WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.
Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.
A workforce identity offboarding checklist for IT and security teams: what to disable, revoke, transfer, and rotate in each app, and the evidence to keep.
A SaaS access review checklist for IT teams: reconcile accounts and grants, record decisions, assign remediation, and verify app access changed as intended.
How workforce and customer identity differ, how they connect in B2B software, and which team owns sign-in, membership, permissions, and access removal.
SSO handles employee sign-in, and SCIM keeps app accounts and groups in sync with your directory. Learn where offboarding gaps appear and what to ask vendors.
An employee onboarding access checklist for approved apps and roles, account setup, first sign-in, and evidence that day-one access works for each new hire.
Learn how workforce identity manages employee and contractor access, how SSO and provisioning fit together, and what to check before choosing a system.
A contractor access management checklist for sponsors, approved scope, end dates, renewal decisions, and evidence that temporary access was removed from apps.
An employee role change access checklist: compare old and new grants, approve handover exceptions, remove unneeded permissions, and verify the changes in apps.
How your identity provider can grant AI agents access to work apps, without a consent screen for every app and every agent.
What Okta’s Agent SSO launch reveals about the unfinished standards behind cross-company agent identity.
Google now binds OAuth refresh tokens to a client key with DPoP; access tokens stay Bearer. What that protects, what to build, and who can use it.
Forty attorneys general just told a bankruptcy court that a self-reported birthdate isn't age verification. The options you have at signup, what each one keeps, and where each one fails an audit.
When a peer agent posted GO, an OpenAI agent read it as permission. Why agent-to-agent instructions need a delegation you can check, and how RFC 8693 does it.
Revoking an AI agent's access stops new reads but not what it already learned. What OpenAI's dots reveal about deprovisioning, and four controls that help.
C2PA’s exclusion range flaw let a signature verify while covering zero bytes. The same bug hits SAML and JWT. A checklist for verifying what a signature covers.
Please try a different search
Our global team is growing and we’re hiring all types of roles.
WorkOS builds developer tools for quickly adding enterprise features to applications.
We use cookies for analytics and advertising. See our cookie policy for details.
