LoginSign Up
← Back to all sparks
W

WorkOS

INFRA · APIS
Velocity8.8

WorkOS is building identity for agents while quietly fixing the sign-up funnel.

identityauthenticationai-agentsscimdeveloper-infrastructureoauth
◆Current state
WorkOS ships several small entries a week, and August splits cleanly in two. One half is authentication housekeeping for human users: an Android SDK, deliverability checks that reject undeliverable addresses at sign-up, invitation acceptance counting as email verification, and a reversible SCIM proxy for migrating directory connections without downtime. The other half is agent infrastructure — Agent Registration via the auth.md protocol, and the Pipes Token Proxy that calls third-party APIs on a user's behalf without the application ever touching their token.
◆Where it's heading
The agent work is the strategic line. Registration gives an agent an identity of its own instead of a borrowed human session; the token proxy means an application acting for a user never holds the credential. Together they describe a stack where an agent can be authorized, audited and revoked as a first-class principal. The human-auth releases are conversion and migration work — the deliverability check and SCIM Bridge both remove reasons a customer stalls — which is what a developer-infrastructure company does while its next category is still forming.
◆Prediction
Registration and the token proxy leave scoping and revocation as the visible gaps, so expect per-agent permissions or consent surfaces next. Whether auth.md gains adoption beyond WorkOS is not something these entries can answer.

◆Recent moves

  1. 2d ago

    Android SDK

    An Android SDK joins the client library set. Platform coverage catching up, and a prerequisite for AuthKit being the default in mobile products rather than web-only ones.

  2. 2d ago

    Higher quality sign-ups with email deliverability checks

    AuthKit now rejects sign-ups and invitations to addresses that cannot receive mail, catching typo domains at entry rather than after a bounce. It pairs with the invitation-verification change a few days earlier — both remove dead ends from the funnel rather than adding capability.

  3. 5d ago

    Migrate SCIM Connections with SCIM Bridge

    SCIM Bridge proxies existing SCIM connections into WorkOS reversibly, so a directory migration can roll back. Migration risk is the standard objection when replacing an identity layer, and this is aimed directly at it.

  4. 6d ago

    Accepted invitations count as email verification

    Accepting an invitation within ten minutes now counts as email verification, dropping a redundant second email. A small friction removal in the same sign-up cleanup as the deliverability check.

  5. 13d ago

    Pipes Token Proxy

    ⚡ SPARK

    The second half of WorkOS's agent stack: an application can act on a user's third-party accounts without ever holding the credential. Registration says who the agent is; the proxy governs what it may do with someone else's access.

  6. 15d ago

    Agent Registration

    ⚡ SPARK

    Agents get to authenticate as themselves rather than borrowing a human session or a shared service account. It is the foundational piece of the agent-identity line WorkOS has been assembling all month.