WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.
Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.
Drop the WorkOS UsersManagement widget into your B2B app so your customers' own IT admins can invite members, remove them, and change roles without a ticket.
Agent sessions in WorkOS Agent Auth can be listed and revoked. Here is the removal routine, what a revoke stops, and how fast it takes effect in your API.
Environment roles apply to every organization. A custom role belongs to one, so you can give a customer the role they asked for without touching the rest.
Password spraying tries a few common passwords across many accounts, slipping under per-account lockouts. The signals it leaves and what stops it.
NIST no longer accepts security questions for account recovery. The four methods SP 800-63B-4 recognizes, and how to migrate your product onto them.
Your app's remove member button can make one of two AuthKit calls. What deactivate and delete each change, and the follow-up steps that finish the removal.
A practical walkthrough of OWASP A07:2025, the weaknesses it lists, the fix for each one, and which of them your auth layer should be handling already.
Account takeover is the outcome. Credential stuffing, phishing, SIM swapping and session theft are the methods. Here are the four ways in and how to close them.
In B2B SaaS, one taken-over account exposes a whole customer organization. Here are the B2B-specific doors and the WorkOS controls that close each one.
Public CAs and Chrome are removing clientAuth from TLS certificates by 2027. The dates per CA, what fails at renewal, and where mTLS should go next.
Keep Better Auth for sign-in and sessions, and let WorkOS handle SAML, OIDC and directory sync for the customers who need them.
Give each product its own AuthKit sign-in pages and emails while users keep one account. How inheritance works, and what stays environment-wide.
On November 3, 2026, Entra dynamic groups built on memberOf stop updating. Apps provisioned from them stop receiving new hires and role changes, and nothing reports an error.
Maximum session length, access token duration, and inactivity timeout each run a different clock in AuthKit. What each one controls, and how to choose it.
WorkOS is on the 2026-27 Cyber60. The CISO survey published with it shows 77% of enterprises run agents and only 34% give those agents their own identity.
Please try a different search
Our global team is growing and we’re hiring all types of roles.
WorkOS builds developer tools for quickly adding enterprise features to applications.
We use cookies for analytics and advertising. See our cookie policy for details.
