WorkOS Pipes: Where your users' tokens actually live

WorkOS Pipes manages OAuth connections by separating connected-account metadata from encrypted provider credentials, storing access and refresh tokens in a credential vault protected with AES-256 envelope encryption, per-object data encryption keys, and hardware-security-module-backed key encryption keys. Connected accounts expose only metadata such as scopes, state, and masked credential fragments, while credentials can be migrated into Pipes if valid access and refresh token combinations are supplied. Vault encryption can be segmented through key context and supports customer-managed keys for tenant-specific isolation, although Pipes-managed tokens use WorkOS-controlled key layouts. Access to live provider tokens is governed primarily by the WorkOS API key rather than encryption alone, and Pipes offers either direct token vending for trusted systems or Relay, a proxy that injects credentials without exposing provider tokens to untrusted runtimes. Key rotation rewraps encryption keys without changing OAuth consent, whereas revoked, expired, or missing grants require reauthorization; connected accounts can be deleted to remove stored tokens, though provider-side authorization may remain until separately revoked. The text also notes limits on key contexts and unique keys, automatic regional replication for WorkOS-managed keys as of February 2026, and the importance of defining cryptographic boundaries around durable tenant identifiers rather than individual records.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.