DOCSEARCHbyAlgolia
Submit Docs

WorkOS Documentation: AuthKit, Admin Portal, and Audit Logs

website·Indexed Apr 14, 2026

https://workos.com/docs/

Official documentation for WorkOS, covering AuthKit for authentication flows, Admin Portal for SSO and directory sync, and Audit Logs for event streaming to destinations like Datadog and Splunk. Includes guides on SDKs, migrations, custom branding, and integration with providers such as Google Analytics, Segment, and Stripe.

Tokens
329.3K
Snippets
155
Records
2.3K
Agent score
50%

What's inside WorkOS Docs

  1. Overview of SAML Signing Certificates

    SAML signing certificates are X.509 certificates used to verify the authenticity of SAML messages.

    1. SAML Response Signing: The Identity Provider (IdP) signs the SAML response. The Service Provider (SP/WorkOS) uses the public key from the IdP's certificate to verify the response has not been tampered with.
    2. SAML Request Signing: The Service Provider (WorkOS) signs the SAML request. The IdP uses the public key from WorkOS's certificate to verify the request's authenticity.

    For response signing, the IdP's certificate must be provided to WorkOS. For request signing, WorkOS provides an SP metadata URL that the IdP must consume.

  2. Overview: PingFederate SCIM Integration with WorkOS

    The PingFederate SCIM Connector enables directory synchronization between WorkOS and a PingFederate instance. This integration allows you to sync users and groups provisioned for your application. To establish the connection, you need two key pieces of information from WorkOS: an SCIM Endpoint URL and a Bearer Token for authentication. The setup involves configuring the WorkOS directory first, then installing and configuring the SCIM Connector within the PingFederate instance.

  3. Overview of the Organization Switcher Widget

    The Organization Switcher widget allows users to switch between organizations within a WorkOS application. It is implemented via the <OrganizationSwitcher /> component from the @workos-inc/widgets package. No special permissions are required for users to switch between organizations they already have access to. If the target organization requires SSO or MFA, the user will be automatically redirected to reauthorize with that organization.

  4. Overview: Radar automated fraud and abuse protection

    Radar is an automated protection layer for AuthKit that monitors user sign-in behavior to identify and block abusive or anomalous activity. It collects behavioral signals to detect threats such as bots, fraud, and abuse. When suspicious activity is detected, Radar can automatically block or challenge the authentication attempt based on your configuration. A key feature is device fingerprinting, which allows Radar to distinguish between legitimate and malicious users by tracking the specific client used for authentication. This helps prevent automated protections from impacting app availability during attacks and identifies patterns like a single device used for multiple accounts or multiple devices accessing the same account.

  5. Overview of WorkOS Events

    Events in WorkOS represent activity that has occurred within the WorkOS platform or within third-party identity and directory providers. They are primarily used to keep your application in sync with WorkOS data. To understand how to consume these events in your application, refer to the data syncing guide.

  6. Overview: SCIM v2.0 Directory Sync with WorkOS

    SCIM (System for Cross-domain Identity Management) v2.0 allows organizations to synchronize users and groups from their identity provider (IdP) or SCIM server directly to your application via WorkOS. WorkOS acts as the intermediary, receiving data from the organization's SCIM server and making it available to your application. This setup enables real-time updates when users or groups are assigned or modified in the organization's directory.

  7. Overview of AuthKit Actions

    AuthKit Actions allow you to customize authentication and user registration flows by injecting custom logic. When an action is configured, WorkOS synchronously calls your endpoint and waits for a response to allow or deny the operation. The request payload includes contextual metadata such as the user profile, associated organization, and IP address, which can be used for decision-making logic.

  8. Overview of Organization Roles

    Organization roles are access control resources defined at the organization level, allowing individual organizations to create custom roles tailored to their specific needs. Unlike environment roles which apply across all organizations, organization roles are specific to a single organization.

    Key characteristics:

    • Can be assigned to organization memberships, directory users, and SSO profiles.
    • Each role has a unique slug identifier within the organization.
    • When listing roles, both environment roles and organization roles are returned in priority order (environment roles first).
    • New organization roles are placed at the bottom of the organization's priority order.

  9. Overview of SailPoint SCIM Directory Sync

    SailPoint SCIM v2.0 integration allows an organization's IT team to synchronize users and groups from their SailPoint SCIM server directly to your application via WorkOS. WorkOS acts as the intermediary, receiving requests from the SailPoint server and forwarding them to your application's directory sync endpoint. This setup enables real-time updates to your application's user and group data whenever changes occur in the organization's directory.

  10. Overview: Segment AuthKit Add-on

    The Segment AuthKit Add-on registers AuthKit as a Segment source, enabling the forwarding of authentication events (logins, sign-ups, and other activities) to your Segment destinations. This integration allows you to analyze user journeys and marketing campaign effectiveness by combining AuthKit data with your existing analytics.

  11. Overview of Widget Localization

    WorkOS Widgets support automatic translation of text into 90+ languages and format dates according to the user's locale. Widgets can automatically match the language of your website to provide a consistent user experience. The system also supports Right-to-Left (RTL) languages like Arabic and Hebrew by inheriting the text direction from the HTML element.

  12. Overview of Intuit OAuth integration

    The Intuit OAuth integration allows your users to authenticate using their Intuit credentials via WorkOS SSO. This encapsulates the standard Intuit OAuth flow, eliminating the need to build the authentication logic manually. It supports both AuthKit's Hosted UI and custom authentication flows.