WorkOS

WorkOS is a developer-first platform that enables SaaS applications to integrate enterprise authentication and IT management features with ease. It provides APIs and SDKs for SSO (SAML 2.0, OpenID Connect), Directory Sync (SCIM 2.0 inbound), MFA and Passkeys (AuthKit), Audit Logs, and a hosted Admin Portal for IT configuration. The platform allows applications to act as the relying party while WorkOS manages the underlying identity and provisioning infrastructure.

Key Capabilities

• Standards-based SSO: Integrates any SAML or OIDC IdP through a consistent API; per-connection OIDC client/discovery inputs are documented so the app can consume normalized tokens.

• Directory Sync (SCIM 2.0 inbound): Exposes a SCIM v2 endpoint so customer IdPs/HRIS (e.g., Okta, Microsoft Entra ID, OneLogin) can provision users and groups directly into your app.

• Hosted Admin Portal: Provides out-of-the-box UI for domain verification, SSO, and Directory Sync setup, with custom domains for a branded IT admin experience.

• AuthKit MFA & passkeys: Delivers TOTP/SMS factors via the MFA API and WebAuthn/passkeys for passwordless sign-in managed from the dashboard.

Limitations

• Role in the stack: Designed for applications to consume enterprise authentication and SCIM capabilities; not intended as a general-purpose IdP that issues SAML/OIDC tokens to unrelated third-party SaaS.

• SCIM directionality: Optimized for inbound provisioning (IdP/HRIS → WorkOS → application); outbound SCIM to other targets is not publicly confirmed.

• MFA with SSO: MFA enforcement does not apply to SSO users; the connected IdP’s MFA policies govern those flows.

• Feature breadth vs. depth: WorkOS offers RBAC, fine-grained authorization, Vault, and Feature Flags; maturity and suitability should be validated during evaluation or proof of concept.