WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.
Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.
A practical walkthrough of OWASP A07:2025, the weaknesses it lists, the fix for each one, and which of them your auth layer should be handling already.
Account takeover is the outcome. Credential stuffing, phishing, SIM swapping and session theft are the methods. Here are the four ways in and how to close them.
In B2B SaaS, one taken-over account exposes a whole customer organization. Here are the B2B-specific doors and the WorkOS controls that close each one.
Public CAs and Chrome are removing clientAuth from TLS certificates by 2027. The dates per CA, what fails at renewal, and where mTLS should go next.
Keep Better Auth for sign-in and sessions, and let WorkOS handle SAML, OIDC and directory sync for the customers who need them.
Give each product its own AuthKit sign-in pages and emails while users keep one account. How inheritance works, and what stays environment-wide.
On November 3, 2026, Entra dynamic groups built on memberOf stop updating. Apps provisioned from them stop receiving new hires and role changes, and nothing reports an error.
Maximum session length, access token duration, and inactivity timeout each run a different clock in AuthKit. What each one controls, and how to choose it.
WorkOS is on the 2026-27 Cyber60. The CISO survey published with it shows 77% of enterprises run agents and only 34% give those agents their own identity.
Shared credentials turn one manipulated agent into a compromised chain. Narrow, audience-bound tokens at every hop shrink the blast radius.
AuthKit rejects sign-ups and invitations at domains that can't receive mail. The reserved test domains that keep seeded environments and CI suites green.
A cluster admin token created in 2024 and never rotated led to 3.2 million customer environment variables being read. What that means if your product stores credentials for your customers.
Create a group in WorkOS, give it a role, and every current and future member inherits it. How group roles resolve in single-role and multiple-roles mode.
Microsoft OAuth and an Entra SSO connection are two different integrations. What each covers, how email domains route users, and which one a deal needs.
AuthKit translates its hosted pages, emails and Widgets into 90 locales. How each one picks the language, what you pass, and which strings stay yours.
Please try a different search
Our global team is growing and we’re hiring all types of roles.
WorkOS builds developer tools for quickly adding enterprise features to applications.
We use cookies for analytics and advertising. See our cookie policy for details.
