WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.
Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.
Use the WorkOS Rust SDK to sign users in with AuthKit, verify their session on every request, and check webhook signatures in an axum service.
Critical flaws in PHP, Node.js and GitLab, a poisoned LiteLLM release and weak CA keys all hit in October 2026. Here's what AI had to do with it.
Run one command to add sign-in to a Next.js app. The WorkOS CLI creates a temporary environment and writes your keys. Claim it when you want to keep it.
WorkOS sends an event before a SAML certificate expires. Turn it into one open reminder per certificate, routed to the person who can actually renew it.
macOS hands a custom-scheme URL to the running app. Windows and Linux start a second copy with the URL in its arguments. Here is the main-process code for both.
Organization roles give a member the same access everywhere. Scope a WorkOS role to a resource type and one person can edit one workspace and view another.
Each audit event lands as a row in your customer's own Snowflake table, with key-pair auth, a fixed schema, grants up front, and a freshness check.
When a provider needs each customer's own OAuth app, the Pipes Admin widget lets their admin register it, rotate the secret and retire it without your help.
Use the WorkOS Feature Flags targeting endpoints to add and remove organizations and users from your own systems, and learn what removing a target really does.
Turning off AuthKit's default emails is one setting. The work is the four flows you then own: invitations, Magic Auth, email verification and password reset.
The WorkOS Node SDK ships a feature flags runtime client that keeps flag configuration in memory, so a flag check on a hot path never waits on a request.
Configure a sign-in endpoint and WorkOS turns an identity provider tile click into a normal SP-initiated sign-in, handing your app the connection_id it needs.
A step-by-step walkthrough of the AD FS console work behind a SAML SSO connection, plus the claims and metadata details that cause failed sign-ins later.
Just-in-time provisioning is a resolution order in your SSO callback. Here is the order, the condition that makes the email match safe, and what to store.
GitHub App installation tokens are now about 520 characters instead of 40. What to audit before the override header is deprecated on November 30, 2026.
Please try a different search
Our global team is growing and we’re hiring all types of roles.
WorkOS builds developer tools for quickly adding enterprise features to applications.
We use cookies for analytics and advertising. See our cookie policy for details.
.webp)
