Changelog

Pipes now allows you to configure custom providers, so you can connect any compatible data source to your application.

IT admins can now view and independently rotate bearer tokens for their SCIM directories from the Admin Portal.

WorkOS has rolled out environment creation functionality within the dashboard. Users can now manage staging and production environments through the environment selector dropdown, with the ability to create new environments and apply custom naming conventions.

Key features:

• Create new staging or production environments via the dashboard
• Rename environments for organizational purposes
• Access detailed configuration guidance in the official documentation

WorkOS has released a new Rust SDK, adding Rust to their family of SDK languages.

The Rust SDK delivers async-first access to the WorkOS API with generated, strongly typed resource APIs, a builder-based client, structured error handling, safe retry behavior, and stream-based auto-pagination.

Helpers are included for common WorkOS workflows including:

• AuthKit
• SSO
• PKCE
• Webhook verification
• JWKS
• Passwordless
• Vault local crypto

Installation

cargo add workos

Resources

• Crate docs
• GitHub repository

Organizations can now generate API keys scoped to individual users. This capability supplements existing organization-level API keys.

The API keys widget has been updated to support user-level key management, allowing organization admins to create, manage, and revoke user API keys for organization members.

Docs: API Keys (AuthKit) · API Keys widget

The WorkOS Node SDK now includes a runtime client that keeps an in-memory view of your flags in sync. Evaluations are synchronous and local, with no network call per check.

You can create a shared client during application initialization and retrieve flag state from anywhere within your service. The client also supports receiving events when flag state changes.

Learn more in the docs

WorkOS now supports resource indicators for MCP auth, giving you control over access to individual MCP servers.

When an MCP client requests a token scoped to a specific server, AuthKit issues a token that can only be used with that server — a token issued for one server can't be used with another. This creates cleaner access boundaries across multiple MCP servers operating within the same AuthKit environment.

See the MCP integration documentation for implementation details.

The Admin Portal now supports managing multiple IT contacts, expanding from a single contact previously. This feature can be enabled via Configuration > Emails in the Dashboard.

Key capabilities include:

• Setup flows (SSO, Directory Sync, certificate renewal) now collect IT contact emails
• Users can view and manage their IT contacts list post-configuration
• Organizations can maintain up to 20 contacts
• Dashboard management available under organization settings
• Pre-population support via admin_emails parameter when generating Admin Portal links

Group organization memberships together using the new Groups API. Make named groups to organize users by team, department, or organizational unit, and manage group memberships through the API. Check out the Groups API docs to learn more.

Custom roles can now be scoped to specific resource types like workspaces or projects, in addition to applying organization-wide. The dashboard now features a refreshed custom roles UI for managing roles and permissions.

New API endpoints enable users to independently modify their email address with integrated verification and backup mechanisms.

Users initiate the email change process but must verify the new email before the system updates their account. Two primary endpoints are available:

• Send Email Change Code — initiates the email change flow and sends a verification code to the new address
• Confirm Email Change — finalizes the update once the code is verified

See the AuthKit user reference documentation for full API details.

We've added additional predefined attributes that are automatically mapped from directory providers giving you richer user profile data out of the box. display_name, employee_number, manager_name, manager_id, organization, and phone_numbers are now available to enable in the dashboard. Visit the custom attributes docs to learn more.

You can now edit user and organization metadata, including external ID, from the dashboard.

Users can now modify user and organization metadata directly through the dashboard interface, including external IDs. The system supports providing external IDs during manual user or organization creation. A metadata editor offers intelligent guidance by suggesting keys already present in JWT templates and warning against deletion of keys currently in use.

Widgets can automatically translate text in your users' preferred language, with support for 90 languages out of the box.

Widgets now support automatic translation into 90 languages based on user preference. The feature intelligently matches page language settings when a website is already localized, ensuring consistency across the user experience. Date formatting automatically adapts to the user's locale settings.

See the WorkOS documentation for implementation guidance.

The JWT Debugger is a free, browser-based tool for decoding, verifying, and inspecting JSON Web Tokens.

• Paste tokens to view decoded header, payload, and signature instantly
• Verify signatures to detect tampering
• Check expiration and time-based claims
• Generate new JWTs with custom header, payload, and signature details
• All processing occurs client-side, keeping tokens in the browser
• No WorkOS account required

The WorkOS API now includes an open-source OpenAPI specification available on GitHub. This machine-readable contract documents every endpoint across AuthKit, Single Sign-On, Directory Sync, Audit Logs, and Fine-Grained Authorization.

Key capabilities enabled by this spec:

• Generate typed clients in multiple programming languages
• Import endpoints into tools like Postman or Insomnia
• Build automations and CI pipeline validations
• Validate API requests and responses

The specification adheres to the OpenAPI 3.1 standard and is distributed under the MIT license through the WorkOS GitHub repository.

Widget Skills enable AI agents to generate native app implementations of WorkOS workflows including user management, domain verification, and SSO setup. The generated output is framework-specific, styled according to your design system, and ready for codebase integration.

Rather than embedding a Widget component directly, developers can direct their coding agent to Widget Skills for a production-ready implementation built on the same underlying APIs. The resulting code remains yours to customize and extend. Launch with npx skills add workos/skills or explore additional details in the accompanying blog post.

Pipes MCP is a deployable MCP server that gives agents time-limited access to third-party data connections.

If you use Pipes to connect to Google Workspace, GitHub, Slack, or other third-party providers, Pipes MCP exposes those connections as discoverable tools via MCP. The difference from using Pipes directly is that agent access is scoped to a session, not to the lifetime of the OAuth token. Users can approve the agent's initial access and changes to that access as the agent works.

Get started on GitHub or learn more in the blog.