WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.
Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.
Node.js and PHP shipped RCE fixes, a malicious LiteLLM release hit PyPI, and eMudhra CA keys were compromised. What WorkOS did, and some recommendations for your stack.
Directory Sync maps manager_id, manager_name and manager_email from the IdP. Where they land, how to key approval chains on them, and the no-manager fallback.
A map of NIST’s seven Zero Trust tenets onto the MCP request path: what the spec gives you, what you build, and the five checks every AI agent call should pass.
Run a closed beta on AuthKit Waitlist: enable it per environment, then list, add, approve and deny entries from the Waitlist API, webhooks or an MCP agent.
A stolen vendor credential signed in to Microsoft 365 tenants as a trusted app. What that pattern means if your product integrates with customer accounts.
Yelp sells agent access, JPMorgan refuses it, Shopify ships it as a toggle. Admission is a commercial call, and bot rules are the wrong place to enforce it.
RAR, DPoP, CIMD and Transaction Tokens get cited as the answer for AI agents. What each one actually binds, and three problems none of them solves yet.
Pipes Connection Sharing lets an admin connect a provider once for the whole organization. When it beats per-user OAuth, and what changes in your code.
WorkOS now writes Audit Log events for sign-ins and membership changes. What gets captured, what does not, and why turning it on is not retroactive.
DX Deputy CTO Justin Reock on why PR throughput keeps climbing, AI spend is up 50x, and the data still shows no clear return on agentic coding tools yet.
A workforce identity offboarding checklist for IT and security teams: what to disable, revoke, transfer, and rotate in each app, and the evidence to keep.
A SaaS access review checklist for IT teams: reconcile accounts and grants, record decisions, assign remediation, and verify app access changed as intended.
How workforce and customer identity differ, how they connect in B2B software, and which team owns sign-in, membership, permissions, and access removal.
SSO handles employee sign-in, and SCIM keeps app accounts and groups in sync with your directory. Learn where offboarding gaps appear and what to ask vendors.
An employee onboarding access checklist for approved apps and roles, account setup, first sign-in, and evidence that day-one access works for each new hire.
Please try a different search
Our global team is growing and we’re hiring all types of roles.
WorkOS builds developer tools for quickly adding enterprise features to applications.
We use cookies for analytics and advertising. See our cookie policy for details.
