Blog — WorkOS - hn Reader

Tutorials

All posts

Aug 21, 2026

How to add enterprise SSO to an Express.js API

Add enterprise SSO (SAML and OIDC) to an Express.js API with WorkOS. Step-by-step Node.js code for the login redirect, the callback, and JWT verification on protected API routes.

Maria Paktiti

Aug 21, 2026

Roundups

All posts

Aug 21, 2026

Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM

Auth0's beta keeps the authorization server you already run and adds the enterprise surface around it. The differences from WorkOS show up in SCIM direction, plan tier, and which pricing table you are actually reading.

Maria Paktiti

Aug 21, 2026

Guides

All posts

Aug 18, 2026

Session lifetime is a security control, not a UX setting

A Zoom zero-click RCE went from discovery to working exploit in a day. The exploit took one day; your sessions last longer than that.

Maria Paktiti

Aug 18, 2026

Guides

All posts

Aug 18, 2026

How to store and refresh session tokens correctly with the WorkOS iOS SDK

A practical guide to Keychain storage, refresh token rotation, and terminal vs. transient failures on iOS

Maria Paktiti

Aug 18, 2026

Guides

All posts

Aug 18, 2026

RFC 9470 explained: The OAuth step-up authentication challenge protocol

How an API tells a client that the user needs to authenticate again, why acr_values is only a request while max_age is a requirement, and what the auth_time claim actually proves.

Maria Paktiti

Aug 18, 2026

Product

All posts

Aug 17, 2026

Running the WorkOS API locally

WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod.

Garen Torikian

Aug 17, 2026

Culture

All posts

Aug 17, 2026

What it's like to join WorkOS as a product designer

What it's actually like to join WorkOS as a product designer: transparent context by default, and AI as everyday design tooling.

Sara Kaandorp

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night demo recap: How Mastra turned its issue backlog into a software factory

Abhi Aiyer, co-founder and CTO of Mastra, demoed the company's open source software factory at Agent Night: memory, harness, a rules engine around work.

Zack Proser

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night demo recap: Evil Martians on making your docs discoverable to agents

Irina Nazarova's Agent Night lightning demo: why GitHub, not your docs site, is the path into model training sets, and how Evil Martians measured all of it.

Zack Proser

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night recap: Airlock and intent-based access control

Recap of Agent Night at the Regency Ballroom: why agent permissions break RBAC and least privilege, and a live demo of Airlock, our intent-based access control.

Zack Proser

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night panel recap: AGI arrived, or it's a skill issue

Jaya Gupta, Flo Crivello, and swyx on stage at Agent Night: 5x AI spend, open source getting real, harness engineering, skills, and December predictions.

Zack Proser

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night demo recap: exe.dev — your agent can rewrite the software you use

David Crawshaw of exe.dev showed how two prompts let an agent customize any open source tool you use, then keep those changes rebased on upstream nightly.

Zack Proser

Aug 17, 2026

News

All posts

Aug 17, 2026

Agent Night demo recap: Brian Douglas's self-healing Pokémon agent

Brian Douglas of Paper Compute closed Agent Night with six months of running Pokémon as a self-healing agent: traces, anomalies, dreams, and inceptions.

Zack Proser

Aug 17, 2026

Tutorials

All posts

Aug 17, 2026

Step-up authentication for AI agents

Your MCP server hands an agent a token that stays valid for hours. Here is how to put a human back in the loop before it does something irreversible.

Maria Paktiti

Aug 17, 2026

Engineering

All posts

Aug 14, 2026

Stop giving your coding agent a million-token context window

Derive your coding agent's effective context window from two numbers: the compaction threshold you want, and the response runway the model needs to finish.

Mitch Fultz

Aug 14, 2026