LoginSign Up
← Back to all sparks
W

WorkOS

INFRA · APIS
Velocity8.8

WorkOS is making agents first-class principals and taking custody of the tokens they act with.

agent-identitytoken-custodyauthkitpipesai-coworker
◆Current state
WorkOS shipped a dense two-week window across three fronts. On identity, Agent Registration lets agents sign into AuthKit using the auth.md protocol, treating a non-human caller as a registrable principal rather than a service account borrowed from a human. On integrations, Pipes gained API key support alongside OAuth and then a Token Proxy that calls third-party APIs on a user's behalf without the application ever handling their access token. Separately the company launched Atlas, a Slack-based AI coworker, and shipped a local WorkOS API for CI/CD testing with seeded data, signed webhooks and fault injection.
◆Where it's heading
The through-line is that WorkOS is building the plumbing for software that acts on a user's behalf without inheriting the user's credentials. Agent Registration establishes who the agent is, the Pipes Token Proxy removes the need for the agent's application to hold the token it acts with, and the one-click Claude and ChatGPT plugins put those pieces in reach of the tools people are already using. Atlas points a second way: WorkOS is not only selling this infrastructure but building an end-user product on top of it. The CI/CD testing work is the unglamorous prerequisite for any of it being adopted in regulated environments.
◆Prediction
Expect the agent principal from Agent Registration and the token custody in Pipes to converge, so that an agent's registered identity is what scopes which third-party calls the proxy will make for it. Whether WorkOS competes with its own customers via Atlas is the open question these entries do not answer.

◆Recent moves

  1. 6d ago

    Pipes Token Proxy

    ⚡ SPARK

    Pipes moves from brokering connections to standing in the request path, which is the piece that makes the agent-identity work usable. An agent can now act against a third-party API without its application ever being trusted with the user's token.

  2. 8d ago

    Atlas: Your AI Coworker

    ⚡ SPARK

    A company that sells identity infrastructure to developers has shipped an application aimed at whole teams. Atlas sits outside the arc of the rest of this window, which makes it the more consequential signal about where WorkOS thinks the value is.

  3. 8d ago

    Agent Registration

    ⚡ SPARK

    This is the entry that reframes what AuthKit is for. Identity infrastructure built around human sessions now admits agents as registrable principals through an open protocol, which is the precondition for everything else WorkOS shipped this window.

  4. 13d ago

    Testing WorkOS in CI/CD

    Developers can now run a local WorkOS API with seeded data, interactive login flows, signed webhooks and fault injection. Unglamorous, but testing auth flows against a real local implementation rather than mocks is what makes the rest of this window safe to adopt.

  5. 13d ago

    Pipes API Key Support

    Pipes extends beyond OAuth to providers that authenticate with API keys, widening which third parties it can front. Coverage work that set up the Token Proxy landing a week later.

  6. 16d ago

    WorkOS Plugin for Claude and ChatGPT

    A one-click plugin connects WorkOS to Claude or ChatGPT. Distribution rather than capability, but it puts the identity and integration surface directly inside the assistants that will be driving it.