AuthKit is the WorkOS login and user-management layer: a sign-in interface built on Radix components that handles email and password, social sign-in such as Google and Microsoft, one-time passcodes from an authenticator app, and role-based access control. It can be used as a hosted page or with your own frontend, and it connects to the rest of WorkOS for SAML single sign-on, SCIM directory sync, and RBAC.
The linked repository is the WorkOS Node.js library, the server-side JavaScript client for the WorkOS API that apps use to drive AuthKit. It generates authorization URLs, exchanges codes for access and refresh tokens, and verifies session cookies against the WorkOS JWKS, with optional issuer validation. A public client mode, initialized with only a client ID, uses PKCE for browser, mobile, and CLI apps that cannot hold a secret, and server-side apps can combine PKCE with their client secret.
Features
- Hosted or custom login: use the hosted AuthKit page or build your own frontend, styled to match the app
- Sign-in methods: email and password, Google and Microsoft sign-in, magic links, and authenticator-app passcodes
- Account protection: leaked password protection, password strength validation, and spam and bot detection
- Access control: role-based access control, with SAML single sign-on and SCIM directory sync through WorkOS
- PKCE flows: public client mode for browser, mobile, and CLI apps, and PKCE alongside the client secret for server apps
- Session verification: session cookie helpers check the access token signature against the WorkOS JWKS, with optional issuer checks
- Automatic retries: transient failures retry with exponential backoff and jitter, honor Retry-After, and add idempotency keys to retried writes
