Search Guides

⌘ K

All Guides

Implementing a generic SCIM client

If you’ve built a custom Identity Provider, you’ll need to implement SCIM client functionality yourself. This guide shows you how to build a standards-compliant SCIM 2.0 client that can provision users and groups using WorkOS as the SCIM service provider.

How to migrate enterprise SSO connections from Auth0 to WorkOS

A step-by-step technical guide to migrating enterprise SAML and OIDC connections from Auth0 to WorkOS in 9 steps.

Best practices for MCP secrets management

Every outbound call from your MCP server carries credentials—API keys, database passwords, OAuth tokens, you name it. If those secrets leak, the blast radius extends far beyond your LLM demo. Learn to secure your MCP secrets.

MCP, ACP, A2A, Oh my!

Let’s explore the MCP, ACP and A2A protocols, understand what they do, and highlight how they differ and complement one another.

Decoding and solving the five most common SAML errors

Discover how to solve the top five SAML errors, complete with practical troubleshooting tips.

What is the Model Context Protocol (MCP)?

Anthropic developed the Model Context Protocol (MCP), an open standard that connects AI assistants to systems where data actually lives—content repositories, business tools, development environments, and more.

Understanding the OAuth 2.0 Client Credentials flow

Learn how to use OAuth for secure machine-to-machine communication with the Client Credentials flow.

What is federated identity?

Learn what federated identity is, how it works, its pros and cons, and how it differs from SSO and social logins.

What does it mean to distill a machine learning model or LLM?

Distillation is a technique for creating smaller, faster, and more efficient versions of neural networks while retaining most of their performance.

How to build secure AI agents that are Enterprise Ready

How can you build secure, compliant AI agents while maintaining performance and fostering innovation?

Authentication glossary

A glossary of terms and definitions for all things related to authentication.

What is device fingerprinting and how does it work?

Your device leaves a unique trail of digital breadcrumbs whenever you open a web browser. These aren't cookies that you can delete – they're subtle signals from your hardware and software that combine to create something far more permanent: your device fingerprint.

How SCIM provisioning works

SCIM is a widely used protocol, but not many people understand it. This straightforward and comprehensive guide steps through how it works, using real-world examples and API calls and responses.

What is multitenant authentication?

Learn how to build and scale authentication systems that serve multiple enterprise customers. This guide explores key concepts in multitenant authentication, from managing organization-specific SSO and security policies to avoiding common pitfalls.

SCIM best practices

User provisioning is hard, and there are many things you can get wrong if you do it in-house. We gathered some best practices on SCIM to help you with that.

Best practices for secrets management

This guide explains best practices for keeping your secrets where they belong—secured away from public code and prying eyes.

SSO best practices

SSO is necessary if you want to sell to enterprise customers, but doing it well is hard. We gathered some best practices that can help you with that.

The complete guide to OAuth 2.0

Learn everything you need to know about OAuth: what it is, what problem it solves, and how it works.

Best practices for CLI authentication: A technical guide

Learn how to securely authenticate users accessing your service through a command-line tool, enabling safe, scriptable workflows across terminals, machines, and Docker containers.

Common SAML security vulnerabilities and how to defend against them

Review some of the common SAML security vulnerabilities and see how you can defend against them.

What is entitlement management? A guide to secure access

Learn all about entitlement management: what it is, how it works, its benefits, and how to implement it effectively.

Understanding cross-site scripting (XSS) attacks

XSS attacks are not to be taken lightly. Learn what XSS is, the different types of attacks, and how you can defend against them.

SCIM: what it is and how it works

What is SCIM, and why do you need to support it in your SaaS? We’ll discuss the SCIM standard in-depth, how it works, and how you can add SCIM support to your app.

JWT validation: how-to and best libraries to use

Learn about JSON Web Token (JWT) validation, why it’s important, what the best practices are, and how to do it using trusted third-party libraries.

OTP bots explained: What they are and how to stop them

Learn how OTP bots work, their role in bypassing MFA, and the top methods to protect your accounts from these cyber threats.

The developer’s guide to Fine-Grained Authorization (FGA)

As apps have become more complex, especially with the rise of user-generated content, the need for a more granular and scalable authorization scheme has become crucial. Unlike other models, Fine-Grained Authorization defines permissions at the resource level, providing precision and the ability to handle millions of authorization requests per second.

Implementation challenges of a homegrown SCIM solution

SCIM provisioning is an important enterprise feature that provides user lifecycle management (ULM) and automated access control. Building this in-house means you must deal with fragmentation issues across onboarding, implementation, and triage, incurring significant engineering cost, delayed time to market, and potential security issues.

What is Single Logout?

Learn what single logout is, its benefits, why it's important, and why it has such limited support.

What is OpenID Connect (OIDC)?

Learn what OpenID Connect (OIDC) is, how it works, and when you should use it.

What is fine-grained access control?

Learn what Fine-Grained Access Control is and how it works.

The developer’s guide to auth sessions

Learn what sessions are and how you can implement them from scratch or using an auth provider like WorkOS.

Managing SAML X.509 Certificates

In this article, we’ll dive into what SAML X.509 certificates are, their role in your SAML Single Sign-On (SSO) connections, and best practices for managing these to ensure there is no downtime for your enterprise customers.

What is RBAC? How it works and when to use it

Learn what RBAC stands for, its key benefits, and how to implement it effectively to maintain access control.

What is Attribute Based Access Control (ABAC)?

Attribute-Based Access Control (ABAC) provides a targeted, more precise way to manage who can see and use different resources and under which conditions.

What is authorization (authZ)?

Learn what authorization is, its different patterns, and best practices.

SCIM vs SSO: What's the difference and how do they work together?

SCIM vs SSO: Learn the differences between SCIM and SSO and how they work together in identity and access management.

Unlocking the power of SCIM: streamlining enterprise user management

Learn what SCIM stands for, how it simplifies provisioning and access control, and why you should support it.

What is Google Zanzibar?

Learn what Google Zanzibar is, how to implement it, and how it compares to other authorization technologies.

The developer's guide to RBAC

Authorization often takes a backseat to authentication, but it becomes critical as applications scale and and require finer access control. This article is a practical guide for developers on how to design, scale, and integrate role-based access control (RBAC): from simple roles to enterprise-ready systems with IdP syncing.

What is Relationship-Based Access Control (ReBAC)?

Relationship-Based Access Control (ReBAC) is an authorization model that grants access based on user-resource relationships, offering a more dynamic approach compared to RBAC and ABAC. This blog breaks down how ReBAC works, its benefits and implementation challenges, and when it's the best fit for your app.

What is authentication (authN)?

Authentication (authN) is the process of verifying the identity of users or systems before granting access to resources, essential for ensuring security in applications. This blog explores various authN methods like passwords, multi-factor authentication, and biometrics, and discusses the trade-offs of building in-house or using third-party providers..

The 4 main types of access control

Learn about the 4 main types of access control, how they work and how to choose the right one for your company.

SCIM 2.0 vs SCIM 1.0: What’s the difference between the two versions?

Exploring the differences between SCIM 2.0 and SCIM 1.0, and what's new in the latest version of the protocol

SAML vs OAuth: A technical guide

Exploring the differences between SAML and OAuth, how they function, and how to choose which one to support.

What are JSON Web Tokens (JWTs)?

Learn what JWTs are, how they work and what you can use them for.

OpenID Connect vs. SAML

Exploring the differences between OIDC and SAML, how they function, and how to choose which one to support.

SCIM vs JIT: Key differences explained

Exploring the differences between JIT and SCIM, how they function, and how to choose which one to support.

A guide to organization modeling

Learn what organizational modeling is and how to implement it, as well as explore the complexities of supporting SSO in a multi-organizational model.

What are SCIM groups?

Learn how SCIM groups automate access management, reducing compatibility issues across platforms in enterprise environments.

The developer's guide to user management

Developer resource for modern day user management, including 101 topics like SSO and MFA as well as more advanced concepts like identity linking, email verification, and JIT provisioning.

What is MFA, and why does your app need it?

Learn what MFA stands for, and why your app needs it.

What is Just-In-Time Provisioning and how do you use it?

We’ll explain what JIT is, how it compares to other user provisioning strategies, why you should consider supporting it and how you can implement it.

Enterprise readiness checklist: Steps to scale your business

Learn about enterprise readiness for companies and how WorkOS can help meet large clients' security and compliance needs.

How to get Enterprise Ready: Guide for SaaS product managers

Everything you need to get your SaaS Enterprise Ready: timing, essential features, build vs. buy decisions, and key pricing considerations.

Every SCIM attribute explained

In this article, you’ll learn more about attributes, including how the key attributes work, and how you can use custom attributes to deliver additional functionality.

What is SAML and how does it work?

In this article, you’ll learn what SAML is, how you can set it up, and what other options you have to provide similar functionality and support SSO for your customers.

The developer's guide to domain verification

Learn what domain verification is, how it works, its challenges, best practices, and how you can use WorkOS to verify domains.

UI/UX best practices for IdP & SP-Initiated SSO

Explore the UI/UX best practices for IdP and SP-initiated SSO flows, like subdomaining tenants and separating email and password screens.

Understanding CSRF attacks

What is a CSRF attack? Learn how these attacks exploit user trust in web apps and how you can prevent them.

How to pick an identity as a service (IDaaS) provider: A guide for busy startups

Identity is an important problem, but solving it is outside your core skill set. Lucky for you, and with apologies to Steve Jobs, there’s a SaaS - and a guide! - for that.

Crossing the Enterprise Chasm

The Enterprise Chasm separates early-adopter users from larger enterprise customers in B2B SaaS apps. Learn which features your app needs to cross it.

How to write your first Service Level Agreement (SLA)

So, you're writing your first service level agreement? Learn from the best: examples from Slack, Amazon, and Google show how you can write your SLA for comprehension and effectiveness.

The developer’s guide to Directory Sync and SCIM

Learn what SCIM is, why you should care, and how to build it into your app using WorkOS Directory Sync.

The developer’s guide to SSO

Adding SSO to your app is a common requirement for selling to enterprise customers. Here’s a guide that will help you understand SSO and choose the best way to add it to your app.

SOC 1 vs. SOC 2 vs. SOC 3: Why your company needs compliance to grow

Compliance stands between your company and growth. If you want to sign enterprise deals, learn the differences between SOC 1, SOC 2, and SOC 3, and how best you can comply.

Key differences between CCPA and GDPR: How location affects enterprise compliance

Discover the key compliance differences between CCPA and GDPR and how each law affects your business operations.

Authentication vs. authorization

Authentication and authorization are often interwined, but refer to completely different things. This post breaks down the difference and explores difference schemes for each.

A developer’s guide to startup security

The size of your startup, no matter how small, won’t keep it safe. In this post, we cover five common threats facing your startup and explain how they work.

How to get SOC 2 compliance: A developer’s guide

Learn how to get SOC 2 compliance and how long it takes.

Security policy document examples for B2B SaaS apps

If you’ve been put in charge of writing a security policy document, you might feel a tad overwhelmed. This guide will help, with examples from companies like Slack and Stripe.

A developer's guide to GDPR compliance

GDRP affects companies the world over and as a developer, it's your job to ensure compliance. Read our guide to the basics to understand what GDPR entails.

When is it a good time to start enterprise sales?

Jim Barksdale once said, “There [are] only two ways to make money in business: One is to bundle; the other is unbundle.” Here's when you should bundle your product for enterprise sales.