WorkOS operator

Wire and repair AuthKit sign-in, covering the hosted sign-in and sign-up URLs, organization-scoped sign-in, the callback exchange, encrypted session cookies, middleware refresh of short-lived access tokens, reading the user and role on the server, protecting routes by default, impersonation, and sign-out. Use when sign-in must be added or fixed, when users are unexpectedly signed out, when a callback fails, or when route protection must be added.

Answer quick WorkOS questions with a compact reference for AuthKit sign-in and callback calls, session helpers, single sign-on and directory sync APIs, organization and membership calls, user management, webhook verification, environment values and their scope, and the staging versus production distinction. Use when someone asks which WorkOS call or environment value to use, or wants a fast lookup rather than a guided workflow.

Set up and reconcile directory sync, covering the Admin Portal handoff for SCIM and directory providers, directory states, cursor-paginated listing of users and groups, mapping directory users and groups onto local records and roles, handling activate and deactivate events rather than deletions, group membership changes, and a full reconciliation pass when events were missed. Use when an enterprise customer must provision users automatically, when a directory shows fewer users than expected, or when deprovisioning has not taken effect in the application.

Inspect which WorkOS environment an application targets, which API key and client id it holds, whether the redirect URI matches a registered one, the cookie password strength, the configured connections and directories per organization, and which webhook endpoints exist, without changing anything. Use before a WorkOS operation, when sign-in fails on a redirect, when an object seems missing, or when the user asks whether WorkOS is set up.

Connect WorkOS to the systems around it, covering framework SDKs and session middleware, mirroring users and organizations into a local database, scoping every query by the organization from the session, protecting an API boundary with a verified token, machine-to-machine access, tying billing to an organization, and staging versus production promotion. Use when WorkOS identity must reach a local user table, when an API or another service must trust a WorkOS session, or when tenant scoping must be enforced.

Discover, compatibility-check, install, update, list, or remove WorkOS's first-party coding-agent skills. Use when asked about WorkOS native skills, workos skills commands, AuthKit agent setup, or whether the installed WorkOS skill matches the project's current SDK.

Manage WorkOS organizations and their members, covering creating organizations, verified domains and domain-based joining, memberships and role slugs, invitations, listing and pagination, mapping an organization onto a local tenant record, switching the active organization in a session, and deleting an organization and what that removes. Use when a tenant must be created or renamed, when a domain must be added, when members or roles must change, or when a user belongs to more than one organization.

Set up WorkOS in an application from zero, covering the environment and API key, client id, a cookie password of sufficient length, registered redirect URIs, the AuthKit SDK install and callback route, middleware for session refresh, the sign-out redirect, and keeping staging separate from production. Use when an application has no WorkOS wiring, when keys and redirect URIs must be configured, or when the user asks how to get WorkOS working.

Configure and test enterprise single sign-on connections, covering SAML and OpenID Connect connection types, the Admin Portal handoff to a customer's identity provider administrator, connection states, domain verification and identifier-first routing, attribute and profile mapping, just-in-time provisioning, and testing a connection before it goes live. Use when an enterprise customer must sign in with their own identity provider, when a connection is inactive or misconfigured, or when profile attributes arrive wrong or missing.

Diagnose WorkOS failures from reproducible evidence, covering wrong environment and key mismatches, unregistered or mismatched redirect URIs, short cookie passwords, missing session refresh, inactive connections and directories, partial directory listings from unpaginated reads, webhook signature failures and duplicate delivery, missing role slugs after promotion, and cross-tenant scoping mistakes. Use when sign-in fails or loops, when users are unexpectedly signed out, when an object seems missing, or when events arrive but nothing happens.

Receive and handle WorkOS webhook events safely, covering endpoint registration per environment, signature verification against the raw request body, replay-window tolerance, idempotency keyed on the event id, acknowledging quickly and processing afterwards, ordering and out-of-order delivery, retries and failure handling, and local delivery for development. Use when an endpoint must consume WorkOS events, when events arrive but nothing happens, when signature verification fails, or when an event has been applied twice.