---
scope: org
organization: workos
release_count: 13
last_release: 2026-08-17
generated: 2026-06-04
updated: 2026-09-11
canonical: https://releases.sh/workos/overview.md
---

Recently shipped OIDC per-connection hardening, custom feature-flag targets, and a self-serve waitlist.

**OIDC connections are no longer one-size-fits-all.** PKCE (RFC 7636), userinfo-endpoint claims instead of ID tokens, `private_key_jwt` token auth with a downloadable public certificate, and pinned ID token signing algorithms (RS256 by default) are all per-connection settings now. Rotating a compromised secret no longer means resetting the entire connection, and IT admins configure it themselves.

**Feature Flags target anything, not just users and organizations.** Define workspaces, plans, environments, or regions and enable features for specific IDs — useful for closed betas and staged rollouts.

**Waitlist gates launches.** Enabling it replaces the signup form so demand is captured while sign-ups stay closed; entries can be approved or denied, and approved users get an invitation email. The Waitlist API manages entries programmatically, and MCP-connected agents can too.

**Groups assign roles once instead of per user.** Each organization has a Dashboard Groups tab for creating groups and managing members; a role assigned to a group applies to every current and future member.

**AI agents get their own revocable identities.** Agent Auth scopes and revokes agent credentials. MCP Enterprise-Managed Authorization lets identity providers manage access to your MCP server.

**Audit logs now retain events for up to 10 years**, and full SCIM request and response payloads are visible in the Dashboard for debugging provisioning failures.

Also shipped: native iOS and Android SDKs (coroutine- and Swift-concurrency-first, typed resources, `PublicClient` needing only a client ID), Cloudflare Email Service as a custom provider, sign-up rejections for undeliverable addresses, zero-downtime SCIM Bridge migration, and invite acceptance within 10 minutes counting as verification.