How to add authentication to a Rust axum app with WorkOS AuthKit

WorkOS’s Rust SDK supports AuthKit integration for Rust backends by handling PKCE sign-in flows, encrypted session cookies, local session-token verification, refresh operations, logout URLs, and signed webhook validation. Applications create and share a configurable client at startup, store PKCE state and verifiers in short-lived sealed cookies, exchange callback codes for tokens, and place session data in AES-256-GCM-protected cookies. On each request, the SDK authenticates session tokens against cached signing keys and distinguishes valid sessions, expired sessions requiring refresh, absent cookies, and invalid or tampered credentials, while authorization decisions should rely on the verified user ID rather than mutable profile data. Webhook handlers must validate the WorkOS-Signature header against the exact raw request body before parsing events, respond quickly, and process deliveries idempotently because retries, duplicates, and out-of-order events are possible. The SDK provides structured errors, safe retry behavior for eligible requests, configurable networking options, and secret-redaction protections, but local verification cannot immediately detect session revocation, so sensitive actions may require webhook-driven state updates or direct WorkOS checks.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.