May Updates
Auth.md Agent Registration, Rust SDK Released, Environment Creation, & more
Auth.md - an open protocol for agent registration
Sign-up forms weren't built for agents. An agent hits your API, gets a 401, and has no good options. It can give up, or interrupt the user to create an account and paste an api key. Auth.md solves this. It is an open protocol that tells any agent how to register for your service via a Markdown file on your domain.
Check out this live demo from MCP Night with Cloudflare and Firecrawl: an agent registered for both services and deployed a site without leaving the terminal. Early access support in Authkit coming soon!
Read the spec →
Rust SDK Released
There's a new language to our SDK toolbelt: Rust!
The SDK provides async-first access to the WorkOS API with generated, strongly typed resource APIs, a builder-based client, structured error handling, safe retry behavior, and stream-based auto-pagination. It also includes helpers for common WorkOS flows including AuthKit, SSO, PKCE, webhook verification, JWKS, Passwordless, and Vault local crypto.
Get started by installing the crate with cargo add workos, then check out the crate docs and GitHub repository.
View the docs →
Environment Creation
Environment creation is now available in the WorkOS dashboard from the environment selector. You can create new staging or production environments as needed. Environments can also be renamed to differentiate them. You can learn more about managing environments in the docs.
User Scoped API Keys
You can now create API keys scoped to individual users in an organization. This extends the existing organization-scoped API keys. The API keys widget has been extended to support management of user API keys. Organization admins can mange and revoke user api keys for organization members giving them more control over their organization. Learn more about API keys in the docs.
Feature Flags Runtime Client
The WorkOS Node SDK now includes a runtime client that keeps an in-memory view of your flags in sync. Evaluations are synchronous and local, with no network call per check. Create a shared client at application start and fetch flag state from anywhere in your service. You can also receive events in app when flag state changes. Learn more in the docs.
Resource indicators for MCP Auth
You can now control access to individual MCP servers using resource indicators. When an MCP client requests a token, AuthKit scopes it to the specific MCP server the client asked for, so a token issued for one server can't be used with another. This gives you cleaner access boundaries across multiple MCP servers running under the same AuthKit environment. See the MCP integration guide to set it up.
More featured content