WorkOS

WorkOS introduces a Waitlist API that replaces the signup form with a waitlist form, letting you approve or deny each request and email approved users an invitation. Entries can be managed programmatically — list, add, approve, or deny — and AI agents can do the same through the WorkOS MCP server.

You can now manage groups directly in the WorkOS Dashboard, including creating groups, adding and removing members, and deleting them. Assigning roles to a group automatically grants them to current and future members.

OIDC SSO connections now support per-connection settings including PKCE, userinfo endpoint claims, token endpoint authentication via private key JWT, and pinned ID token signing algorithms. IT admins can update client ID and secret from the Admin Portal after setup without resetting the connection.

Cloudflare Email Service is now available in WorkOS as a custom email provider, letting you deliver AuthKit invitations, magic codes, Radar challenges, and Admin Portal notification emails using your own Cloudflare account credentials.

New coroutine-first Android SDK provides typed resource APIs, structured error handling, safe retry behavior, and Kotlin Flow-based auto-pagination for AuthKit and the WorkOS API, plus helpers for native auth flows, session management, webhook verification, and Vault local crypto. PublicClient requires only a client ID—no API key or secret embedded.

AuthKit sign-ups and invitations for email addresses that can't receive mail are now rejected at the point of entry, so typos surface immediately and bounce rates drop. Dummy addresses on example.com, example.net, example.org, or any .test domain remain accepted and excluded from email sends.

Introduces SCIM Bridge, a proxy that dual-writes requests from existing SCIM connections to WorkOS, enabling migration with zero downtime and safe rollbacks. A control panel allows backfilling data per connection, monitoring, and rolling back before cutover.

New users who accept an invitation within 10 minutes of the invitation email being sent are now automatically considered verified, skipping the separate email verification step. The authentication.email_verification_succeeded event is still emitted; email_verification.created is not.

WorkOS introduces Pipes Token Proxy, which proxies third-party API requests through WorkOS and automatically swaps in the user's credential based on user and organization context, so you don't handle secrets directly. Access requires contacting support.

Relay proxies requests to third-party applications through WorkOS, automatically swapping in the user's credential based on context, so you never handle secrets directly. Access is available by contacting support.

First mobile native SDK for iOS provides async-first access to AuthKit and the entire WorkOS API from Swift, with generated typed APIs, structured error handling, safe retry, and AsyncSequence-based auto-pagination. Includes helpers for native auth flows, webhook verification, and Vault local crypto; PublicClient requires only client ID, no embedded secrets.

Atlas is a new AI coworker that works in Slack — mention @Atlas in any channel, thread, or DM to start with shared team context. Custom agents can be built with their own name, job, and scoped tools, then mentioned like any other team member.

Agents are knocking on your product's door and bouncing off browser auth built for humans. Agent Registration turns that traffic into signups using auth.md, the open protocol for agent registration now built into AuthKit.

Pipes now supports providers that authenticate with API keys, letting users connect tools without OAuth by entering a key directly in the Pipes widget. WorkOS stores it as a managed credential, and the Pipes credentials API vends whichever credential type the provider uses.

WorkOS released @workos/emulate, an open-source local API server that lets you test WorkOS integrations without hitting a live environment. Supports seeding users, organizations, RBAC, SSO connections, and AuthKit end-to-end flows including SSO redirect and webhook events.

WorkOS can now be connected to Claude or ChatGPT in a single click through their respective marketplaces, enabling management of WorkOS environments directly via MCP across Claude, Claude Code, ChatGPT, or Codex.

Two new read-only roles join the Dashboard: Sandbox Developers (Developer-level access, read-only in production) and Support Viewers (Support-level access, read-only in all environments). Both can be mapped to IdP groups via Directory Sync.

Radar now supports custom AuthKit UIs built on the User Management APIs, with extended API signals to detect and block malicious traffic. Contact support to enable this workflow.

AuthKit support for Astro is now available via the @workos-inc/authkit-astro package, including sign up/sign in flows, user management, SSO integration, route middleware, and full TypeScript support.

The Widgets API is a session-aware GraphQL API that lets browsers query WorkOS data directly via short-lived, origin-pinned tokens, eliminating the need for backend proxying. Coding agents can introspect the schema without documentation. Currently covers user management, sessions, and profile data.