Changelog

Environment creation is now available in the WorkOS dashboard from the environment selector. You can create new staging or production environments as needed. Environments can also be renamed to differentiate them. Additional details are available in the documentation.

There's a new language to our SDK toolbelt: Rust!

The SDK provides async-first access to the WorkOS API with generated, strongly typed resource APIs, a builder-based client, structured error handling, safe retry behavior, and stream-based auto-pagination. It also includes helpers for common WorkOS flows including AuthKit, SSO, PKCE, webhook verification, JWKS, Passwordless, and Vault local crypto.

Get started by installing the crate with cargo add workos, then check out the crate docs and GitHub repository.

You can now create API keys scoped to individual users in an organization. This extends the existing organization-scoped API keys. The API keys widget has been extended to support management of user API keys. Organization admins can manage and revoke user API keys for organization members giving them more control over their organization.

The WorkOS Node SDK now includes a runtime client that maintains an in-memory view of your flags in sync. Evaluations happen synchronously and locally, eliminating network calls per check. Developers can instantiate a shared client at application startup and retrieve flag state from anywhere within their service. The runtime also supports receiving events when flag state changes.

You can now control access to individual MCP servers using resource indicators. When an MCP client requests a token, AuthKit scopes it to the specific MCP server the client asked for, so a token issued for one server can't be used with another. This gives you cleaner access boundaries across multiple MCP servers running under the same AuthKit environment. See the MCP integration guide to set it up.

The Admin Portal now supports collecting and managing multiple IT contacts, previously known as organization admins. Enable collection from Configuration > Emails in the Dashboard. When enabled, Admin Portal setup flows — including SSO, Directory Sync, and certificate renewal — will include a step to collect an IT contact email. After setup, users can view and manage their IT contacts list from the Admin Portal post-configuration page.

Organizations can now have up to 20 contacts, up from one. You can manage this list yourself in the dashboard under an organization's settings page. You can also pre-populate contacts when generating an Admin Portal link via admin_emails.

Group organization memberships together using the new Groups API. Make named groups to organize users by team, department, or organizational unit, and manage group memberships through the API. Check out the Groups API docs to learn more.

Custom roles can now be scoped to specific resource types like workspaces or projects, in addition to applying organization-wide. The dashboard now features a refreshed custom roles UI for managing roles and permissions. Visit the FGA documentation to learn more.

New API endpoints support allowing users to change their own email address with built in verification and fallback.

Users can initiate the email change but need to verify the new email address before their email address is updated. Check out the docs here and here to learn more.

We've added additional predefined attributes that are automatically mapped from directory providers giving you richer user profile data out of the box. display_name, employee_number, manager_name, manager_id, organization, and phone_numbers are now available to enable in the dashboard. Visit the custom attributes docs to learn more.

You can now edit user and organization metadata, including external IDs, from the dashboard. Additionally, external IDs can be provided when manually creating users or organizations.

To prevent misconfigurations, the metadata editor includes safeguards that:

• Encourage using keys already present in your JWT templates
• Discourage deleting keys in use

Learn more about metadata in the documentation.

Widgets can automatically translate text in your users' preferred language, with support for 90 languages out of the box. If your website is already localized in multiple languages, then Widgets can match the page's language, giving your users a consistent experience. Dates are also formatted with respect to the user's locale. Learn how to get started in the docs.