July 2026 Summaries

On July 28, 2026, the MCP protocol was finalized, transitioning to a stateless core, which enhances authorization to align with OAuth 2.1 and OIDC standards and officially introduces MCP Apps and Tasks as part of a versioned extensions framework. These changes eliminate the need for session-based transport, allowing any server instance to handle requests efficiently without session persistence. This update emphasizes a closer alignment with real OAuth practices, requiring MCP servers to implement OAuth 2.1 features like Protected Resource Metadata and Resource Indicators to ensure secure and specific token usage. A small internal tool example, an expense approval board, demonstrates the practical application of these principles by enabling stateless deployment, enforcing permissions per tool with WorkOS AuthKit, and ensuring secure authorization at the handler level rather than the UI. This approach highlights the significance of integrating both UI and authorization measures in a stateless environment, providing a comprehensive model that stands apart from previous session-based methods.

A refined prompt developed months ago revealed significant logic vulnerabilities that had eluded existing automated tools and manual reviews, prompting an initiative to enhance the efficiency and effectiveness of vulnerability detection using frontier models. These models, when properly guided, can identify complex logic bugs that traditional methods often miss, highlighting the importance of a nuanced understanding of code, data flows, and product specifics. To address the challenge of high signal-to-noise ratios in security scanner outputs, a three-part pipeline was established, focusing on comprehensive coverage, accurate signal differentiation, and continuous improvement. This system ensures thorough examination of all code areas, prioritizes severe vulnerabilities, and integrates feedback to refine the detection process. The methodology, which includes mapping data flows, threat modeling, and hypothesis testing, has led to the discovery of numerous high-severity issues overlooked by conventional techniques. The initiative emphasizes the importance of explicit severity assessment and capability delta, ensuring findings are actionable and impactful. Since its inception, the pipeline has significantly reduced false positives and improved vulnerability management, demonstrating the value of integrating sophisticated machine learning models with structured security engineering insights.

Michael Grinich, founder and CEO of WorkOS, engaged in a thought-provoking conversation with renowned AI interviewer Dwarkesh Patel at Dwarkesh Unplugged, covering a range of topics from the exponential growth in AI to the societal implications of its future development. Patel, with his extensive experience and notable guests like Mark Zuckerberg and Satya Nadella, emphasized that while exponential growth may seem static from within, it fundamentally reshapes industries and societies, particularly as AI technologies evolve. He discussed his approach to interviews, focusing on extracting actionable insights by thoroughly understanding the technology and preparing targeted questions. Patel posited a future where AI could perform tasks at a scale humans cannot, raising questions about economic structures and potential loss of control, suggesting that the real risk lies in AI systems operating independently of human oversight. He also highlighted the communication challenges surrounding AI, pointing out its unpopularity and the necessity of articulating its benefits to the general public to ensure its development remains a global effort. The conversation underscored the importance of addressing the political and social dimensions of AI, beyond just the technical advancements.

MCP 2026-07-28 introduces significant changes to the protocol, emphasizing a stateless server design with enhanced security features through the integration of OAuth 2.1 and AuthKit as the authorization server. This update separates the roles of the MCP server as the resource server responsible for verifying bearer tokens, and AuthKit, which handles login, consent, token issuance, and the JWKS endpoint. The protocol allows for stateless transport, eliminating the need for sticky sessions and enabling server deployment behind load balancers or on serverless architectures. To comply with the new specifications, servers must publish resource metadata and verify tokens on every request, moving away from session-dependent state management to explicit handles. The shift from Dynamic Client Registration to Client ID Metadata Document ensures streamlined client identification, while maintaining backward compatibility. These changes aim to improve scalability and security by removing session dependencies and ensuring precise token verification.

Customer identity and access management (CIAM) has evolved from simple password logins to a complex system accommodating diverse authentication needs by 2026. Enterprises now demand support for SAML or OIDC SSO and SCIM directory sync, while individual users prefer passwordless options like passkeys and magic links. Companies must choose the right CIAM platform to avoid extensive integration work, scalability issues, and potential migration challenges. The guide evaluates seven leading CIAM providers, each suited for different needs, from WorkOS, which integrates enterprise SSO and passwordless authentication seamlessly, to Keycloak, an open-source option for those with robust engineering resources. It emphasizes the importance of selecting a platform that can handle both enterprise demands and individual user experiences, ensuring scalability and security without overburdening development teams.

The text critiques the conventional approach of categorizing CIAM (Customer Identity and Access Management) providers into distinct categories, arguing that this method does not reflect the real purchasing journey of B2B SaaS companies. It emphasizes that the progression from basic login to advanced features like SSO, SCIM provisioning, audit logs, and role-based access control is a continuous path rather than separate markets. The text suggests that evaluating providers based on their ability to support a company's growth without requiring platform changes is more important than relying on traditional rankings. It highlights WorkOS as an example of a provider that offers a unified platform capable of supporting this growth trajectory by allowing companies to add features like SSO and SCIM without switching providers, thus providing a more practical and adaptable solution for scaling enterprises.

"App-in-a-box" refers to a set of prebuilt UI components designed to accelerate the development of applications by providing ready-made solutions for user interactions and administrative functions, such as sign-ups, MFA, and profile management. This concept allows developers to forgo the design and build processes for standard components, enabling faster production times, though it may limit control over customization and design in the long run. While many vendors offer "app-in-a-box" solutions, it's crucial to evaluate their claims critically, ensuring that the package includes comprehensive administrative interfaces and checking for flexibility in customization to avoid hitting a functional ceiling later. WorkOS provides a distinctive approach with its AuthKit and Admin Portal, offering both prebuilt UI and API-first options, allowing for customization beyond initial setups. Ultimately, "app-in-a-box" is beneficial for teams prioritizing speed and simplicity over extensive customization but requires careful assessment of vendor offerings to align with long-term needs.

The live interview between Dwarkesh Patel and Dr. Fei-Fei Li at Dwarkesh Unplugged explored the evolution of AI, emphasizing the critical role of data over clever algorithms in advancing the field. Dr. Li recounted her experience in the development of ImageNet, which provided a vast dataset that catalyzed breakthroughs in AI by allowing convolutional neural networks to flourish when paired with sufficient data and computational power. The interview highlighted the shift from individual contributions to large-scale team efforts in AI research, akin to high-energy physics, as AI models now require extensive resources and collaboration for advancement. Dr. Li noted the shift from data scarcity to an abundance, which, while beneficial for recall, still leaves models unable to generate entirely new ideas, underscoring the divergence between machine and human intelligence. Ultimately, Dr. Li expressed her belief in the continued importance of human insight in the AI landscape, emphasizing that the frontier of intelligence lies where machines cannot yet reach.

Maintaining consistency across multiple SDKs for APIs has been streamlined by using a custom-built tool that automates the generation and release process, addressing challenges such as manual edits across seven repositories and language-specific conventions. The workflow begins with a single OpenAPI spec that feeds into open-source tools, oagen and oagen-emitters, to generate idiomatic code for different languages, with a focus on maintaining a stable and consistent release process without breaking customer builds. The pipeline is managed through a dashboard that facilitates spec changes, validation, and release, allowing for automated or manual oversight as needed. This system includes features like dry runs, which simulate the release process without making permanent changes, and a changelog generation that prioritizes the most significant updates. The final release still requires human intervention to ensure quality control, blending automation with manual checks to achieve efficient and reliable SDK maintenance. The tools used, including oagen and oagen-emitters, are open source, offering an alternative to relying on third-party vendors for those maintaining multi-language client libraries.

IAM (Identity and Access Management) and CIAM (Customer Identity and Access Management) are both concerned with identifying individuals and determining their access rights, but they cater to different audiences. IAM is typically used for managing workforce identities within an organization, focusing on control, compliance, and lifecycle management, with tools like SCIM provisioning and role-based access control. Conversely, CIAM is aimed at managing external users such as customers and partners, prioritizing seamless signup processes and user experience to minimize friction and support growth. The distinction between these two systems is crucial, as a system designed for workforce management can create barriers for customer conversion, while a customer-focused system may lack the governance and audit capabilities needed for workforce management. Many organizations, therefore, operate separate systems for IAM and CIAM, even if a single vendor offers both solutions. In B2B SaaS environments, the lines between IAM and CIAM can blur as customers often require enterprise-grade features like single sign-on, which is where WorkOS provides a solution. WorkOS offers pre-built connectors for enterprise identity features like SCIM provisioning and directory sync, bridging the gap between customer and workforce identity needs without requiring extensive development efforts from engineering teams.

WorkOS developed a program called UI Nits to enhance product quality by addressing minor user interface issues, which evolved from a simple Slack channel into an automated, efficient pipeline for resolving these details quickly. Initially, team members would report UI problems without any structured process, but by linking this to the Linear platform, the company could track, measure, and celebrate their progress in fixing issues weekly. The introduction of a cloud-based triage skill enabled the automated enrichment of tickets, providing context and suggested solutions, thus streamlining the process and allowing agents to handle most tasks autonomously. This system now integrates with WorkOS's self-driving codebase, Horizon, which automatically fixes high-confidence tickets, leaving only the final review to humans. This approach has maintained both high velocity and quality standards, enabling fast shipping without compromising on detail, and ensuring that the entire company adheres to a consistent quality bar.

Building and maintaining OAuth integrations often requires significantly more time and resources than initially estimated due to the complexity and scope beyond just the authorization flow. This involves managing client credentials, handling token storage with encryption, implementing token refresh logic with distributed locking, and dealing with provider-specific quirks such as error handling and revocation detection. Each integration demands continuous maintenance due to frequent provider API changes, and a single integration can cost approximately $48,000 per year when considering engineering, maintenance, and customer support. Multiple integrations exacerbate these challenges as each provider presents unique requirements that do not scale linearly with existing infrastructure. Solutions like WorkOS Pipes aim to simplify these processes by offering a unified infrastructure across different providers, reducing the time and effort required to build and manage OAuth integrations, thus allowing teams to focus more on their core products.

Bring Your Own Key (BYOK) has become a standard expectation in enterprise software, serving as a procurement checkbox rather than a differentiator, as it allows customers to use their own encryption keys for enhanced data control. BYOK permits customers to store their own encryption keys in systems like AWS KMS or Azure Key Vault, enabling them to control access to their encrypted data, particularly in regulated industries and compliance frameworks that require customer-controlled encryption. The primary advantage of BYOK is its provision of a guaranteed method for customers to render their data unreadable by revoking access to their key, which is crucial for data sovereignty and security maturity. While BYOK enhances control over data access, it does not prevent applications from accessing data during normal operations, nor does it safeguard against application-layer vulnerabilities. Implementing BYOK involves configuration rather than a full-scale engineering project, particularly for applications using WorkOS Vault, which simplifies the process through guided customer IT setups, while allowing organizations to tier BYOK as an enterprise feature to meet specific security needs.

The checklist is designed for developers reviewing or creating a custom SAML service provider implementation, focusing on code and configuration rather than broader architectural decisions. It highlights common vulnerabilities in SAML implementations, often arising from incorrect choices in XML parser setup, signature validation, and assertion extraction. Key recommendations include disabling DTD processing to prevent XXE injection, using a single parser instance for the entire SAML response, validating the presence and correctness of signatures using absolute XPath expressions, and rejecting deprecated signing algorithms like SHA-1. The checklist also emphasizes the importance of validating essential assertion fields, such as the issuer, audience restriction, destination, and timestamps, to prevent authentication bypasses. Replay prevention and proper certificate handling during rotations are crucial to maintaining security. Developers are advised to run automated tests to ensure all validation gaps are closed and consider using platforms like WorkOS for handling complex SAML tasks if identity infrastructure is not their core product focus.

SCIM integrations begin with systems establishing trust to automate user lifecycle management via APIs, yet the SCIM specification lacks guidance on authentication and authorization, often leading implementers to rely on long-lived bearer tokens, which pose security risks due to their static nature. OAuth 2.0's Client Credentials grant type offers a more secure alternative by facilitating short-lived token exchanges between the identity provider and SCIM server, reducing the risk of leaked credentials and allowing for seamless rotation without disrupting service. Despite its advantages, the transition to Client Credentials has been slow, partly due to historical reliance on bearer tokens and challenges in implementing comprehensive support across various identity providers. WorkOS addresses these challenges by supporting Client Credentials for SCIM directories, providing directory-level credential isolation and automated token management, thus enhancing security and operational flexibility for administrators and developers.

WorkOS has introduced a plugin available in the ChatGPT and Codex plugin directory, revolutionizing how users can manage their WorkOS workspace by allowing them to operate in plain language. This plugin enables users to perform tasks such as setting up SSO and Directory Sync connections, creating organizations, inviting users, adjusting authentication policies, pulling audit log events, and configuring AuthKit branding through simple queries. The plugin maps user inquiries to corresponding WorkOS operations, eliminating the need to navigate the dashboard or remember specific API details, thus speeding up investigative processes like troubleshooting login issues. Actions executed via the plugin are governed by existing WorkOS team permissions, ensuring that only authorized tasks are performed, and all operations are logged under the user's existing access rights. By installing the plugin and authenticating with a WorkOS account, users can streamline operations, making it a more efficient alternative to traditional dashboard navigation for specific tasks.

AuthKit's hosted UI automatically integrates Radar to safeguard sign-in and sign-up processes without requiring setup, but when using headless AuthKit by directly calling User Management APIs, additional client-side signals are needed to enable Radar's protection. The tutorial provides a step-by-step guide for integrating Radar into a custom authentication flow using Next.js, focusing on collecting browser-side signals, handling authentication challenges, and ensuring that Radar can evaluate login attempts effectively. Initially, everything operates in log mode, allowing users to observe Radar’s decisions without affecting real users, before switching to enforcement mode for actual challenges and blocks. The process involves collecting device signals, passing them alongside user data to the server, managing different outcomes from Radar (such as allowing, challenging, or blocking attempts), and handling email and SMS challenges if required. The integration is designed to enhance security by ensuring that signals like IP address and user agent are verified by the server, preventing spoofing, and involves a series of server-side and client-side steps to ensure comprehensive protection and user management.

AuthKit's new Agent Registration feature addresses the limitations of traditional OAuth flows by providing a mechanism specifically designed for AI agents that cannot interact with standard browser-based authorization processes. This innovative solution allows agents to programmatically follow a discovery mechanism, register an identity, and optionally bind that identity to a real user without needing a browser redirect at every step. By borrowing concepts from the Device Authorization Flow, such as showing a code for human confirmation, this feature enables agents to start with limited access and gain trusted permissions once a human vouches for them. The process includes anonymous registration, exploration of API with restricted access, and a user-verified claim ceremony to obtain full permissions, all while maintaining a secure and auditable trail of actions through assertion exchanges. This approach not only enhances agent autonomy but also provides a structured trust model, enabling agents to perform tasks on behalf of users with precise accountability.

WorkOS provides a streamlined solution for facilitating AI agent access to user data and actions within a product, centering around a process called the "claim ceremony." This process involves a human confirming an agent's short code to upgrade its access from limited to trusted. Traditionally, this confirmation occurs on an AuthKit-hosted page, but WorkOS allows businesses to integrate the confirmation step directly into their own applications, maintaining a seamless user experience and reducing onboarding drop-off. The integration involves backend API calls to link the user and agent while ensuring authentication remains robust. By keeping the confirmation within the familiar context of a company's product, users can maintain their trust without the disruption of a domain redirect, thus enhancing user experience and security.

WorkOS provides a multi-layered approach to managing organizational access by addressing two fundamental questions: who is allowed to authenticate and how, and who becomes a member of the organization and how did that happen. The system consists of several mechanisms, including domain verification, organization policies, SSO connections, directory sync, JIT provisioning, and invitations, each serving distinct roles in verifying domain ownership, enforcing authentication methods, synchronizing directory data, and controlling membership. Domain verification ensures that an organization controls the claimed domain, which is crucial for applying subsequent policies. Domain policies enforce specific authentication methods and facilitate automatic membership for users with matching email domains, while SSO connections handle individual authentication processes. Directory sync keeps membership updated in line with the organization's IdP directory, and JIT provisioning automatically creates user accounts upon first sign-in for verified domains. Invitations allow explicit membership grants, bypassing domain-based constraints, enabling flexibility for welcoming individuals from unverified domains. This layered system allows organizations to tailor their access control processes according to their needs, ranging from startups focusing on invitations to large enterprises employing stringent domain policies and synchronization for dynamic role management.

SAML SSO, a critical feature for enterprise customers, often suffers from security vulnerabilities not due to flaws in its specification, but from inadequate validation by service providers. Common pitfalls include incomplete assertion validation, reuse of insecure or deprecated algorithms like SHA-1, and poor management of assertion lifetimes and replay attacks. To enhance security, it's essential to validate all fields in SAML responses, use well-maintained libraries, reject weak algorithms, and implement replay prevention with shared assertion ID stores. Proper certificate management and configuring SSO options like making IdP-initiated flows an explicit opt-in, as well as keeping assertion lifetimes short, further mitigate risks. Logging validation failures, writing negative test cases, and ensuring automated metadata refresh and certificate rotation without downtime are crucial for maintaining robust SAML security. WorkOS offers a platform that handles many of these security aspects automatically, although application-level controls such as session management and role mapping remain the developer's responsibility.

In recent discussions on OAuth vulnerabilities, the token exchange flaw in n8n was highlighted, where a valid token from one issuer could be misused under a different issuer, exemplifying a mix-up attack. Mix-up attacks occur when OAuth clients, interacting with multiple authorization servers, become confused about which server response they receive, potentially allowing attackers to exploit the confusion and gain unauthorized access. Although RFC 9207, published in 2022, aims to address this by introducing the "iss" parameter to verify the authorization server's identity, it remains under-deployed and often overlooked in current implementations. This issue is particularly relevant as multi-authorization-server clients, such as those using MCP architectures, become more common, necessitating rigorous checks on issuer identity to prevent security breaches. The flaw lies in the failure to verify the specific issuer of a token, rather than just any trusted signer, a gap exploited in cases like CVE-2026-59208, where tokens were misapplied across different account namespaces. Proper implementation of RFC 9207 and issuer-specific verification is essential for securing OAuth systems, especially as they scale to accommodate more complex agent and tenant interactions.

OAuth, a widely-used authentication protocol, faces various security challenges, with recent vulnerabilities exposing critical flaws in multiple implementations. Unlike SAML, whose issues often stem from XML parsing and signature validation, OAuth's problems typically arise from trust boundaries, such as issuer verification and endpoint configuration. Notable vulnerabilities include a severe flaw in the miniOrange OAuth SSO plugin for WordPress, allowing unauthorized admin access, and a token exchange issue in n8n that permits cross-issuer access. Security updates from Better Auth highlight ongoing risks in SSO, SCIM, and OAuth provider plugins, especially amid Vercel's acquisition. Additionally, RabbitMQ's outdated management endpoint exposes OAuth client secrets, and a forum-software vulnerability allows account hijacking even without OAuth configuration. These incidents underscore the complexity of correctly implementing OAuth's trust model, emphasizing the importance of careful issuer binding and scrutiny of multi-tenant, multi-issuer flows. Users are advised to conduct thorough audits, ensure unused features are gated, and adhere to vendor timelines for patches to mitigate these vulnerabilities.

Building a SaaS application that caters to multiple organizations involves addressing both data and authentication architecture challenges, with a focus on ensuring that the organization context is correctly managed within the session. The text outlines how to implement organization-scoped sessions in a multi-tenant environment using Next.js App Router, emphasizing the importance of carrying both user identity and active organization ID within the session to enforce correct data access and permissions. It details the use of WorkOS AuthKit for handling multi-tenant authentication layers, including configuring SSO per tenant, managing invitations, and ensuring secure session management. The guide stresses that all server actions should validate resource ownership based on the authenticated session rather than URL parameters, thus ensuring tenant isolation and correct data access. WorkOS provides tools for managing organizational contexts, such as directory sync for enterprise customers and role-based access control (RBAC), ensuring that each authenticated request is scoped to the correct organization. This setup is crucial for maintaining security and functionality in multi-tenant applications.

The Continuous Access Evaluation Protocol (CAEP) addresses the gap in traditional B2B SaaS applications that typically make a single access decision at login, leaving sessions vulnerable until token expiration. Unlike traditional systems that rely on periodic checks to determine session validity, CAEP enables identity providers to instantly inform applications of changes such as session revocations or device non-compliance, allowing for immediate action. This protocol, part of the OpenID Foundation's Shared Signals Framework, has been gaining traction following the finalization of its specifications alongside the Risk Incident Sharing and Coordination (RISC) profile. Key industry players, including Microsoft, Google, and Okta, have begun implementing CAEP features, signaling a shift towards continuous identity evaluation and away from static, one-time authentication. While the technology is still in early stages and its implementation varies across vendors, it represents a critical evolution in enhancing security by ensuring ongoing validation of user sessions, potentially closing long-standing security gaps in applications.

The guide delves into the intricacies of implementing Multi-Factor Authentication (MFA) in TanStack Start, emphasizing the importance of both initial login authentication and ongoing step-up authentication for sensitive operations. It highlights the limitations of traditional SMS-based MFA due to vulnerabilities like SIM swapping and interception, advocating for Time-based One-Time Password (TOTP) via authenticator apps like Google Authenticator for enhanced security. The guide explains the process of enabling MFA using WorkOS AuthKit, which handles enrollment and verification seamlessly, and introduces step-up authentication, which requires fresh verification for critical actions, leveraging auth_time claims and max_age parameters to ensure security. Additionally, it discusses organizational policies for MFA enforcement, testing workflows to prevent user lockouts, and compliance considerations, underscoring the robust security framework WorkOS provides for managing secure user sessions and high-stakes operations without additional costs for up to 1 million users on the free plan.

The text compares four secrets management tools—AWS Secrets Manager, HashiCorp Vault, Doppler, and WorkOS Vault—highlighting their distinct purposes and best applications. AWS Secrets Manager is tailored for AWS-native teams seeking to manage infrastructure credentials with minimal operational overhead. HashiCorp Vault, known for its complexity and flexibility, suits large enterprises needing dynamic secrets and PKI management, albeit with significant operational commitment. Doppler excels in providing a seamless developer experience for syncing environment configurations without requiring infrastructure management, but lacks per-tenant cryptographic isolation. WorkOS Vault stands out for its encryption key management, enabling per-tenant cryptographic isolation and BYOK, making it ideal for B2B SaaS companies focused on ensuring customer data security and isolation. The article advises that selecting the right tool depends on specific needs, such as whether centralized credentials or cryptographic isolation is the primary concern, and suggests that most production applications may require a combination of these tools to meet diverse requirements.

On July 16, 2026, WorkOS experienced significant service disruptions due to elevated latency, timeouts, and HTTP 5xx errors across its User Management API and authentication services. The issue was triggered by an anomalous increase in concurrent session creation, which led to a defect in the code path that exhausted the database connection pool. This defect caused requests to hold one database connection while waiting for a second, leading to connection starvation that degraded service. Despite attempts to mitigate the issue, including increasing service capacity, the core problem was identified as a bug in the transaction library that requested an additional database connection. The situation was resolved by disabling the AuthKit Analytics write, allowing the system to recover quickly. Steps are being taken to address the defect, improve system architecture, and enhance monitoring to prevent similar incidents. These measures aim to ensure that unusual traffic does not lead to broad service degradation and that low-priority tasks do not interfere with critical operations.

SEP-1763, the Interceptor Framework for Model Context Protocol (MCP), represents a pivotal yet underreported advancement in MCP's 2026 roadmap, focusing on standardizing cross-cutting concerns like PII redaction and audit logging across diverse servers and languages. Unlike the more publicized roadmap items, such as stateless transport and Tasks, SEP-1763 proposes an innovative solution to the M times N problem of middleware integration by introducing interceptors as a new first-class resource type in MCP. These interceptors, categorized into validation, mutation, and observability types, offer a unified interface and execution model to ensure consistent policy enforcement and logging across trust boundaries. The framework, still in draft but actively discussed by its working group, is already influencing production systems, with organizations exploring cryptographic receipts and robust policy enforcement as they trial the interceptor pattern. The ongoing debate over prompt injection defense highlights the evolving nature of this proposal, which, by enabling cryptographic accountability and policy enforcement, could ultimately make MCP a trusted infrastructure for regulated enterprises.

Managing encryption at scale involves complexities beyond merely selecting an algorithm like AES-256; the real challenge lies in key management, particularly when using a single key, which poses risks like data loss, key rotation difficulties, and security breaches. Envelope encryption offers a robust solution by introducing two layers of keys: the Data Encryption Key (DEK) and the Key Encryption Key (KEK). The DEK, which encrypts the actual data, is unique and short-lived, while the KEK, which encrypts DEKs, is long-lived and stored securely in a Hardware Security Module (HSM). This design makes key rotation efficient, limits the damage from potential breaches to individual data objects, enables multi-tenant cryptographic isolation, and supports customer-supplied keys (BYOK). Implementing envelope encryption requires careful attention to avoid pitfalls such as improper DEK storage or KEK management, making managed services like WorkOS Vault, AWS KMS, Google Cloud KMS, and Azure Key Vault more practical for most organizations.

The Model Context Protocol (MCP) has emerged as a standard for AI models to interface with business logic, introduced by Anthropic in 2024 and widely adopted by major tech companies and developers. By 2025, it became a vendor-neutral, community-governed standard under the Agentic AI Foundation. A key aspect of MCP is its approach to authorization, focusing on specific permissions for tool access rather than traditional OAuth methods. This involves dynamic client registration, per-tool scopes, and least privilege enforcement, ensuring that AI-driven actions are tightly controlled and audited through tools like WorkOS AuthKit. The protocol requires identity and organizational awareness for each tool invocation, with a shift towards session-scoped authorization to enhance security. As MCP expands, including the introduction of MCP Apps for interactive interfaces, its architecture emphasizes the need for robust, user-specific authorization models to ensure secure and efficient AI interactions.

B2B SaaS teams often learn what should be included in an audit log through challenging experiences like security questionnaires and deal delays, prompting a proactive approach. The text outlines ten critical event categories commonly requested by security reviewers, such as authentication events, MFA actions, session lifecycles, role changes, directory provisioning, and API key management. It emphasizes the importance of logging data exports, impersonation activities, security configuration changes, and non-human activities, as these are critical for security audits and troubleshooting. Retention policies are crucial, with recommendations to store authentication events for about a year and administrative changes for two years, while longer retention is suggested for high-risk categories. Implementing robust audit logging is complex, requiring infrastructure like tamper-evident storage and flexible schemas, and WorkOS Audit Logs is highlighted as a solution that simplifies this process by providing a defined event schema, SDKs, and seamless integration with existing tools, reducing the need for extensive custom development.

According to FusionAuth's 2026 State of AI and Identity Report, 65% of organizations experienced a confirmed AI identity-related security incident, with an additional 23% reporting a near miss, highlighting significant vulnerabilities in AI security practices. The report reveals that organizations with high confidence in their AI security were breached more often than those with lower confidence, as confidence often correlated with deployment speed and policy documentation rather than actual security measures. Common AI identity breaches include compromised service accounts, token leakage, and over-permissioned agent identities, with incidents exacerbated by agents generating more calls across various tools, often without adequate oversight. The report emphasizes the need for stringent identity management practices, such as inventorying agents, using scoped and short-lived tokens, enforcing human approval for critical actions, maintaining detailed audit logs, and integrating AI tool access into existing Role-Based Access Control (RBAC) systems. The adoption of these practices, which align with standard identity hygiene for high-privilege clients, is crucial for organizations to safeguard against AI-related security incidents effectively.

WebMCP is a proposed web standard designed to enhance how AI agents interact with web pages, specifically documentation sites, by providing structured tools that agents can call directly. Unlike traditional methods that rely on separate MCP servers, WebMCP integrates directly into the page, using JavaScript and HTML annotations to clearly define the purpose of each element, reducing the need for AI to infer functionality from raw markup. This eliminates the problem of maintaining two representations of the same content and ensures that both human users and AI agents interact with the same version of a site. WebMCP, implemented as a custom Astro integration, generates a manifest at build time and registers tools at runtime, allowing agents to perform tasks like searching, navigating, and retrieving page information in a reliable manner. This approach aligns the agent's view with the human's, fostering trust and accuracy in interactions, and is currently in early development with trials available in Chrome, indicating a shift towards integrating AI directly into the human web experience.

WorkOS offers a streamlined approach to setting up authentication in web projects, allowing developers to bootstrap a new project in seconds with a single command: `npx workos@latest`. This command automates the usual processes of installing SDKs, setting environment variables, and configuring middleware, ultimately speeding up the creation of a login page. The CLI installer efficiently detects the project's framework, authenticates the account, configures the dashboard, and installs the appropriate SDK, while also setting up routes and middleware, and validating the integration. WorkOS provides a range of features, such as user management, social login, SSO, and audit logs, without requiring changes to application code, making it a versatile solution for authentication needs. The process is quick, with the initial setup and first successful sign-in achievable in under five minutes, allowing developers to focus more on building their product.

SCIM (System for Cross-domain Identity Management) has recently undergone significant updates with the release of three new RFCs aimed at addressing existing limitations in large-scale implementations. RFC 9865 introduces cursor-based pagination to improve performance and stability over the traditional offset pagination when syncing large directories, by using a token system that directly points to the correct data, eliminating offset issues. RFC 9967 defines a standard for representing SCIM lifecycle changes using Security Event Tokens, promoting interoperability among identity providers by standardizing event delivery, which has previously been inconsistent due to varying webhook implementations. RFC 9944 introduces a device schema extension, allowing for the standardized representation of managed devices within SCIM, which is particularly relevant for MDM and UEM vendors dealing with conditional access policies. While these updates do not immediately necessitate changes for all users, they are crucial for those handling large-scale directory syncs or needing robust device management. The advancements reflect the evolving nature of SCIM, requiring developers to stay informed of such updates, particularly if managing SCIM endpoints in-house, though services like WorkOS Directory Sync offer a way to handle these changes efficiently.

Claude Code can now connect to remote MCP servers efficiently by using an OAuth flow, eliminating the need for custom login screens or token issuers, as long as an authorization server like AuthKit is in place. The process involves setting up an MCP server with the appropriate SDKs and configuring the authentication layer, which includes token verification and metadata exposure, to ensure seamless integration with Claude Code. To achieve this, key steps include enabling Client ID Metadata Document support, registering the MCP server's URL as a resource indicator, and implementing token verification that includes a WWW-Authenticate header for authentication prompts. This setup allows Claude Code to discover and use the server without manual configuration by the user, relying on AuthKit to handle the OAuth process. Additionally, if an organization already has its own authentication system, WorkOS Connect can be used in standalone mode to integrate with existing login pages, although this might limit certain features like Cross App Access. For compatibility with older MCP clients, additional configuration may be required to support their metadata discovery methods.

Vercel's acquisition of Better Auth, the company behind the open-source TypeScript authentication library, does not immediately compel users to migrate from the library, which remains free, MIT-licensed, and maintained by the same team. However, governance changes as the roadmap focuses more on agent identity rather than enterprise needs, prompting B2B teams to reassess their dependency on Better Auth. While the library allows for in-app control of authentication processes, this often involves operational burdens that could be mitigated by using managed services like WorkOS, which already handles authentication for companies like OpenAI and Indeed. The acquisition serves as a catalyst for organizations to evaluate whether maintaining their own identity infrastructure aligns with their strategic goals, especially as they face security reviews and enterprise feature demands. Migration paths to other platforms like WorkOS are well-documented, offering a structured transition for those deciding to shift away from Better Auth.

At the AI Engineer World's Fair 2026, Michael Grinich discussed the evolving landscape of AI expenditure with Remy Guercio from Tailscale, focusing on the shift from "token maxing" to "ROI maxing" in AI projects. Remy highlighted the financial implications of utilizing large context windows in AI models, emphasizing that while this exploration has been productive, it has also led to significant costs, prompting finance teams to scrutinize AI bills from various providers like OpenAI and Anthropic. He used the Concorde analogy to illustrate that efficiency should be measured per task rather than per token, as cheaper tokens don't necessarily equate to cheaper tasks. Aperture, Tailscale’s AI gateway, was introduced as a solution to monitor and manage AI model usage and costs, providing insights into average costs per million tokens and facilitating governance by tracking agent activities and stripping PII. Remy cautioned against consolidating AI services with one provider, advocating for diverse experimentation across models to ensure cost-effectiveness and performance verification. He noted the cultural shift within Tailscale, where AI has enabled engineers to explore multiple approaches, leading to potentially better software development. The discussion also touched on the broader theme of token allocation akin to capital allocation, underscoring the importance of thoughtful AI usage in balancing costs and innovation.

Vercel's acquisition of Better Auth, an open-source TypeScript authentication library, signals a shift in governance and development priorities towards agent identity and Vercel's platform integration, while maintaining its open-source and MIT-licensed status. Despite the acquisition, the library's core features remain unchanged, but it presents developers with a decision between maintaining their own authentication infrastructure or opting for a managed platform like WorkOS, which offers extensive enterprise features and support. As Vercel integrates Better Auth's capabilities into its broader strategy, the acquisition prompts developers to reconsider the benefits and drawbacks of self-managed authentication versus outsourcing to a service that handles complex identity management tasks, especially as they scale towards enterprise-level needs. The acquisition does not compel immediate changes, but it encourages developers to evaluate their long-term authentication strategy, with Vercel and several other companies opting for WorkOS to manage their authentication needs.

The AI Engineer World's Fair 2026 in San Francisco saw the WorkOS team hosting a variety of events and discussions that centered around the evolving role of AI in organizational operations. The events included a popular workshop, "Lifestyles of the AI-Native," which emphasized transitioning from manual typing to operating with AI agents, leveraging tools like Handy for voice coding and implementing verification gates for automated processes. Michael Grinich, founder of WorkOS, presented "Auth for Agents" on the mainstage, discussing the open protocol auth.md that enables AI agents to authenticate users without traditional sign-up forms. Additionally, Garrett Galow introduced Studio, a system empowering non-technical employees to create tools without coding, while Ryan Cooke critiqued simplistic software factory models, advocating for a deeper integration of organizational processes. The conference highlighted the importance of building robust frameworks around AI models to effectively harness their potential within business operations, a theme underscored by the open-source resources shared for further exploration.

WorkOS has introduced a new GraphQL API that provides developers with direct access to data and mutations, allowing them to construct custom user interfaces without being constrained by the prebuilt Widgets previously offered. This API enables developers to fetch necessary fields in a single request, providing a more streamlined and efficient development process compared to traditional REST endpoints. The API retains a session-aware, client-side access model similar to Widgets, but without the predefined UI, supporting the complete lifecycle of user management, including queries and mutations for users, memberships, and invitations. Initially launched in closed beta, the API plans to expand its capabilities to include features like SSO, directory sync, audit logs, and RBAC, with future enhancements benefiting both the API and existing Widgets. Access to the API is currently limited to teams developing custom user management interfaces, who are encouraged to provide feedback on its schema and authentication model.

AuthKit has introduced step-up authentication to address the issue of equal trust levels for all actions within a session, regardless of their sensitivity. This feature allows specific operations to require fresh verification without terminating the existing session, ensuring that actions such as accessing admin panels or changing billing details are executed with confirmed user identity. This is particularly important for applications under compliance regulations like SOC 2, HIPAA, or PCI-DSS, where re-verifying before accessing sensitive data is expected. The new release includes an auth_time claim on tokens to track the last active authentication, a max_age parameter to enforce re-authentication based on a specified time threshold, and a hosted re-authentication flow. The system emits an authentication.reauthenticated event upon successful step-up, and the WorkOS Node core SDK facilitates integration by providing tools to build authorization URLs with max_age and check token freshness.

WorkOS has introduced the Management MCP Server, a remote server that allows agents to manage WorkOS accounts via OAuth authentication, mirroring the permissions of the user's dashboard login. This server provides a comprehensive range of operations across the WorkOS product suite, including managing organizations, SSO connections, and user roles, while deliberately excluding sensitive operations such as credential-minting and billing. Instead of a tool for each endpoint, it uses a discover-then-execute design to efficiently manage operations within an agent's context. This enables agents to perform management tasks traditionally done via the dashboard, such as debugging sign-in issues or configuring branding, without the need for a local development setup. Team access to the MCP server can be controlled through authentication settings, allowing incremental adoption. The MCP server complements the WorkOS CLI by offering remote, no-install access, making it suitable for various automated workflows and agent interactions.