The Changelog

Use FGA to centralize your authorization logic, implement complex authorization schemes like Google Docs-style permissions, and define precise access control that goes beyond RBAC.

Real-time protection against bots, fraud, and abuse. Now available with AuthKit.

Passkeys allow you to log into your account using biometrics instead of a password. They are now available for free to all AuthKit customers.

Add your team's support email address as part of Admin Portal setup emails.

SSO now supports identity provider role assignment.

AuthKit Quick Start guides that cover additional frameworks and languages.

Enhanced customization options for the AuthKit sign-in and sign-up pages, including support for custom HTML and CSS.

Now supporting frontend sessions.

WorkOS is HIPAA compliant.

Multiple organizations can now add the same verified domain and configure which verified domains are included in a domain policy.

Example app that shows how to integrate with AuthKit in any Ruby application.

Major update for the Python SDK with sample apps.

Retrieve provider icons​​ for IdPs, Directory Sync, and domain verification services used within the Admin Portal.

The Admin Portal now supports built-in SAML certificate renewal flows.

Documentation covering common auth concepts, B2B app modeling, multi-tenancy, and the WorkOS integration architecture.

Once authenticated, users can now switch between different organizations without having to log out and log back in.

Early access for FGA is now available.

The SDK can be used to handle signing, encrypting session data, and managing JWTs.

AuthKit now supports custom permissions for user roles, providing a robust RBAC implementation.

You can now update user roles on Organization Membership via Identity Provider Role Assignment in the Admin Portal.

WorkOS now supports a generic Log Streams destination, HTTP POST, that can be streamed to any SIEM provider that accepts HTTP POST requests with a JSON payload.

Example app that shows how to integrate AuthKit in your Remix application.

Identity provider role assignment is now supported for IT admins as they set up Directory Sync in the Admin Portal.

Now supporting Apple OAuth for SSO.

Migrate existing TOTP MFA factors to WorkOS without requiring your users to re-enroll.

Directory Sync now supports role assignment for users based on their group memberships.

User Management now supports automatic user provisioning and de-provisioning via SCIM and Google Workspace directories.

You can now disable emails for specific user management lifecycle events and send them yourself.

Migration docs from Clerk and new tooling to simplify the import process.

Users are now automatically signed in upon signup in AuthKit.

An example app that shows you how to authenticate users with AuthKit and the WorkOS PHP SDK.

User Management now has native support for soft-deletion use cases.

PKCE support for SSO is now available.

The Events API now supports the Organization ID parameter for filtering Events that have occurred in a specific organization.

The response to the User Management authenticate endpoint now includes information about the authentication method of a user.

Users can now configure group syncing for Google Workspace Directories in the WorkOS Dashboard.

A new API endpoint for retrieving a User’s identifiers from external IdPs.

Developers can now direct users to either the sign-in or sign-up screen in AuthKit using the screen_hint parameter.

WorkOS has partnered with GitHub to support scanning for leaked WorkOS secrets exposed in public repositories and packages.

Impersonation provides an effective and secure way for your support team to troubleshoot.

The workos-node library now supports JavaScript environments like Deno, Bun, Cloudflare Workers, Vercel, and Node, simplifying API requests across these platforms.

The new Datadog integration now lets users stream WorkOS events and generate comprehensive reports of all end-user logins.

With Roles, defining access control levels for your users is now a breeze. When a user session is initiated, role information will appear by default.

Sessions are important for securely handling interactions between a user and an application within a specific time frame.

Organization owners can now specify which auth methods members can use during sign-in.

With Test SSO, developers can perform rigorous end-to-end testing for the SSO integration without having to sign up with an identity provider.

User Management will now include OAuth profile pictures as part of the user metadata returned to your application.

The updated Organizations page provides new filtering parameters to sort through information more easily.

Bot Detection now included in hosted AuthKit.

Google Workspace admins now have more granular control over user information that is synced through Directory Sync.

Now supporting GitHub OAuth as a Single Sign-On authentication method.

Suspended and inactive Directory Sync Users are now consolidated into to a single inactive state for easier integration and readability.

AuthKit, the open source authentication UI built on Radix, and User Management, the backend platform handling email verification, account linking, and more.

Effective and comprehensive setup flows for non-SCIM directories.

Available to all users: enable SAML auth for the WorkOS Dashboard.

The Admin Portal now supports Domain Verification, enabling IT admins to prove domain ownership with DNS TXT records.

To provide cleaner and more secure data, user information in dormant states will be deleted by default.

Developers can now use custom domains when sending Admin Portal invite emails, ensuring consistent branding during onboarding.

User can now view events-related data such as payload information, webhooks emitted for specific events, and metadata more easily. This provides an advanced workflow for debugging scenarios when configuring integrations.

99.99% uptime is now contractually guaranteed as part of the enterprise SLA.

All users that are updated to “suspended” state will now result in a deletion of that user’s group memberships.

The Audit Logs API can now be used to increase the retention period from 30 to 365 days.

WorkOS now uses more comprehensive validation during SCIM directory setup in the Admin Portal to ensure successful configuration.

We’ve shipped a new Audit Logs API that enables you to define Audit Logs event schema in code.

We’ve introduced a new way to view Directory Events directly from the WorkOS Dashboard.

We now support Google Cloud Storage as a Log Streams destination, so you can stream Audit Log events directly from your application to your customer’s Google Cloud instance.

We've released the Events API – a reliable and efficient integration method to sync changes from WorkOS to your app.

You can now invite your customers’ IT admins to configure Single Sign-On, Directory Sync, and Log Streams by sending them an email directly from the WorkOS Dashboard.

We've enhanced the OIDC setup experience in Admin Portal, providing verification for discovery endpoints and validation while testing SSO.

We've enhanced the SSO configuration experience in Admin Portal to make it even easier for your customers to successfully configure single-sign on for your application.

The Dashboard organization page has been redesigned to make it easier to share a setup link with your customers.

We’ve just published a new integration that enables WorkOS features within your Bubble application.

We’ve just published a developer guide to building user experiences for SSO sign-in.

We’ve just published new user experience guides on MFA enrollment and MFA sign-in.

We're introducing a new groups attribute for the User profile. Developers can use this group membership information to enable SSO role-based access control in their apps, using Just-In-Time User Provisioning.

We’ve just published a new guide on Just-In-Time User Provisioning with WorkOS Single Sign-On.

We're introducing a new SFTP-based integration for Directory Sync. Organization admins looking for a flexible and secure mechanism to provision and de-provision their users can now do so by sending CSVs via SFTP.

We’ve made it easy to pass in login hints to Okta SAML and Azure SAML and domain hints to Google SAML, making user login experiences even smoother.

We’ve made the navigation in Admin Portal more intuitive when moving between the provider selection screen and the provider configuration steps.

There are three new pages available for Directory Sync developer documentation: "Fundamentals", "Role Data", and "Role Architecture".

We’ve enhanced the SAML session viewer in the WorkOS dashboard to improve the experience of debugging your connection sessions.

To make it even easier to get started with our API endpoints, we’ve created a WorkOS Postman public workspace.

We’ve just added a Compliance Documents page which makes it easier to access all of our compliance reports: SOC 2 Type II, SOC 3, SIG Lite, and Penetration Test.

We’ve just enabled self-serve creation of your shared Slack Channel from the Dashboard.

You can now add custom branding to your Admin Portal sessions in a sandbox environment for free.

We're excited to introduce a new feature called Log Streams that makes Audit Logs even more useful for your customers. Log Streams enable you to stream audit log events from your application directly to your customers' Security and Incident Event Management (SIEM) platforms, like Datadog, Splunk, and AWS S3.

We have enhanced Directory Sync custom attributes to automatically populate common fields across different providers.

We’re excited to announce that you can now update Admin Portal custom branding properties directly from the WorkOS Dashboard.

Recently we’ve been introducing a suite of improvements to the Admin Portal experience. Including navigation improvements, a new feedback channel, and persistence between sessions.

Today we’re adding support for testing your Google/Microsoft OAuth connections without having to create your own OAuth credentials.

We’re excited to announce that you can now support Cezanne HR through the WorkOS Directory Sync integration and Admin Portal.

Today we're adding a new `success_url` attribute which gives more flexibility and control to developers over the flow after successfully setting up Directory Sync or Single Sign On via the Admin Portal.

Today we’re releasing a fix in how we process SAML responses, which include `Attributes` with multiple child `AttributeValue` tags. It is important for you to check the type of a raw attribute before processing it, as some values will now be of type array.

Audit Logs are a collection of events that contain information relevant to notable actions taken by users in your app. These events are similar to application logs and analytic events, but are fundamentally different in their intent.

We’re excited to announce that you can now support Rippling SAML through the WorkOS Single Sign-On integration and Rippling SCIM through the WorkOS Directory Sync integration.

Today we are releasing a suite of new example apps that demonstrates how to use Typescript to interact with the WorkOS Node.js SDK for our Single Sign-On, Directory Sync, Admin Portal, Magic Link, and Multi-Factor Authentication products.

Today we’ve added the `organization_id` to both the Directory User and Directory Group API endpoints and webhooks. This popular request unlocks flexibility in how you choose to store references to the WorkOS API in your applications — letting you find the best model for your architecture.

We’re excited to announce that you can now support People HR through the WorkOS Directory Sync integration and Admin Portal.

We're adding support for wildcard Redirect URIs in Staging environments. This will enable you to use multiple "review app" style deployment URLs, and map them to a single WorkOS environment.

We’re excited to announce that you can now support SimpleSAMLphp through the WorkOS SSO integration and Admin Portal.