The Changelog

The WorkOS Node SDK now includes a runtime client that keeps an in-memory view of your flags in sync.

You can now control access to individual MCP servers using resource indicators.

The Admin Portal now supports collecting and managing multiple IT contacts (previously known as organization admins).

Group organization memberships together using the new Groups API.

Custom roles can now be scoped to specific resource types like workspaces or projects.

New API endpoints support allowing users to change their own email address with built in verification and fallback.

New predefined attributes — display_name, employee_number, organization, phone_numbers, manager_name, and manager_id are available from directories.

You can now edit user and organization metadata, including external ID, from the dashboard.

Widgets can automatically translate text in your users’ preferred language, with support for 90 languages out of the box.

Decode, verify, and inspect JWTs directly in your browser

Inspect and work with the WorkOS API through the OpenAPI specification.

Widget Skills let AI coding agents generate app-native implementations of WorkOS-powered workflows.

Pipes MCP is a deployable MCP server that gives agents time-limited access to third party data connections.

Turn your agent into a WorkOS expert with six new capabilities.

See how users are using your app with AuthKit Analytics.

Manage identity and users across all your apps with support for multiple applications.

You can now check and remove user email addresses from the email suppression list.

Two new widgets, directory sync and log streaming are now available to embed in your application.

WorkOS now supports Fine-Grained Authorization (FGA), extending our existing RBAC offering so you can define both roles and permissions scoped to the resources in your application.

The SSO session lifecycle has been improved with a new Timed-out state and additional events to better monitor SSO sessions.

Custom attributes sourced from Identity Providers are now available in AuthKit.

Search and navigate the WorkOS dashboard with the new command palette.

Developers can now manage their Roles and Permissions through the new Authorization API.

JWT Templates can now be used in Connect for MCP and OAuth applications.

WorkOS now supports Intuit as a built-in authentication provider for AuthKit.

Integrating AuthKit is now a single command: npx workos@latest.

The WorkOS Node SDK now supports PKCE authentication for public clients and improved runtime compatibility.

Audit logs now supports log streaming to Microsoft Sentinel.

You can now manage API keys for organizations via the API.

WorkOS Pipes now supports 9 new providers including: Asana, Box, Dropbox, Front, GitLab, HelpScout, Hubspot, Intercom, Jira, Sentry.

WorkOS Connect now supports users selecting one of their Organizations when authorizing a Connect Application.

AuthKit now keeps user emails in sync with their social login provider.

WorkOS now supports Vercel as a built-in authentication provider for AuthKit.

Pipes allows your users to securely connect their third-party accounts to your application.

WorkOS is now PCI DSS (self-attested via SAQ-D).

WorkOS has published a Trust Center where customers may access the latest security and compliance resources.

Identity provider role assignment now supports multiple roles across SSO, Directory Sync, and AuthKit.

Developers can now manage feature flags through the Feature Flags Management API.

Developers of platforms (hosting, vibe coding, etc.) can now embed AuthKit into every app built on their platform.

WorkOS Connect now supports Client ID Metadata Document, or CIMD for use with MCP.

WorkOS now supports the Clever identity platform for SSO connections.

We’ve added an additional layer of protection to Single Sign-On to defend against login CSRF attacks and phishing attempts.

Add secure, server-first auth to Start apps with minimal setup using the AuthKit SDK for TanStack Start.

Sync active organization member counts to Stripe automatically with Stripe Seat Sync.

Add API support to your app in minutes with API Keys.

AuthKit now supports Mailgun as a custom email provider.

The branding editor now includes an AI assistant that can help make changes to your app’s branding.

WorkOS Vault now supports Azure Key Vault for bring your own key (BYOK) encryption.

The branding editor now allows you to preview AuthKit emails.

Updates to feature flags can be delivered to your slack workspace with the WorkOS slack app.

Configure WorkOS to send emails through your own Amazon SES, Postmark, Resend, or SendGrid account.

AuthKit is now available in 90 languages.

AuthKit is now the default authentication provider for Convex.

AuthKit now supports assigning multiple roles per organization membership.

The standalone SSO API now supports provider_scopes in the Authorization URL and oauth_tokens in the SSO Token output.

Developers can now target feature flags at Users in addition to Organizations.

Users can now set up SSO and view connection status in your app with the SSO status widget.

WorkOS now supports user auth into your application through the Vercel marketplace.

Users can now view and manage their verified domains in your application with the new domain verification widget.

AuthKit now displays a badge showing the user’s last-used login method.

You can now fetch feature flags for an organization via the API.

We’ve added two new events related to invitations to make it easier to track the state of pending invitations.

Enterprise IT admins can connect their AWS Key Management Service (KMS) to WorkOS Vault to bring their own key.

Add OAuth to your MCP server using your existing auth. No migration required.

List all active sessions or revoke sessions by ID with new session APIs.

Block sign-ups from disposable email services in Radar.

Customize identity provider claims for OIDC connections with standard and custom profile attributes.

Convex now has first-class support for WorkOS AuthKit as an authentication provider.

AuthKit now supports Google fonts for customizing authentication UI.

We’ve added support for three new OIDC-based SSO connection types: Okta OIDC, Entra ID OIDC (formerly Azure AD), and Google OIDC.

Token refreshes, in AuthKit, now remember the most recently used organization.

Developers can now configure custom OAuth scopes in the WorkOS Dashboard.

WorkOS Radar can now challenge suspicious sign-ups with a SMS challenge to better combat fraud and abuse.

WorkOS Radar now supports blocking traffic based on specific countries and geographic regions.

WorkOS now offers a lightweight Docker image for running FGA in local and test environments.

Allows users to securely authenticate command-line interface applications using AuthKit.

Connect Google Analytics or Segment to AuthKit to get real-time visibility into sign-ups, sign-ins, and other events.

You can now use AuthKit as a 3rd party Auth provider in Supabase.

Use feature flags to roll out new features to organizations.

Customize the look and feel of Authkit with custom CSS.

The WorkOS CLI now includes an FGA test command for validating your schema changes.

You can now set wildcards in redirect URIs for production environments.

The official WorkOS MCP Documentation server is now available!

WorkOS now emits events related to SAML certificate renewals.

Access JWT claims from the access token used in FGA checks with the new jwt_claim policy helper.

User's emails can now be changed via API or the dashboard.

AuthKit can now be used for MCP server authorization.

Custom attributes now support mapping from SAML responses during SSO.

Admin Portal now alerts customers to verify domains before setting up a SSO connection.

New FGA policy helpers make it easier to write dynamic, context-aware policies.

Use your existing authentication provided by WorkOS to secure your remote MPC server running on Cloudflare

Support logins that originate outside of your application, like from bookmarks, with less effort.

Introducing WorkOS Guides, your new go-to hub for mastering authentication, authorization, user provisioning, security, and more.

Add context to your LLM prompts with ease using the new “Copy as Markdown” feature in the WorkOS product documentation.

IT admins can now map roles to identity provider groups during Single Sign-On setup in the Admin Portal.

Define and use policies in your authorization schema with WorkOS Fine-Grained Authorization (FGA)

Learn how to use WorkOS with on-prem customers

Developers can enable password history to reject up to 10 previously used passwords for a user.

New widgets are available for a complete user profile experience and organization switching.

WorkOS now supports eight new built-in login providers for AuthKit.