01 · ABOUT

What WorkOS does

Provides OAuth authorization for MCP servers through AuthKit and WorkOS Connect.

Why teams reach for it: Acts as the OAuth authorization server for MCP servers, whether AuthKit handles user login or the application already does.

Worth knowing

It implements OAuth 2.1, with PKCE supported, and CIMD and DCR client registration. It federates with Okta, Entra ID, Auth0 SAML, Google OAuth, Microsoft OAuth, GitHub OAuth, Sign in with Apple, OpenID Connect, Custom SAML.

SaaSOpen SourceTypeScriptMCP Server
02 · TECHNICAL SPECIFICATIONS

How WorkOS compares

Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."

Oauth Version
OAuth 2.1
Client Registration
CIMD and DCR
Resource Indicators (RFC 8707)
Yes
Protected Resource Metadata (RFC 9728)
Yes
Authorization Server Metadata (RFC 8414)
Yes
Pkce
Supported
Token Exchange (RFC 8693)
Yes
Idp Federation
Okta, Entra ID, Auth0 SAML, Google OAuth, Microsoft OAuth, GitHub OAuth, Sign in with Apple, OpenID Connect, Custom SAML
03 · NEW TO MCP?
Who can connect, and what may they do?

Authorization & identity tools control who — or which AI agent — is allowed to connect, and what they're allowed to do once connected.