# WorkOS

```json
{
  "name": "WorkOS",
  "slug": "workos",
  "url": "https://composio.dev/toolkits/workos",
  "markdown_url": "https://composio.dev/toolkits/workos.md",
  "logo_url": "https://logos.composio.dev/api/workos",
  "categories": [
    "developer tools & devops"
  ],
  "is_composio_managed": false,
  "updated_at": "2026-10-12T12:48:37.666Z"
}
```

![WorkOS logo](https://logos.composio.dev/api/workos)

## Description

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with WorkOS MCP or direct API to sync directories, manage users, create connections and invitations, and query user profiles through natural language.

## Summary

WorkOS is an enterprise identity and user management API for directory sync, connections, invitations, and users.
Use it to centralize SSO, provisioning, and directory synchronization across providers.

## Categories

- developer tools & devops

## Toolkit Details

- Tools: 29

## Images

- Logo: https://logos.composio.dev/api/workos

## Authentication

- **Api Key**
  - Type: `api_key`
  - Description: Api Key authentication for WorkOS.
  - Setup:
    - Configure Api Key credentials for WorkOS.
    - Use the credentials when creating an auth config in Composio.

## Suggested Prompts

- Sync new users from Okta directory
- Create invitation links for pending users
- List all connected identity providers and statuses

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `WORKOS_CREATE_ORGANIZATION` | Create Organization | Create a WorkOS organization in the connected environment. |
| `WORKOS_CREATE_ORGANIZATION_MEMBERSHIP` | Create Organization Membership | Grant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated. |
| `WORKOS_CREATE_USER` | Create User | Create a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords. |
| `WORKOS_DELETE_ORGANIZATION` | Delete Organization | Permanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID. |
| `WORKOS_DELETE_ORGANIZATION_MEMBERSHIP` | Delete Organization Membership | Permanently remove an organization membership and its access. Prefer deactivation when access may need to be restored. |
| `WORKOS_DELETE_USER` | Delete User | Permanently delete an AuthKit user. This cannot be undone and may remove the user's access. |
| `WORKOS_GET_CONNECTION` | Get Connection | Get one WorkOS connection by ID. |
| `WORKOS_GET_DIRECTORY` | Get Directory | Get one WorkOS Directory Sync directory by ID. |
| `WORKOS_GET_DIRECTORY_GROUP` | Get Directory Group | Get one WorkOS Directory Sync group by its exact group ID. |
| `WORKOS_GET_DIRECTORY_USER` | Get Directory User | Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by this directory user ID. |
| `WORKOS_GET_INVITATION` | Get Invitation | Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials. |
| `WORKOS_GET_ORGANIZATION` | Get Organization | Get one WorkOS organization by its WorkOS ID or external ID. |
| `WORKOS_GET_ORGANIZATION_MEMBERSHIP` | Get Organization Membership | Get one WorkOS AuthKit organization membership by ID. |
| `WORKOS_GET_USER` | Get User | Get one WorkOS AuthKit user by WorkOS ID or external ID. |
| `WORKOS_LIST_CONNECTIONS` | List Connections | List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name. |
| `WORKOS_LIST_DIRECTORIES` | List Directories | List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain. |
| `WORKOS_LIST_DIRECTORY_GROUPS` | List Directory Groups | List one page of WorkOS Directory Sync groups for a directory, a directory user, or both. |
| `WORKOS_LIST_DIRECTORY_USERS` | List Directory Users | List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per second per directory; on HTTP 429, honor Retry-After before retrying. |
| `WORKOS_LIST_INVITATIONS` | List Invitations | List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials. |
| `WORKOS_LIST_ORGANIZATION_MEMBERSHIPS` | List Organization Memberships | List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships. |
| `WORKOS_LIST_ORGANIZATIONS` | List Organizations | List one page of WorkOS organizations, optionally filtered by domain or organization name. |
| `WORKOS_LIST_USERS` | List Users | List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address. |
| `WORKOS_RESEND_INVITATION` | Resend Invitation | Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token and acceptance URL. |
| `WORKOS_REVOKE_INVITATION` | Revoke Invitation | Revoke a pending AuthKit invitation so it can no longer be accepted. |
| `WORKOS_SEND_INVITATION` | Send Invitation | Create an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intentional. The output omits the sensitive acceptance token and acceptance URL. |
| `WORKOS_SET_ORGANIZATION_MEMBERSHIP_STATUS` | Set Organization Membership Status | Activate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active. |
| `WORKOS_UPDATE_ORGANIZATION` | Update Organization | Update selected properties of an existing WorkOS organization. |
| `WORKOS_UPDATE_ORGANIZATION_MEMBERSHIP_ROLES` | Update Organization Membership Roles | Replace the role assignment on an existing WorkOS organization membership. |
| `WORKOS_UPDATE_USER` | Update User | Update selected profile fields on an AuthKit user without invoking email delivery flows. |

## Supported Triggers

None listed.

## Installation and MCP Setup

### Path 1: SDK Installation

#### Path 1, Step 1: Install Composio

Install the Composio SDK
```python
pip install composio_openai
```

```typescript
npm install @composio/openai
```

#### Path 1, Step 2: Initialize Composio and Create Tool Router Session

Import and initialize Composio client, then create a Tool Router session
```python
from openai import OpenAI
from composio import Composio
from composio_openai import OpenAIResponsesProvider

composio = Composio(provider=OpenAIResponsesProvider())
openai = OpenAI()
session = composio.create(user_id='your-user-id')
```

```typescript
import OpenAI from 'openai';
import { Composio } from '@composio/core';
import { OpenAIResponsesProvider } from '@composio/openai';

const composio = new Composio({
  provider: new OpenAIResponsesProvider(),
});
const openai = new OpenAI({});
const session = await composio.create('your-user-id');
```

#### Path 1, Step 3: Execute WorkOS Tools via Tool Router with Your Agent

Get tools from Tool Router session and execute WorkOS actions with your Agent
```python
tools = session.tools
response = openai.responses.create(
  model='gpt-4.1',
  tools=tools,
  input=[{
    'role': 'user',
    'content': 'YOUR_SPECIFIC_PROMPT_HERE'
  }]
)
result = composio.provider.handle_tool_calls(
  response=response,
  user_id='your-user-id'
)
print(result)
```

```typescript
const tools = session.tools;
const response = await openai.responses.create({
  model: 'gpt-4.1',
  tools: tools,
  input: [{
    role: 'user',
    content: 'YOUR_SPECIFIC_PROMPT_HERE'
  }],
});
const result = await composio.provider.handleToolCalls(
  'your-user-id',
  response.output
);
console.log(result);
```

### Path 2: MCP Server Setup

#### Path 2, Step 1: Install Composio

Install the Composio SDK for Python or TypeScript
```python
pip install composio claude-agent-sdk
```

```typescript
npm install @composio/core ai @ai-sdk/openai @ai-sdk/mcp
```

#### Path 2, Step 2: Initialize Client and Create Tool Router Session

Import and initialize the Composio client, then create a Tool Router session for WorkOS
```python
from composio import Composio

# Initialize Composio and create a Tool Router session
composio = Composio(api_key='your-composio-api-key')
session = composio.create(user_id='your-user-id')
url = session.mcp.url

# Example: create an auth config for WorkOS (API key) and link a connected account
# Note: WorkOS uses an API key; configure your WorkOS API key here
auth_config = composio.auth_configs.create(toolkit='workos', auth_type='api_key', name='workos-api-key', config={'api_key': 'YOUR_WORKOS_API_KEY'})
connected_account = composio.connected_accounts.link(auth_config_id=auth_config.id, account_name='workos-enterprise-account')

# You can also create an MCP entry if needed
mcp_entry = composio.mcp.create(name='workos-tool-router', session_id=session.id)
print(f"Tool Router URL: {url}")
```

```typescript
import { Composio } from '@composio/core';

const composio = new Composio({ apiKey: 'your-api-key' });
const session = await composio.create('your-user-id');
console.log(`Tool Router session created: ${session.mcp.url}`);

// Example: create an auth config for WorkOS (API key) and link a connected account
// WorkOS uses an API key; set YOUR_WORKOS_API_KEY in config
const authConfig = await composio.auth_configs.create({ toolkit: 'workos', auth_type: 'api_key', name: 'workos-api-key', config: { api_key: 'YOUR_WORKOS_API_KEY' } });
const connectedAccount = await composio.connected_accounts.link({ auth_config_id: authConfig.id, account_name: 'workos-enterprise-account' });

// Optionally create an MCP entry
const mcpEntry = await composio.mcp.create({ name: 'workos-tool-router', session_id: session.id });
console.log(`MCP entry created: ${mcpEntry.id}`);
```

#### Path 2, Step 3: Connect to AI Agent

Use the MCP server with your AI agent (Anthropic Claude or Mastra)
```python
import asyncio

from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions

options = ClaudeAgentOptions(
    permission_mode='bypassPermissions',
    mcp_servers={
        'tool_router': {
            'type': 'http',
            'url': url,
            'headers': {
                'x-api-key': 'your-composio-api-key'
            }
        }
    },
    system_prompt='You are a helpful assistant with access to WorkOS tools.',
    max_turns=10
)

async def main():
    async with ClaudeSDKClient(options=options) as client:
        await client.query('YOUR_SPECIFIC_PROMPT_HERE')
        async for message in client.receive_response():
            if hasattr(message, 'content'):
                for block in message.content:
                    if hasattr(block, 'text'):
                        print(block.text)

asyncio.run(main())
```

```typescript
import { openai } from '@ai-sdk/openai';
import { experimental_createMCPClient as createMCPClient } from '@ai-sdk/mcp';
import { generateText } from 'ai';

const client = await createMCPClient({
  transport: {
    type: 'http',
    url: session.mcp.url,
    headers: {
      'x-api-key': 'your-composio-api-key',
    },
  },
});

const tools = await client.tools();
const { text } = await generateText({
  model: openai('gpt-4o'),
  tools,
  messages: [{
    role: 'user',
    content: 'YOUR_SPECIFIC_PROMPT_HERE'
  }],
  maxSteps: 5,
});

console.log(`Agent: ${text}`);
```

## Why Use Composio?

### 1. AI Native WorkOS Integration

- Supports both WorkOS MCP and direct API based integrations
- Structured, LLM-friendly schemas for reliable tool execution
- Rich coverage for reading, writing, and querying your WorkOS data

### 2. Managed Auth

- Built-in API key handling with secure storage
- Central place to manage, scope, and revoke WorkOS access
- Per user and per environment credentials instead of hard-coded keys

### 3. Agent Optimized Design

- Tools are tuned using real error and success rates to improve reliability over time
- Comprehensive execution logs so you always know what ran, when, and on whose behalf

### 4. Enterprise Grade Security

- Fine-grained RBAC so you control which agents and users can access WorkOS
- Scoped, least privilege access to WorkOS resources
- Full audit trail of agent actions to support review and compliance

## Use WorkOS with any AI Agent Framework

Choose a framework you want to connect WorkOS with:

- [ChatGPT](https://composio.dev/toolkits/workos/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/workos/framework/claude-cowork)
- [Hermes](https://composio.dev/toolkits/workos/framework/hermes-agent)
- [Atomic Agent](https://composio.dev/toolkits/workos/framework/atomic-agent)

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [GitHub](https://composio.dev/toolkits/github) - GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anakin](https://composio.dev/toolkits/anakin_io) - Anakin is a web automation platform offering scraping, crawling, search, and browser automation. Use it to extract structured data, automate site tasks, and monitor web changes reliably.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [Authyo](https://composio.dev/toolkits/authyo) - Authyo is a REST API service for passwordless authentication, OTP verification, session management, and transactional notifications. Use it to add secure login flows and user verification without building auth infrastructure from scratch.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Azure Monitor Activity Log](https://composio.dev/toolkits/azure_monitor_activity_log) - Azure Monitor Activity Log is Azure's service that records management and control-plane events for a subscription. Use it to audit changes, troubleshoot issues, and track resource operations across your Azure resources.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.
- [Baserow](https://composio.dev/toolkits/baserow) - Baserow is an open-source no-code database platform for building collaborative data apps. It makes it easy for teams to organize data and automate workflows without writing code.

## Frequently Asked Questions

### Do I need my own developer credentials to use WorkOS with Composio?

Yes, WorkOS requires you to configure your own API key credentials. Once set up, Composio handles secure credential storage and API request handling for you.

### Can I use multiple toolkits together?

Yes! Composio's Tool Router enables agents to use multiple toolkits. [Learn more](https://docs.composio.dev/tool-router/overview).

### Is Composio secure?

Composio is SOC 2 and ISO 27001 compliant with all data encrypted in transit and at rest. [Learn more](https://trust.composio.dev).

### What if the API changes?

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)