Blog

We localized AuthKit into 90 languages in 5 weeks. Learn how we did it, and how you can do it for your web-based product.

Learn how attackers exploit human behavior to bypass multi-factor authentication, and how to stop them.

Everything you need to know to secure your MCP server using OAuth 2.1 and PKCE, server and auth metadata, client registration, JWT validation, and role-based access control.

A complete developer’s guide to SAML certificates: X.509, signing, encryption, rotation, and management for secure Single Sign-On (SSO).

A step-by-step guide to moving users, organizations, MFA, and enterprise features from Auth0 to WorkOS, so you can scale with predictable pricing and an enterprise ready platform.

AuthKit in 90 languages, Native AuthKit integration for Convex, Multiple Role support for AuthKit, and more

AI agents are powerful, but without access control, they can create serious risks. Learn how to manage permissions safely with RBAC, OAuth, and Audit Logs.

Discover the new features from WorkOS Fall Launch Week 2025, including multiple roles in AuthKit, Convex integration, localization, custom email providers, and feature flags in Slack—built to help you ship Enterprise Ready apps faster.

The WorkOS Slack app brings transparency to your feature rollouts, helping teams coordinate better and debug faster.

WorkOS now lets you send transactional emails through your own provider—like SES, Postmark, Resend, or SendGrid—giving you full control over deliverability, reputation, and visibility while keeping the simplicity of WorkOS auth flows.

AuthKit now automatically translates into ~90 languages based on your users' operating system settings.

AuthKit is now the default authentication option for Convex projects, enabling zero config Enterprise Ready authentication for real-time applications

AuthKit now supports assigning multiple roles per organization membership, giving users the union of permissions across roles. This feature eliminates role explosion and makes access control more flexible and intuitive.

A practical guide to securing MCP model–agent interactions: prevent prompt injection, privilege escalation, replay attacks, and data exfiltration with validation gateways, signing, DLP, and scoped creds.

SAML certificates don’t work the same way as web SSL certificates. Here’s why self-signed certificates are the secure, standard choice for SAML, and when a CA-signed certificate might still make sense.