Microsoft and Slack on every plan, plus Linear, Notion, Stripe, Segment, BigQuery, Snowflake, Okta and Azure AD on Team and Enterprise. Anything not on the list can be wired up through signed outbound webhooks or our typed TypeScript and Python clients.

See all FAQs

Ship the product. Skip the auth re-write.

Spin up a WRNexus workspace in under five minutes. The Starter tier is free forever, and there is no credit card required to evaluate.

Create a free account Talk to the team