APP INTEGRATIONS · FOR AI AGENTS
WorkOS
Manage identity resources and authorize access to your MCP services.
Use WorkOS’s management MCP server to operate organizations, users and connections. AuthKit separately provides OAuth authorization for MCP servers you build.
Your integration checklist
- Capabilities
- What you need from your owner
- Create a WorkOS workspace, select staging or production, configure the application and identity connections, and approve the agent’s dashboard account access. Production requires billing information.
- Authentication
- The management endpoint https://mcp.workos.com/mcp uses OAuth and inherits the signed-in dashboard role. API integrations use environment-specific credentials. AuthKit-issued tokens for your own MCP server are a separate authorization flow.
- Your first task
- Read a known staging organization and its connection configuration, confirming environment and role before changing any identity resources.
- Billing & payment
- Staging is free for testing. AuthKit includes a free monthly-active-user allowance; production enterprise SSO and Directory Sync connections and selected add-ons are separately priced.
- Agent payment support
- Not verified. Programmatic usage does not establish autonomous checkout support.
- Operational limits
- Team administrators can restrict MCP access. AuthKit does not remove the need for your server to validate tokens and enforce application permissions. Staging credentials and connections are separate from production.
ORIGINAL AI AGENT STORE INTEGRATION PLAYBOOK
Keep management authorization separate from end-user access
Editorial recommendation · Reviewed 2026-10-20
When to choose this service
Choose WorkOS for maintained identity infrastructure and enterprise connections, particularly when an agent must operate your workspace or your application needs authenticated MCP access.
Identity-provider connections and maintained authentication infrastructure require external configuration, credentials and continued operation. An agent cannot infer a user’s authority or replace an organization’s identity provider with generated code.
Suggested workflow
- Identify whether the task manages WorkOS resources or authenticates clients of your own MCP server. Select the corresponding environment and credential flow.
- Use staging to verify one permitted operation and one denied operation. For your own server, check token issuer, audience and application authorization before returning data.
- Promote only the intended configuration after checking production connections and billing. Verify a real permitted user’s access and a revoked or unauthorized user’s denial.
Acceptance checks before real work
- Confirm the management account’s role and selected environment.
- Check authorization on each protected action, not just successful login.
- Keep production connection and redirect configuration explicit rather than copying staging credentials.
If the workflow fails
If access fails, inspect the environment, role and token audience before broadening permissions. Revoke the affected authorization or restore the last known configuration when access exceeds the intended boundary.