Security · llms.txt file breakdown
WorkOS Documentation organizes WorkOS content, including Getting started, Pricing, Developer tools, Feedback and 29 additional sections.
The actual file
The saved llms.txt text, displayed as source. The file belongs to its publisher; the live endpoint may change.
Showing the first 18000 characters. Load the complete file to read the remainder.
# WorkOS Documentation
> WorkOS is the enterprise authentication and identity platform for SaaS companies. AuthKit ships email/password, social login, passkeys, MFA, magic auth, and enterprise SSO from one integration, and is free up to 1M monthly active users. Enterprise APIs include Single Sign-On, SCIM Directory Sync, RBAC, Audit Logs, Radar (bot and fraud protection), Vault, and a no-code Admin Portal — priced per connection with volume discounts. SDKs for Node, Python, Go, Ruby, PHP, Java, and .NET.
This documentation site provides guides, references, and examples for implementing WorkOS features in your applications.
## Getting started
- [Auth](https://workos.com/auth.md): Instructions for how agents can set up a new WorkOS account and start developing with the SDKs.
## Pricing
- [Pricing](https://workos.com/pricing.md): WorkOS pricing details for AuthKit, SSO, Directory Sync, Audit Logs, Radar, and more.
## Developer tools
- [WorkOS CLI](https://github.com/workos/cli): The official CLI for integrating and managing WorkOS. It is [published on npm](https://registry.npmjs.org/workos/latest) and runs with `npx workos@latest`.
- [API changes and deprecations](https://workos.com/docs/deprecation-policy.md): Links to the API reference, changelog, and feature-specific migration guidance.
## Feedback
- [Docs feedback for agents](https://workos.com/docs/feedback.md): Where and how agents report wrong or missing documentation, and what happens after a report.
## Postman
- [WorkOS Postman collection](https://workos.com/docs/postman.md): Test the WorkOS API with Postman.
## On prem deployment
- [Using WorkOS with On-prem Customers](https://workos.com/docs/on-prem-deployment.md): Best practices for using WorkOS with on-prem customers.
## Migrate standalone sso
- [Migrate from the standalone SSO API](https://workos.com/docs/migrate-standalone-sso.md): Learn how to migrate your code from an existing WorkOS SSO integration.
## Mcp
- [WorkOS MCP Server](https://workos.com/docs/mcp.md): Manage your WorkOS workspace with AI agents. The WorkOS MCP server lets any Model Context Protocol client manage organizations, users, SSO connections, and more.
## Glossary
- [Glossary](https://workos.com/docs/glossary.md): Terminology and concepts used in the WorkOS documentation.
## Email
- [Email delivery](https://workos.com/docs/email.md): Best practices for sending email with WorkOS.
## Widgets API
- [Getting started](https://workos.com/docs/widgets-api.md): GraphQL queries, mutations, and type definitions for the WorkOS Widgets API.
- [verify-current-email](https://workos.com/docs/widgets-api/users/verify-current-email.md)
- [user](https://workos.com/docs/widgets-api/users/user.md)
- [update-profile](https://workos.com/docs/widgets-api/users/update-profile.md)
- [send-verification-code](https://workos.com/docs/widgets-api/users/send-verification-code.md)
- [send-email-change](https://workos.com/docs/widgets-api/users/send-email-change.md)
- [me](https://workos.com/docs/widgets-api/users/me.md)
- [Users](https://workos.com/docs/widgets-api/users.md): Read and update the profile of the user the token was issued for.
- [confirm-email-change](https://workos.com/docs/widgets-api/users/confirm-email-change.md)
- [update-sso-connection](https://workos.com/docs/widgets-api/single-sign-on/update-sso-connection.md)
- [sso-connections](https://workos.com/docs/widgets-api/single-sign-on/sso-connections.md)
- [sso-connection](https://workos.com/docs/widgets-api/single-sign-on/sso-connection.md)
- [Single Sign-On](https://workos.com/docs/widgets-api/single-sign-on.md): Manage the SSO connections of the organization the token was issued for.
- [delete-sso-connection](https://workos.com/docs/widgets-api/single-sign-on/delete-sso-connection.md)
- [create-sso-connection](https://workos.com/docs/widgets-api/single-sign-on/create-sso-connection.md)
- [update-role](https://workos.com/docs/widgets-api/roles-and-permissions/update-role.md)
- [roles](https://workos.com/docs/widgets-api/roles-and-permissions/roles.md)
- [role](https://workos.com/docs/widgets-api/roles-and-permissions/role.md)
- [permissions](https://workos.com/docs/widgets-api/roles-and-permissions/permissions.md)
- [Roles and permissions](https://workos.com/docs/widgets-api/roles-and-permissions.md): Define the roles available to an organization, the permissions attached to them, and the permissions a given member effectively holds.
- [effective-permissions](https://workos.com/docs/widgets-api/roles-and-permissions/effective-permissions.md)
- [delete-role](https://workos.com/docs/widgets-api/roles-and-permissions/delete-role.md)
- [create-role](https://workos.com/docs/widgets-api/roles-and-permissions/create-role.md)
- [assign-permission-to-role](https://workos.com/docs/widgets-api/roles-and-permissions/assign-permission-to-role.md)
- [Pagination](https://workos.com/docs/widgets-api/pagination.md): How to page through list results in the Widgets API using cursors.
- [update-member-role](https://workos.com/docs/widgets-api/organizations/update-member-role.md)
- [revoke-invitation](https://workos.com/docs/widgets-api/organizations/revoke-invitation.md)
- [resend-invitation](https://workos.com/docs/widgets-api/organizations/resend-invitation.md)
- [remove-member](https://workos.com/docs/widgets-api/organizations/remove-member.md)
- [organizations](https://workos.com/docs/widgets-api/organizations/organizations.md)
- [organization](https://workos.com/docs/widgets-api/organizations/organization.md)
- [organization-memberships](https://workos.com/docs/widgets-api/organizations/organization-memberships.md)
- [invite-user](https://workos.com/docs/widgets-api/organizations/invite-user.md)
- [Organizations](https://workos.com/docs/widgets-api/organizations.md): List the organizations a user belongs to and manage the membership of the organization the token was issued for, including invitations and each member's roles.
- [Errors](https://workos.com/docs/widgets-api/errors.md): How the Widgets API reports both expected and unexpected failures.
- [reverify-organization-domain](https://workos.com/docs/widgets-api/domain-verification/reverify-organization-domain.md)
- [organization-domains](https://workos.com/docs/widgets-api/domain-verification/organization-domains.md)
- [organization-domain](https://workos.com/docs/widgets-api/domain-verification/organization-domain.md)
- [Domain verification](https://workos.com/docs/widgets-api/domain-verification.md): Add domains to the organization the token was issued for and track the DNS verification of each one.
- [delete-organization-domain](https://workos.com/docs/widgets-api/domain-verification/delete-organization-domain.md)
- [create-organization-domain](https://workos.com/docs/widgets-api/domain-verification/create-organization-domain.md)
- [Directory Sync](https://workos.com/docs/widgets-api/directory-sync.md): Read the directory connections of the organization the token was issued for, along with their synced users and groups.
- [directory-users](https://workos.com/docs/widgets-api/directory-sync/directory-users.md)
- [directory-groups](https://workos.com/docs/widgets-api/directory-sync/directory-groups.md)
- [directory-connections](https://workos.com/docs/widgets-api/directory-sync/directory-connections.md)
- [directory-connection](https://workos.com/docs/widgets-api/directory-sync/directory-connection.md)
- [update-organization-data-provider-connection-label](https://workos.com/docs/widgets-api/data-providers/update-organization-data-provider-connection-label.md)
- [update-data-provider-connection-label](https://workos.com/docs/widgets-api/data-providers/update-data-provider-connection-label.md)
- [shared-data-providers](https://workos.com/docs/widgets-api/data-providers/shared-data-providers.md)
- [set-organization-data-provider-configuration](https://workos.com/docs/widgets-api/data-providers/set-organization-data-provider-configuration.md)
- [set-data-provider-enabled](https://workos.com/docs/widgets-api/data-providers/set-data-provider-enabled.md)
- [set-data-provider-configuration](https://workos.com/docs/widgets-api/data-providers/set-data-provider-configuration.md)
- [organization-data-providers](https://workos.com/docs/widgets-api/data-providers/organization-data-providers.md)
- [Data providers](https://workos.com/docs/widgets-api/data-providers.md): Browse the data providers configured in the environment, manage which ones the organization can use, and connect or disconnect the authenticated user's own accounts.
- [delete-organization-data-provider-connection](https://workos.com/docs/widgets-api/data-providers/delete-organization-data-provider-connection.md)
- [delete-data-provider-connection](https://workos.com/docs/widgets-api/data-providers/delete-data-provider-connection.md)
- [data-providers](https://workos.com/docs/widgets-api/data-providers/data-providers.md)
- [data-provider](https://workos.com/docs/widgets-api/data-providers/data-provider.md)
- [data-provider-connections](https://workos.com/docs/widgets-api/data-providers/data-provider-connections.md)
- [data-provider-connection](https://workos.com/docs/widgets-api/data-providers/data-provider-connection.md)
- [data-provider-authorization-status](https://workos.com/docs/widgets-api/data-providers/data-provider-authorization-status.md)
- [create-organization-data-provider-connection](https://workos.com/docs/widgets-api/data-providers/create-organization-data-provider-connection.md)
- [create-organization-data-provider-authorization](https://workos.com/docs/widgets-api/data-providers/create-organization-data-provider-authorization.md)
- [create-data-provider-connection](https://workos.com/docs/widgets-api/data-providers/create-data-provider-connection.md)
- [create-data-provider-authorization](https://workos.com/docs/widgets-api/data-providers/create-data-provider-authorization.md)
- [connect-organization-data-provider-with-client-credentials](https://workos.com/docs/widgets-api/data-providers/connect-organization-data-provider-with-client-credentials.md)
- [connect-data-provider-with-client-credentials](https://workos.com/docs/widgets-api/data-providers/connect-data-provider-with-client-credentials.md)
- [configurable-data-providers](https://workos.com/docs/widgets-api/data-providers/configurable-data-providers.md)
- [Branding](https://workos.com/docs/widgets-api/branding.md): Read the branding for the environment the token was issued for.
- [branding](https://workos.com/docs/widgets-api/branding/branding.md)
- [Authentication](https://workos.com/docs/widgets-api/authentication-tokens.md): How to issue and use the short-lived tokens that authorize Widgets API requests.
- [verify-totp](https://workos.com/docs/widgets-api/authentication/verify-totp.md)
- [verify-passkey](https://workos.com/docs/widgets-api/authentication/verify-passkey.md)
- [update-password](https://workos.com/docs/widgets-api/authentication/update-password.md)
- [sessions](https://workos.com/docs/widgets-api/authentication/sessions.md)
- [revoke-session](https://workos.com/docs/widgets-api/authentication/revoke-session.md)
- [revoke-all-sessions](https://workos.com/docs/widgets-api/authentication/revoke-all-sessions.md)
- [remove-mfa-factor](https://workos.com/docs/widgets-api/authentication/remove-mfa-factor.md)
- [register-passkey](https://workos.com/docs/widgets-api/authentication/register-passkey.md)
- [passkeys](https://workos.com/docs/widgets-api/authentication/passkeys.md)
- [Authentication](https://workos.com/docs/widgets-api/authentication.md): Inspect the environment's authentication settings and manage the signed-in user's passwords, multi-factor factors, passkeys, and active sessions.
- [enroll-totp](https://workos.com/docs/widgets-api/authentication/enroll-totp.md)
- [delete-passkey](https://workos.com/docs/widgets-api/authentication/delete-passkey.md)
- [create-password](https://workos.com/docs/widgets-api/authentication/create-password.md)
- [authkit-settings](https://workos.com/docs/widgets-api/authentication/authkit-settings.md)
- [authentication-settings](https://workos.com/docs/widgets-api/authentication/authentication-settings.md)
- [Audit logs](https://workos.com/docs/widgets-api/audit-logs.md): Search the audit events of the organization the token was issued for and export them.
- [create-audit-log-export](https://workos.com/docs/widgets-api/audit-logs/create-audit-log-export.md)
- [audit-log-stream](https://workos.com/docs/widgets-api/audit-logs/audit-log-stream.md)
- [audit-log-export](https://workos.com/docs/widgets-api/audit-logs/audit-log-export.md)
- [audit-events](https://workos.com/docs/widgets-api/audit-logs/audit-events.md)
- [audit-event](https://workos.com/docs/widgets-api/audit-logs/audit-event.md)
- [user-api-keys](https://workos.com/docs/widgets-api/api-keys/user-api-keys.md)
- [organization-api-keys](https://workos.com/docs/widgets-api/api-keys/organization-api-keys.md)
- [API keys](https://workos.com/docs/widgets-api/api-keys.md): Manage the API keys of the organization the token was issued for, as well as the keys belonging to individual members. A key is issued its secret exactly once, at creation.
- [expire-user-api-key](https://workos.com/docs/widgets-api/api-keys/expire-user-api-key.md)
- [expire-organization-api-key](https://workos.com/docs/widgets-api/api-keys/expire-organization-api-key.md)
- [delete-user-api-key](https://workos.com/docs/widgets-api/api-keys/delete-user-api-key.md)
- [delete-organization-api-key](https://workos.com/docs/widgets-api/api-keys/delete-organization-api-key.md)
- [create-user-api-key](https://workos.com/docs/widgets-api/api-keys/create-user-api-key.md)
- [create-organization-api-key](https://workos.com/docs/widgets-api/api-keys/create-organization-api-key.md)
- [Admin Portal](https://workos.com/docs/widgets-api/admin-portal.md): Hand a user off to Admin Portal for a setup flow that is too involved to reproduce in a widget.
- [create-admin-portal-link](https://workos.com/docs/widgets-api/admin-portal/create-admin-portal-link.md)
## Widgets
- [User Sessions Widget](https://workos.com/docs/widgets/user-sessions.md): A widget for displaying and managing user sessions in your application.
- [User Security Widget](https://workos.com/docs/widgets/user-security.md): A widget for controlling user security settings in your application.
- [User Profile Widget](https://workos.com/docs/widgets/user-profile.md): A widget for displaying and managing a user's profile in your application.
- [User Management Widget](https://workos.com/docs/widgets/user-management.md): A widget for displaying and managing users in your application.
- [Authorization Tokens](https://workos.com/docs/widgets/tokens.md): Ensure Widgets have the appropriate permissions in your application.
- [Quick Start](https://workos.com/docs/widgets/quick-start.md): A step-by-step guide for setting up WorkOS Widgets in your application.
- [Pipes Widget](https://workos.com/docs/widgets/pipes.md): A widget for displaying and managing connected accounts with Pipes.
- [Pipes Admin Widget](https://workos.com/docs/widgets/pipes-admin.md): A widget for organization admins to manage their organization's Pipes connections — enabling providers, supplying OAuth credentials, and configuring scopes.
- [Organization Switcher Widget](https://workos.com/docs/widgets/organization-switcher.md): A widget for switching between organizations in your application.
- [Localization](https://workos.com/docs/widgets/localization.md): Learn how to display Widgets in multiple languages.
- [WorkOS Widgets](https://workos.com/docs/widgets.md): Learn how to integrate WorkOS Widgets in your app.
- [Directory Sync Widget](https://workos.com/docs/widgets/directory-sync.md): A widget for managing Directory Sync connections in the Admin Portal.
- [Audit Log Streaming Widget](https://workos.com/docs/widgets/audit-log-streaming.md): A widget for configuring and monitoring audit log streaming in the Admin Portal.
- [API Keys Widget](https://workos.com/docs/widgets/api-keys.md): A widget for displaying and managing API keys.
- [SSO Connection Widget](https://workos.com/docs/widgets/admin-portal-sso-connection.md): A widget for setting up SSO connections in the Admin Portal.
- [Domain Verification Widget](https://workos.com/docs/widgets/admin-portal-domain-verification.md): A widget for verifying domains in the Admin Portal.
- [Theme Customization](https://workos.com/docs/widgets/styling/theme-customization.md): Customize the look and feel of WorkOS Widgets using Radix Themes.
- [Styling](https://workos.com/docs/widgets/styling.md): Customize the look and feel of WorkOS Widgets.
- [CSS Customization](https://workos.com/docs/widgets/styling/css-customization.md): Customize the look and feel of WorkOS Widgets using CSS.
## Vault
- [Quick Start](https://workos.com/docs/vault/quick-start.md): A step-by-step guide on how to start using Vault to manage encrypted objects.
- [Key Context](https://workos.com/docs/vault/key-context.md): User-managed cardinality for keys within Vault.
- [Vault](https://workos.com/docs/vault.md): Encrypt, store, and control access to sensitive data.
- [Bring Your Own Key (BYOK)](https://workos.com/docs/vault/byok.md): Allow your customers to use their own encryption keys with WorkOS Vault for enhanced security and compliance.
## Single Sign-On
- [Test SSO](https://workos.com/docs/sso/test-sso.md): Learn how to test your Single Sign-On integration end-to-end.
- [Single Logout](https://workos.com/docs/sso/single-logout.md): Learn how to implement Single Logout with WorkOS
- [SAML Signing Certificates](https://workos.com/docs/sso/signing-certificates.md): Verify the authenticity of SAML responses and requests.
- [Sign-in Consent](https://workos.com/docs/sso/sign-in-consent.md): Learn about the sign-in consent screen, an extra layer of protection against login CSRF attacks and phishing attempts.
- [SAML Security Considerations](https:/Measured from the saved file
Size measures the captured UTF-8 text, not compressed transfer size. Tokens are counted with a named tokenizer; other models can count differently. Neither measure establishes context compatibility or answer quality.
WorkOS is the enterprise authentication and identity platform for SaaS companies. AuthKit ships email/password, social login, passkeys, MFA, magic auth, and enterprise SSO from one integration, and is free up to 1M monthly active users. Enterprise APIs include Single Sign-On, SCIM Directory Sync, RBAC, Audit Logs, Radar (bot and fraud protection), Vault, and a no-code Admin Portal — priced per connection with volume discounts. SDKs for Node, Python, Go, Ruby, PHP, Java, and .NET.
Context architecture
33 H2 sections organize 842 parsed Markdown links. 840 links point to .md or .markdown paths; 2 link occurrences use another hostname. Linked destinations have not been recursively validated.
| H2 section | Links | UTF-8 bytes | Tokens |
|---|---|---|---|
| Getting startedLine 7 | 1 | 136 | 33 |
| PricingLine 11 | 1 | 132 | 36 |
| Developer toolsLine 15 | 3 | 366 | 90 |
| FeedbackLine 20 | 1 | 162 | 35 |
| PostmanLine 24 | 1 | 103 | 28 |
| On prem deploymentLine 28 | 1 | 146 | 34 |
| Migrate standalone ssoLine 32 | 1 | 166 | 42 |
| McpLine 36 | 1 | 219 | 50 |
| GlossaryLine 40 | 1 | 112 | 28 |
| EmailLine 44 | 1 | 102 | 24 |
| Widgets APILine 48 | 103 | 11647 | 2635 |
| WidgetsLine 154 | 19 | 2742 | 579 |
| VaultLine 176 | 4 | 533 | 128 |
| Single Sign-OnLine 183 | 17 | 2371 | 561 |
| SdksLine 204 | 19 | 1065 | 358 |
| API ReferenceLine 226 | 435 | 44870 | 10880 |
| H2 section | Links | UTF-8 bytes | Tokens |
|---|---|---|---|
| RBACLine 664 | 6 | 838 | 187 |
| PipesLine 673 | 8 | 1223 | 262 |
| MigrationsLine 684 | 9 | 1197 | 292 |
| Multi-Factor AuthLine 696 | 4 | 465 | 111 |
| Magic LinkLine 703 | 3 | 414 | 97 |
| IntegrationsLine 709 | 70 | 8919 | 2385 |
| FGALine 782 | 20 | 3139 | 722 |
| Feature FlagsLine 805 | 6 | 1054 | 226 |
| EventsLine 814 | 6 | 797 | 192 |
| Domain VerificationLine 823 | 2 | 200 | 44 |
| Directory SyncLine 828 | 8 | 1353 | 285 |
| DeprecationsLine 839 | 1 | 179 | 37 |
| DashboardLine 843 | 6 | 912 | 192 |
| Custom DomainsLine 852 | 5 | 660 | 142 |
| AuthKitLine 860 | 68 | 10247 | 2208 |
| Audit LogsLine 931 | 7 | 948 | 221 |
| Admin PortalLine 941 | 4 | 555 | 126 |
Link counts exclude parsed fenced and inline code and resolve relative destinations against the final endpoint. Section sizes cover the text below each H2 until the next H2.
Embedded material
Embedded example text and links to further documentation are counted separately. A code block does not establish that a sample runs or that an authentication flow succeeds.
Publisher prioritization
No H2 section named “Optional” was detected in this file.
The community proposal uses Optional by convention for secondary links that can be skipped for a shorter context. This label does not establish that everything outside it is critical, or that the material inside it is deprecated.
Machine-readable routes
MCP-related text was detected in the captured file. 2 links have MCP-related labels or paths. 0 fenced lines match mcpServers, mcp_servers or an mcp add command.
These are text and link observations. No MCP server connection, authentication or tool call was tested.
Index and bundle
Verified text companion
A verified text response establishes a companion at the checked URL. It does not prove the bundle contains all product documentation, that generation is automated, or that it fits an assistant’s context window.
Change evidence
This capture establishes a baseline. Update frequency cannot be determined from one observation.
6 links have release, changelog, deprecation or migration terms in their labels or paths. These provide places to investigate product changes separately.
File changes can reveal documentation edits or navigation changes. They do not by themselves measure product release velocity, accuracy, agent adoption or AI visibility.
59cd91e9ce0d91d54fd44ad3c9496fddf51221404c16d20e65e36c5ab72de172Counts use a deterministic parser, not a spec-compliance grade. Unusual Markdown and indented code can fall outside its recognized patterns. See the llms.txt proposal and tokenizer implementation.