WorkOS
Enterprise-ready authentication and user management.
Community: Submitted by a user or imported; check the owner before granting accessOnlineAPI key requiredGlobalFreeRead-only
What it can do
- Api Keys.Validations.Create: Validate an API key value and return the API key object if valid.
- Audit Logs.Actions.List: Get a list of all Audit Log actions in the current environment.
- Audit Logs.Actions.Schemas.List: Get a list of all schemas for the Audit Logs action identified by `:name`.
What data it sees
Do you need an account
An API key from the service settings is required
Enterprise-ready authentication and user management. Manage organizations, users, SSO connections, directory sync, audit logs, fine-grained authorization, and feature flags.
How to connect
How to connect WorkOS to Claude
The server address to paste into Claude settings:
https://workos.run.tools
- Open Claude (claude.ai or the desktop app).
- Go to Settings → Connectors.
- Click Add custom connector.
- Paste the server address copied below into Remote MCP server URL and click Add.
- In a chat, click + → Connectors and switch the new connector on.
Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.
Authorization
After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.
How to connect WorkOS to ChatGPT
The server address to paste into ChatGPT settings:
https://workos.run.tools
- Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
- Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
- Open Settings → Connectors and click Create.
- Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
- Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
- In a new chat open + → Apps/Connectors and enable the connector.
OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.
Authorization
On first use ChatGPT opens the service's sign-in window. Sign in and approve access.
How to connect WorkOS to Cursor
The server address to paste into Cursor settings:
https://workos.run.tools
Fastest: click Open in Cursor below and confirm the prompt.
Manually:
- In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
- Paste the JSON copied below into
~/.cursor/mcp.json(per project:.cursor/mcp.jsonin the repo root). - Save the file. The server appears in the MCP list; authorize it there if asked.
Authorization
If the service needs sign-in, an authorize button appears next to the server in the MCP list.
Server tool list (60)
Raw names from tools/list. Only developers need these.
| api_keys.validations.create | Validate an API key value and return the API key object if valid. |
| audit_logs.actions.list | Get a list of all Audit Log actions in the current environment. |
| audit_logs.actions.schemas.list | Get a list of all schemas for the Audit Logs action identified by `:name`. |
| audit_logs.actions.schemas.create | Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created. |
| audit_logs.events.create | Create an Audit Log Event. This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource. To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions. Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key. |
| audit_logs.exports.create | Create an Audit Log Export. Exports are scoped to a single organization within a specified date range. |
| audit_logs.exports.get | Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL. |
| auth.factors.get | Gets an Authentication Factor. |
| auth.factors.delete | Permanently deletes an Authentication Factor. It cannot be undone. |
| authorization.organization_memberships.check.create | Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug. |
| authorization.organization_memberships.resources.list | Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?" You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource. |
| authorization.organization_memberships.role_assignments.list | List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles. |
| authorization.organization_memberships.role_assignments.create | Assign a role to an organization membership on a specific resource. |
| authorization.organization_memberships.role_assignments.by_organization_membership_id.delete | Remove a role assignment by role slug and resource. |
| authorization.organization_memberships.role_assignments.delete | Remove a role assignment using its ID. |
| authorization.organizations.roles.list | Get a list of all roles that apply to an organization. This includes both environment roles and organization-specific roles, returned in priority order. |
| authorization.organizations.roles.create | Create a new custom organization role. When slug is omitted, it is auto-generated from the role name. |
| authorization.organizations.roles.get | Retrieve a role that applies to an organization by its slug. This can return either an environment role or an organization-specific role. |
| authorization.organizations.roles.update | Update an existing custom organization role. Only the fields provided in the request body will be updated. |
| authorization.organizations.roles.delete | Delete an existing custom organization role. |
| authorization.organizations.roles.permissions.create | Add a single permission to an organization role. If the permission is already assigned to the role, this operation has no effect. |
| authorization.organizations.roles.permissions.update | Replace all permissions on a role with the provided list. |
| authorization.organizations.roles.permissions.delete | Remove a single permission from an organization role by its slug. |
| authorization.organizations.resources.get | Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details. |
| authorization.organizations.resources.update | Update an existing authorization resource using its external ID. |
| authorization.organizations.resources.delete | Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources. |
| authorization.organizations.resources.organization_memberships.list | Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID. |
| authorization.permissions.list | Get a list of all permissions in your WorkOS environment. |
| authorization.permissions.create | Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and organization roles. |
| authorization.permissions.get | Retrieve a permission by its unique slug. |
| authorization.permissions.update | Update an existing permission. Only the fields provided in the request body will be updated. |
| authorization.permissions.delete | Delete an existing permission. System permissions cannot be deleted. |
| authorization.resources.list | Get a paginated list of authorization resources. |
| authorization.resources.create | Create a new authorization resource. |
| authorization.resources.get | Retrieve the details of an authorization resource by its ID. |
| authorization.resources.update | Update an existing authorization resource. |
| authorization.resources.delete | Delete an authorization resource and all its descendants. |
| authorization.resources.organization_memberships.list | Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?". |
| authorization.roles.list | List all environment roles in priority order. |
| authorization.roles.create | Create a new environment role. |
| authorization.roles.get | Get an environment role by its slug. |
| authorization.roles.update | Update an existing environment role. |
| authorization.roles.permissions.create | Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect. |
| authorization.roles.permissions.update | Replace all permissions on an environment role with the provided list. |
| connect.applications.list | List all Connect Applications in the current environment with optional filtering. |
| connect.applications.create | Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types. |
| connect.applications.get | Retrieve details for a specific Connect Application by ID or client ID. |
| connect.applications.update | Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes. |
| connect.applications.delete | Delete an existing Connect Application. |
| connections.list | Get a list of all of your existing connections matching the criteria specified. |
| connections.get | Get the details of an existing connection. |
| connections.delete | Permanently deletes an existing connection. It cannot be undone. |
| directories.list | Get a list of all of your existing directories matching the criteria specified. |
| directories.get | Get the details of an existing directory. |
| directories.delete | Permanently deletes an existing directory. It cannot be undone. |
| directory_groups.list | Get a list of all of existing directory groups matching the criteria specified. |
| directory_groups.get | Get the details of an existing Directory Group. |
| directory_users.list | Get a list of all of existing Directory Users matching the criteria specified. |
| directory_users.get | Get the details of an existing Directory User. |
| events.list | List events for the current environment. |