Blog

How to design AI agents that do less, prove more, and stay within boundaries your security team can actually audit.

WorkOS CLI for agents, Multiple application support, AuthKit Analytics, Pipes MCP, Widget Skills, & more.

How AI agents get hijacked, poisoned, and over-privileged, and why identity is the fix for most of it.

How comparing login timestamps and locations catches credential theft before attackers get in.

Let users sync their GitLab projects in your app, using a fresh access token, without writing any OAuth logic.

Understand why scopes and claims serve different roles in OAuth 2.0 and OpenID Connect, and how to design around each.

A developer's guide to registering redirect URIs per environment, debugging "invalid redirect URI" errors, and knowing when to use impersonation instead.

Authentication doesn't end at login. For modern SaaS applications, the real security perimeter is the token, and attackers know it.

Architecture, auth, ecosystem, and the 2026 roadmap for the protocol that connects AI to everything.

Why skipping audience validation lets attackers replay tokens across services, and how to fix it.

Add a "Sign in with Slack" button to your app in minutes using WorkOS AuthKit.

Decode, verify, and inspect JWTs; built by the team that does auth for a living.

Common threats from sign-up to sign-in: what can go wrong, how attackers exploit it, and how to stop them.

A practical comparison of the two protocols reshaping how agents pay for services in 2026.

A practical comparison of modern auth providers, trade-offs, and best practices for React Router apps.