HN user
Michael Grinich
WorkOS founder
mg@workos.com
https://twitter.com/grinich
Custom roles per-org is supported natively with WorkOS. (I'm the founder.)
I think we have the most advanced RBAC system. You can even map roles from custom IdP groups via SCIM.
More info here: https://workos.com/guides/user-provisioning-scim
Hi I'm the founder of WorkOS.
We're working on multi-app support. The large majority of our customers only have 1 app (ChatGPT, Claude, Cursor, etc.) but this isn't the case for developers building lots of side projects.
Also working on shipping an agent-friendly Dashboard. Stay tuned :)
Would love to hear any more feedback: mg@workos.com
WorkOS has a built-in workflow for all the complex SAML/SCIM attribute mapping.
https://workos.com/docs/directory-sync/attributes
Also certificate renewal flows:
https://workos.com/changelog/certificate-renewal-flow
(I'm the founder.)
Docs to migrate from Clerk to WorkOS: http://workos.com/docs/migrate/clerk
Claude Code can often one-shot it. Feel free to reach out if I can help!
WorkOS powers auth for OpenAI, Anthropic, Cursor, Vercel, Perplexity, Clay, Webflow, Granola, and a bunch of others. Free up to 1m users, you pay for enterprise features.
I'm the founder and happy to help. We've differentiated by focusing on "b2b auth" via SAML/SCIM, but today we do everything else. We also have products for feature flags, encryption, bot blocking, MCP auth, etc.
Fun fact, we actually launched on HN in 2020 :) https://news.ycombinator.com/item?id=22607402
What do you use for RBAC today? Do you have AI rewrite it every time?
If you’re looking for b2b identity, I’m the founder of WorkOS and we power this for a bunch of apps. Feel free to email me, mg@workos.com
OpenAI uses WorkOS for SSO and SCIM.
https://help.openai.com/en/articles/9627404-openai-chatgpt-s...
It's so bad
Here is a major vulnerability we disclosed earlier this year:
I got hit with the same kind of phishing attack a couple months ago
It's pretty incredible the level of UI engineering that went into it.
Some screenshots I took: https://x.com/grinich/status/1963744947053703309
They migrated SSO/SAML to WorkOS, and consumer auth to forked open source.
(self plug since you asked!)
WorkOS does exactly this. It's "Stripe for enterprise features."
Our customers include OpenAI, Anthropic, xAI, Cursor, Perplexity, Vercel, Replit, Webflow, Clay, Hex, Carta, Plaid, Drata, Vanta, and many others. If you've used these products, you've used WorkOS!
WorkOS makes it easy to "cross the enterprise chasm." Here's a bit more of the backstory: https://x.com/grinich/status/1841569664465568248
We also launched on HN 5 years ago :) https://news.ycombinator.com/item?id=22607402
thank you! feedback very welcome if you have any suggestions for things to improve or ideas for what we should build next
also if anyone wants to go down the rabbit hole about why SAML is hard to implement, this is a pretty interesting writeup of a major 0-day vuln we discovered earlier this year: https://workos.com/blog/samlstorm
I started a startup to fix this exact problem integrating and configuring SSO/SAML.[0]
We launched here on HN 5 years ago[1] and today power SSO for OpenAI, Cursor, Vercel, and a thousand other apps. We also found the initial configuration step to be painful for users, so we built a self-serve wizard that enables enterprise admins to fix issues.[2]
It's still crazy how much complexity there is with enterprise identity systems and managing the user lifecycle for big orgs. It's like the whole thing is made of weird edge cases and even moreso when you add SCIM, RBAC, MFA, etc etc.
(If anyone reading this also loves suffering at the intersection of IAM and developer tools, we are hiring! Email in my profile :))
Hey I'm the founder of WorkOS.
Glad things are working well for you. If you have any feedback/ideas, I would love to hear them. Thanks! mg@workos.com
Hey - I'm the founder of WorkOS. Happy to chat about the playbook we see with OSS projects spinning-off a commercial offering. It's pretty common and we work with a lot of these businesses, enabling them to continue investment in the ecosystem too. mg@workos.com
For SSO, RBAC, etc, check out https://workos.com
I’m the founder :) Happy to help!
Hi - I work at WorkOS. That's the base price and it decreases exponentially as you scale.
Click on "Automatic volume discounts" here: https://workos.com/pricing
(Our pricing page is confusing and we're working to update it! If you have questions about pricing, please just email us support@workos.com)
Hi - I'm the founder of WorkOS. Would love any feedback you can share here or via email (mg@workos.com)
Betterauth and WorkOS are pretty different. For example, WorkOS isn't designed exclusively for TypeScript (we support SDKs for a bunch of languages/platforms) and WorkOS runs as a cloud service. The developer experience will always be different because of this.
We also design the platform to be modular, which enables you to just use WorkOS for SSO or SCIM alongside an existing auth stack. We call these the standalone APIs and lots of customers use it this way.
WorkOS is focused on enterprise features for b2b apps and solving problems that come with growing upmarket. Today we power auth for OpenAI, Anthropic, Perplexity, Cursor, Vercel, Plaid, and hundreds more.
We love getting feedback so please feel free to post here, email, or twitter DMs are open. Thanks!
(I also love open source and am glad to see more innovation happening here in the ecosystem!)
What about WorkOS? I'm the founder and would be happy to help. mg@workos.com
I'm the founder of WorkOS and we solve this problem for developers, primarily focusing on the challenges around enterprise SAML, SCIM, complex RBAC, fine-grained authorization, and more.
We build the Admin Portal for IdP configuration: https://workos.com/admin-portal
WorkOS actually launched on HN about 5 years ago[0] and today it's used by OpenAI, Cursor, Perplexity, and hundreds of other companies.
Feel free to email me if I can help: mg@workos.com
There are several open source options out there (several linked above) that could be a good fit for your business economics. I know lots of folks talk about Supabase and Auth.js on X.
If you have the time and patience, you can also certainly build it yourself. There's no miracles here, just complex engineering and solving a thousand edge cases.
If you decide to use open source, make sure you quickly update dependencies so you're always running latest. Ruby-SAML had a major vulnerability disclosed last month and thousands of apps were affected: https://workos.com/blog/ruby-saml-cve-2024-45409
"You can think of us as an open source alternative to products like Auth0 or WorkOS." from SSOReady's README: https://github.com/ssoready
Single dev in contributors graph: https://github.com/ssoready/ssoready/graphs/contributors
Pre-pivot startup called Okapi (YC W24): https://news.ycombinator.com/item?id=39755927
on changing emails: https://news.ycombinator.com/item?id=41927216
Yes it will happen!
I work at WorkOS / AuthKit.
We took the Heroku approach. All apps get a free *.authkit.app domain for the hosted login page.
AuthKit never has any WorkOS branding. Clerk puts "Powered by Clerk" on your login page unless you pay. This feels gross. Imagine if Heroku/Vercel were injecting ads into your app?!
AuthKit has free MFA. I believe everyone should get secure auth. Clerk charges to enable MFA. They also charge for passkeys and features like impersonation. Why?
Custom domains cost us $ to run (we pay Cloudflare) so we charge for this. It's also designed for commercial apps. The authkit.app is great for any hobby app.
Security features seem like the ONE thing you wouldn't want an LLM generating/hallucinating ...
Hey thanks for the shout-out. I work at WorkOS / AuthKit.
tl;dr - we know this feature is missing and we are working on it
Changing email address is of those simple sounding features that has a ton of complex edge-cases that are critically important to get right. The crux of it is how organization membership/invites and resource sharing typically works with unconfirmed email addresses in apps. What happens with the old email address? Can a different user claim it? Are you allowed to change your email address if your account comes from SAML/SCIM? If you get this behavior wrong, it will lead to inconsistencies that can even cause security vulnerabilities.
Solving this for thousands of different types of apps of course makes the problem significantly more complex. It turns out different developers actually want slightly different behavior, so we need AuthKit to be customizable to accommodate this. More than anything, want to avoid changing these APIs after launching them (even in beta) so there isn't developer thrash. We are working to make sure the solution is as complete as possible and that's taking longer than I would hope.
In the meantime we have some workarounds. e.g. popular apps like Cursor are built on AuthKit and work great.
Anyone can send me an email if you want to chat about this. We're also hiring if you want to work on it. :) mg@workos.com
I knew I forgot one! Just added.