WorkOS

Recently shipped OIDC per-connection hardening, custom feature-flag targets, and a self-serve waitlist.

OIDC connections are no longer one-size-fits-all. PKCE (RFC 7636), userinfo-endpoint claims instead of ID tokens, private_key_jwt token auth with a downloadable public certificate, and pinned ID token signing algorithms (RS256 by default) are all per-connection settings now. Rotating a compromised secret no longer means resetting the entire connection, and IT admins configure it themselves.

Feature Flags target anything, not just users and organizations. Define workspaces, plans, environments, or regions and enable features for specific IDs — useful for closed betas and staged rollouts.

Waitlist gates launches. Enabling it replaces the signup form so demand is captured while sign-ups stay closed; entries can be approved or denied, and approved users get an invitation email. The Waitlist API manages entries programmatically, and MCP-connected agents can too.

Groups assign roles once instead of per user. Each organization has a Dashboard Groups tab for creating groups and managing members; a role assigned to a group applies to every current and future member.

AI agents get their own revocable identities. Agent Auth scopes and revokes agent credentials. MCP Enterprise-Managed Authorization lets identity providers manage access to your MCP server.

Audit logs now retain events for up to 10 years, and full SCIM request and response payloads are visible in the Dashboard for debugging provisioning failures.

Also shipped: native iOS and Android SDKs (coroutine- and Swift-concurrency-first, typed resources, PublicClient needing only a client ID), Cloudflare Email Service as a custom provider, sign-up rejections for undeliverable addresses, zero-downtime SCIM Bridge migration, and invite acceptance within 10 minutes counting as verification.