April Updates
FGA Custom Roles, Groups API, Self-serve Change Email API, & more
FGA Custom Roles
Custom roles can now be scoped to specific resource types like workspaces or projects, in addition to applying organization-wide. The dashboard now features a refreshed custom roles UI for managing roles and permissions.
Groups API
Group organization memberships together using the new Groups API. Make named groups to organize users by team, department, or organizational unit, and manage group memberships through the API.
Group organization memberships →
Self-serve Change Email API
New API endpoints let users change their own email address with built-in verification and fallback. Users initiate the change, then verify the new address before it takes effect.
Check out how to send an email change code and confirm an email change in the docs.
IT Contacts
The Admin Portal now supports collecting and managing multiple IT contacts (previously called organization admins). Enable collection from Configuration > Emails in the Dashboard. When enabled, Admin Portal setup flows — including SSO, Directory Sync, and certificate renewal — include a step to collect an IT contact email. After setup, users can view and manage their IT contacts from the post-configuration page.
Organizations can now have up to 20 IT contacts, up from one. Manage this list in the dashboard under an organization's settings, or pre-populate contacts when generating an Admin Portal link via admin_emails.
More featured content
- WorkOS joins Stripe Projects. Provision auth from the CLI in one command.
- Register for MCP Night: Agent Mode on May 21st in SF at the Regency Ballroom.
- Learn how to secure agentic apps with scoped, revocable credentials and tool-level authorization.