How to add WorkOS AuthKit to a Ruby on Rails app

AuthKit integration in Rails can be set up through the WorkOS CLI, which installs the necessary gem, callback route, and dashboard redirect configuration, while preserving existing middleware. The authentication flow redirects users to a WorkOS-hosted sign-in page, exchanges the returned short-lived authorization code for an encrypted sealed session, and stores that opaque value in a secure, HTTP-only cookie rather than applying Rails encryption again. Correct Redirect URI, Initiate Login URL, and Sign-out URI settings are essential for authentication, invitation and password-reset flows, and logout behavior in production. On each request, Rails loads and authenticates the sealed session; expired sessions can be refreshed, with the newly sealed cookie requiring a redirect so the next request uses updated credentials. Refreshes should generally be limited to GET requests because redirects can discard POST data, and Turbo Frame behavior should be tested separately. Logout should use a CSRF-protected POST or DELETE request, revoke the live WorkOS session, clear the local cookie, and safely handle missing or invalid cookies. Applications needing local user records should create them once during the callback using the immutable WorkOS user ID rather than a mutable email address, while WorkOS manages token cryptography, rotation, and future enterprise SSO support.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.