The Changelog

The WorkOS CLI now includes an FGA test command for validating your schema changes.

You can now set wildcards in redirect URIs for production environments.

The official WorkOS MCP Documentation server is now available!

WorkOS now emits events related to SAML certificate renewals.

Access JWT claims from the access token used in FGA checks with the new jwt_claim policy helper.

User's emails can now be changed via API or the dashboard.

AuthKit can now be used for MCP server authorization.

Custom attributes now support mapping from SAML responses during SSO.

Admin Portal now alerts customers to verify domains before setting up a SSO connection.

New FGA policy helpers make it easier to write dynamic, context-aware policies.

Use your existing authentication provided by WorkOS to secure your remote MPC server running on Cloudflare

Support logins that originate outside of your application, like from bookmarks, with less effort.

Introducing WorkOS Guides, your new go-to hub for mastering authentication, authorization, user provisioning, security, and more.

Add context to your LLM prompts with ease using the new “Copy as Markdown” feature in the WorkOS product documentation.

IT admins can now map roles to identity provider groups during Single Sign-On setup in the Admin Portal.

Define and use policies in your authorization schema with WorkOS Fine-Grained Authorization (FGA)

Learn how to use WorkOS with on-prem customers

Developers can enable password history to reject up to 10 previously used passwords for a user.

New widgets are available for a complete user profile experience and organization switching.

WorkOS now supports eight new built-in login providers for AuthKit.

Customize your AuthKit integration with custom metadata, external id, and JWT templates.

Simplify encryption and secrets management for modern web applications with WorkOS Vault.

Allow customers, partners, and vendors to seamlessly connect to your application with WorkOS Connect.

The WorkOS Dashboard now includes a new notifications page.

Organizations with IT Admin emails configured will now be notified directly when there are issues with their SSO Connection.

Laravel Cloud supports AuthKit via a pre-built integration

Authkit customers using frontend sessions can now leverage user impersonation.

Develop, test and share fine-grained authorization schemas with the FGA Playground.

The AuthKit Next.js SDK is now available as a v1.0

WorkOS now supports the addition of multiple logout URIs.

Authkit now supports configuring user session inactivity timeouts

AuthKit now supports custom OAuth static scopes for both Google and Microsoft integrations.

Provision custom roles for specific organizations, offering more flexibility and granular access control compared to static, pre-defined roles.

Example that shows how to integrate with AuthKit in any Python app.

Enable IT admins to download your app's logo from the Admin Portal when configuring IdP-initiated SSO.

A new API endpoint to programmatically accept invitations at any point within the application.

AuthKit now supports identity provider role assignment.

Fast-track your SaaS app from 0 to 1.

Entitlements sync between Stripe and your app.

Customizable user registration and authentication flows within AuthKit.

Ready-made components that supply the frontend and backend functionality for specific tasks.

Use FGA to centralize your authorization logic, implement complex authorization schemes like Google Docs-style permissions, and define precise access control that goes beyond RBAC.

Real-time protection against bots, fraud, and abuse. Now available with AuthKit.

Passkeys allow you to log into your account using biometrics instead of a password. They are now available for free to all AuthKit customers.

Add your team's support email address as part of Admin Portal setup emails.

SSO now supports identity provider role assignment.

AuthKit Quick Start guides that cover additional frameworks and languages.

Enhanced customization options for the AuthKit sign-in and sign-up pages, including support for custom HTML and CSS.

Now supporting frontend sessions.

WorkOS is HIPAA compliant.

Multiple organizations can now add the same verified domain and configure which verified domains are included in a domain policy.

Example app that shows how to integrate with AuthKit in any Ruby application.

Major update for the Python SDK with sample apps.

Retrieve provider icons​​ for IdPs, Directory Sync, and domain verification services used within the Admin Portal.

The Admin Portal now supports built-in SAML certificate renewal flows.

Documentation covering common auth concepts, B2B app modeling, multi-tenancy, and the WorkOS integration architecture.

Once authenticated, users can now switch between different organizations without having to log out and log back in.

Early access for FGA is now available.

The SDK can be used to handle signing, encrypting session data, and managing JWTs.

AuthKit now supports custom permissions for user roles, providing a robust RBAC implementation.

You can now update user roles on Organization Membership via Identity Provider Role Assignment in the Admin Portal.

WorkOS now supports a generic Log Streams destination, HTTP POST, that can be streamed to any SIEM provider that accepts HTTP POST requests with a JSON payload.

Example app that shows how to integrate AuthKit in your Remix application.

Identity provider role assignment is now supported for IT admins as they set up Directory Sync in the Admin Portal.

Now supporting Apple OAuth for SSO.

Migrate existing TOTP MFA factors to WorkOS without requiring your users to re-enroll.

Directory Sync now supports role assignment for users based on their group memberships.

User Management now supports automatic user provisioning and de-provisioning via SCIM and Google Workspace directories.

Migration docs from Clerk and new tooling to simplify the import process.

You can now disable emails for specific user management lifecycle events and send them yourself.

Users are now automatically signed in upon signup in AuthKit.

An example app that shows you how to authenticate users with AuthKit and the WorkOS PHP SDK.

User Management now has native support for soft-deletion use cases.

PKCE support for SSO is now available.

The Events API now supports the Organization ID parameter for filtering Events that have occurred in a specific organization.

The response to the User Management authenticate endpoint now includes information about the authentication method of a user.

Users can now configure group syncing for Google Workspace Directories in the WorkOS Dashboard.

A new API endpoint for retrieving a User’s identifiers from external IdPs.

Developers can now direct users to either the sign-in or sign-up screen in AuthKit using the screen_hint parameter.

WorkOS has partnered with GitHub to support scanning for leaked WorkOS secrets exposed in public repositories and packages.

Impersonation provides an effective and secure way for your support team to troubleshoot.

The workos-node library now supports JavaScript environments like Deno, Bun, Cloudflare Workers, Vercel, and Node, simplifying API requests across these platforms.

The new Datadog integration now lets users stream WorkOS events and generate comprehensive reports of all end-user logins.

With Roles, defining access control levels for your users is now a breeze. When a user session is initiated, role information will appear by default.

Sessions are important for securely handling interactions between a user and an application within a specific time frame.

Organization owners can now specify which auth methods members can use during sign-in.

With Test SSO, developers can perform rigorous end-to-end testing for the SSO integration without having to sign up with an identity provider.

User Management will now include OAuth profile pictures as part of the user metadata returned to your application.

The updated Organizations page provides new filtering parameters to sort through information more easily.

Bot Detection now included in hosted AuthKit.

Google Workspace admins now have more granular control over user information that is synced through Directory Sync.

Now supporting GitHub OAuth as a Single Sign-On authentication method.

Suspended and inactive Directory Sync Users are now consolidated into to a single inactive state for easier integration and readability.

AuthKit, the open source authentication UI built on Radix, and User Management, the backend platform handling email verification, account linking, and more.

Effective and comprehensive setup flows for non-SCIM directories.

Available to all users: enable SAML auth for the WorkOS Dashboard.

The Admin Portal now supports Domain Verification, enabling IT admins to prove domain ownership with DNS TXT records.

To provide cleaner and more secure data, user information in dormant states will be deleted by default.

Developers can now use custom domains when sending Admin Portal invite emails, ensuring consistent branding during onboarding.

User can now view events-related data such as payload information, webhooks emitted for specific events, and metadata more easily. This provides an advanced workflow for debugging scenarios when configuring integrations.