WorkOS

What can you set up before a customer asks for company sign-in?

Use AuthKit to let customers sign in and join a workspace. WorkOS can host the sign-in screen. Your app handles the registered return address and uses the resulting session to recognize later requests.

Start with the account methods your first customers need. Company single sign-on lets someone use the company’s existing identity service. Directory Sync is a separate connection for updating accounts from the company directory. You can plan those connections when a customer needs them.

Does signing in let someone open every workspace?

Check the signed-in session and the person’s membership in the workspace that owns the record. A person may be a member of one workspace and have no access to another.

When your app receives a request to open an invoice, check the workspace tied to the invoice on the server. Decide which roles can open or change it. A workspace selector helps people navigate, but your server still has to enforce the decision.

How can you check a workspace boundary without using customer accounts?

Start on paper with two fictional workspaces and one account in each. If you run the exercise, use a disposable app and the WorkOS local emulator. Before opening the app, verify that the sign-in page and server requests use only the emulator. Confirm the invoices, return address, webhooks and analytics stay inside the test setup. Leave real email and company identity connections disconnected.

1. 1
   Set up two sample memberships

   In the emulator’s seed file, the file that creates its starting data, add two fictional users and two organizations. Make each user an active member of only one organization and give each organization its own sample invoice in the test app.
2. 2
   Sign in through the emulator

   Start it with the --interactive option. Without that option it skips the sign-in page and sends the browser straight back to the app. In two separate browser sessions, use the two seeded accounts and confirm each can open its own invoice.
3. 3
   Check the other workspace

   In the first session, try to open the second workspace’s sample invoice. The server should return no invoice data. The emulator checks this integration with test data. It cannot confirm that a real identity provider is configured correctly.

Who helps a customer get back into the app?

For an AuthKit email-and-password account, WorkOS sends password reset email by default. If you turn off the built-in delivery, you are responsible for sending the reset message yourself.

When the customer uses their company’s sign-in, a forgotten password normally goes through that company’s identity provider. Keep those two recovery routes clear on the help page.

What changes the bill and what can you take with you?

WorkOS lists up to one million monthly active AuthKit users at no charge. A user action such as signing up, signing in or updating a profile can count in that month. Production enterprise SSO and Directory Sync use separate connection pricing.

The dashboard can export account profile records as a CSV. WorkOS support handles password hash exports separately. Those hashes are the stored values used to check passwords. Verify the destination can use them and that your workspace membership and app record links survive the move.