WorkOS is a developer platform that gives software companies the identity and access features enterprise buyers expect, as APIs and SDKs they can add to their own product. It saves engineering teams from building each enterprise integration themselves.
Newer products extend the same building blocks to AI agents, so that agents and MCP servers authenticate and act under the same policies as people.
At A Glance
| Vendor | WorkOS |
|---|---|
| Category | Developer APIs for authentication, SSO, directory sync and authorisation |
| Identities covered | Application end users, enterprise workforce users, AI agents and MCP clients |
| Deployment | Hosted APIs and SDKs |
| Agentic AI | MCP Auth, auth.md, Passport, Agent Auth |
| Customers | OpenAI, Anthropic, Cursor, Perplexity, Snowflake |
| Certifications | SOC 2 Type 2, GDPR and CCPA compliant |
| Funding | Series C, March 2026 |
| Market classification | Workforce IAM; also Authorisation |
What WorkOS Does
When a software company starts selling to larger organisations, the deal often depends on features that have nothing to do with the core product: SSO with the customer’s identity provider, automatic provisioning from its directory, audit logs and role-based access. Building each of these in-house, and then maintaining a separate integration for every customer’s identity provider, pulls engineers away from the product itself.
WorkOS turns that work into building blocks behind one API. The vendor maintains the connections to identity providers and directories, and each customer’s IT team can configure its own connection, so the developer integrates once and does not have to step in for every new enterprise deal.
Products
AuthKit
AuthKit is the authentication and user management layer for an application. One integration covers email and password, social login, passkeys, MFA, magic auth and enterprise SSO, so a team does not have to assemble sign-in from separate services.
Enterprise SSO And Directory Sync
These products connect an application to each enterprise customer’s identity systems. A single integration supports any SAML or OIDC identity provider, while Directory Sync manages the user lifecycle through SCIM and HRIS connections. The Admin Portal gives the customer’s IT administrator a no-code setup screen, and domain verification confirms which organisation owns which users.
Authorisation
Applications that need more than a simple admin flag can use Role-Based Access Control or Fine-Grained Authorization (FGA) for resource-level permissions. Airlock adds intent-based access control.
Security And Operations
- Audit Logs for event logging, export and streaming to a customer’s own tools
- Radar for bot and fraud protection at sign-up and sign-in
- Vault for encryption key management
- Pipes for connecting users’ third-party accounts to apps and agents
How It Works
WorkOS runs as a hosted service that developers call from their own applications through RESTful APIs and webhooks, with separate environments for development and production. SDKs are available for Node.js, Python, Go, Ruby, PHP, Java and .NET, along with framework SDKs for Next.js, React, Remix and Astro, a WorkOS CLI and a Postman collection.
| Component | What it does |
|---|---|
| Custom domains | Email, AuthKit, the Authentication API and the Admin Portal can run on the customer’s own domain. |
| On-premises identity systems | Applications on WorkOS can still serve enterprise customers whose identity providers and directories run on their own premises, and WorkOS publishes guidance for those set-ups. |
Identities And Systems Covered
| End users | People signing in to an application through AuthKit |
|---|---|
| Workforce users | Employees of enterprise customers, federated from their identity provider and provisioned through SCIM or HRIS |
| AI agents | Agents accessing applications through OAuth 2.1 flows with scopes and tool permissions |
| Identity providers | Okta, Microsoft Entra ID, Microsoft AD FS, Google Workspace, OneLogin, PingOne, PingFederate, Auth0, Keycloak, JumpCloud, Duo, CyberArk, Login.gov and generic SAML and OIDC |
| Directories and HRIS | Workday, Rippling, SailPoint, HiBob, BambooHR, Google Directory, SFTP and generic SCIM |
Agentic AI Capabilities
MCP Auth
AuthKit acts as an OAuth 2.1 authorisation server for MCP apps, so agents get access with PKCE, scopes and tool permissions. WorkOS Connect can provide only the MCP OAuth flows for an application that already has its own user base. Alongside it, auth.md handles user registration for agents and Agent Auth covers agent authentication.
Passport
Passport gives one sign-in across apps and agents and puts every MCP server under the company’s policies. Agents get access under that policy and every request is audited in the admin console. Passport is in early access.
Integrations
| Area | Integrations |
|---|---|
| Social login | Google, Microsoft, GitHub, GitLab, LinkedIn, Apple, Slack |
| Platforms | Supabase, Firebase, AWS Cognito, Stripe, Datadog |
Company Background
| Leadership | Michael Grinich, founder and CEO |
|---|---|
| Team | Remote-first, with more than 100 staff |
| Funding | A reported $100 million Series C on 2 March 2026 at a $2 billion valuation, led by Meritech and Sapphire, after an $80 million Series B in June 2022 led by Greenoaks |
| Acquisitions | Modulz, the company behind the open-source Radix and Stitches projects, in 2022 |
| Compliance | WorkOS can sign HIPAA business associate agreements |
Note: This overview is compiled from WorkOS’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.