WorkOS

Feature Flags now supports custom targets, giving you control over rollouts beyond users and organizations. Define the resources that matter to your product, such as workspaces, plans, environments, or regions, then enable features for specific IDs. This makes it easier to run…

Support IDP managed access to your MCP server

View your full SCIM request and response payloads from your identity provider directly in the Dashboard to debug provisioning issues.

Give your AI agents their own identity: secure, scoped, instantly revocable.

You can now retain Audit Log events for up to 10 years

WorkOS introduces a Waitlist API that replaces the signup form with a waitlist form, letting you approve or deny each request and email approved users an invitation. Entries can be managed programmatically — list, add, approve, or deny — and AI agents can do the same through the WorkOS MCP server.

You can now manage groups directly in the WorkOS Dashboard, including creating groups, adding and removing members, and deleting them. Assigning roles to a group automatically grants them to current and future members.

OIDC SSO connections now support per-connection settings including PKCE, userinfo endpoint claims, token endpoint authentication via private key JWT, and pinned ID token signing algorithms. IT admins can update client ID and secret from the Admin Portal after setup without resetting the connection.

Cloudflare Email Service is now available in WorkOS as a custom email provider, letting you deliver AuthKit invitations, magic codes, Radar challenges, and Admin Portal notification emails using your own Cloudflare account credentials.

New coroutine-first Android SDK provides typed resource APIs, structured error handling, safe retry behavior, and Kotlin Flow-based auto-pagination for AuthKit and the WorkOS API, plus helpers for native auth flows, session management, webhook verification, and Vault local crypto. PublicClient requires only a client ID—no API key or secret embedded.

AuthKit sign-ups and invitations for email addresses that can't receive mail are now rejected at the point of entry, so typos surface immediately and bounce rates drop. Dummy addresses on example.com, example.net, example.org, or any .test domain remain accepted and excluded from email sends.

Introduces SCIM Bridge, a proxy that dual-writes requests from existing SCIM connections to WorkOS, enabling migration with zero downtime and safe rollbacks. A control panel allows backfilling data per connection, monitoring, and rolling back before cutover.

New users who accept an invitation within 10 minutes of the invitation email being sent are now automatically considered verified, skipping the separate email verification step. The authentication.email_verification_succeeded event is still emitted; email_verification.created is not.

WorkOS introduces Pipes Token Proxy, which proxies third-party API requests through WorkOS and automatically swaps in the user's credential based on user and organization context, so you don't handle secrets directly. Access requires contacting support.

Relay proxies requests to third-party applications through WorkOS, automatically swapping in the user's credential based on context, so you never handle secrets directly. Access is available by contacting support.

First mobile native SDK for iOS provides async-first access to AuthKit and the entire WorkOS API from Swift, with generated typed APIs, structured error handling, safe retry, and AsyncSequence-based auto-pagination. Includes helpers for native auth flows, webhook verification, and Vault local crypto; PublicClient requires only client ID, no embedded secrets.

Atlas is a new AI coworker that works in Slack — mention @Atlas in any channel, thread, or DM to start with shared team context. Custom agents can be built with their own name, job, and scoped tools, then mentioned like any other team member.

Agents are knocking on your product's door and bouncing off browser auth built for humans. Agent Registration turns that traffic into signups using auth.md, the open protocol for agent registration now built into AuthKit.

Pipes now supports providers that authenticate with API keys, letting users connect tools without OAuth by entering a key directly in the Pipes widget. WorkOS stores it as a managed credential, and the Pipes credentials API vends whichever credential type the provider uses.

WorkOS released @workos/emulate, an open-source local API server that lets you test WorkOS integrations without hitting a live environment. Supports seeding users, organizations, RBAC, SSO connections, and AuthKit end-to-end flows including SSO redirect and webhook events.