WorkOS

CHAI AI lets anyone chat with and build AI characters, powered by in-house conversational models and a community of millions of user-created bots. Powered by WorkOS. 🚀

There's a point in token-based integration where a provider access token exists in plain text inside your app. It can be read, logged, or leaked. A credential manager doesn't change that. It still has to hand the token to your code. WorkOS Relay removes that moment. Your app sends the request to WorkOS, Relay attaches the user's credential server-side, and the provider's response streams back. The credential never leaves WorkOS. This matters most when an AI agent is making the call. You can't fully control what an agent logs, echoes back, or passes to the next tool. If it never holds the token, none of that is a risk. Read more👇

The rules are simple: live demos only, no slides, no company pitches. That's Demo Night at WorkOS. 🗓️ September 14 📍 WorkOS SF HQ RSVP:

"MCP or REST?" is the wrong question. REST is built for developer-written code that already knows which endpoint to call. MCP is built for LLM agents that have to discover what your API can do, reason about which operation to use, and hold context across a multi-step task, all at runtime. Different consumers, different protocols. They also aren't competing. Most MCP servers call a REST API under the hood. The GitHub MCP server exposes tools like repository/list, then translates each one into the matching GitHub REST request. MCP handles discovery, sessions, and auth. REST still handles the business logic. The trap is auto-converting every REST endpoint into a tool. A good REST API is generous with hundreds of small endpoints. Hand that to an agent and you drown it in token cost. Design tools around what the user wants to accomplish, not around your internal API structure. Full post👇️

Join us at WorkOS NY HQ for Daytona AI Builders event! Come share your work, get feedback, and meet fellow builders in the community. RSVP:

Generalist is building general-purpose robots you can trust to work, powered by foundation models trained on real-world physical experience. Powered by WorkOS. 🚀

Tonight, 5:30p. Slack Agents Night at WorkOS SF HQ with CopilotKit. Four demos on shipping agents into Slack: • Sofía Sánchez-Zárate (CopilotKit) on Kite & OpenTag with the Channels SDK •  Abhi Aiyer (Mastra) on Mastra Channels •  Ido Pesok (Cognition) on Devin in Slack •  Michael Grinich on WorkOS Atlas See you there:

Most AI founders start with the model. Which LLM, hosted or self-hosted, latency, cost, evals. That's the fun part. Then someone forwards your deck to their security team, and the questions change. Who can see what. How do you revoke access without breaking workflows. How do you provision thousands of users automatically. How do you produce an audit trail when something goes wrong. That's the moment your AI app stops being an AI system and becomes an enterprise software product. SSO across a long tail of identity providers, SCIM provisioning, multi-tenant isolation, real-time abuse detection, audit logs, key management. None of it shows up in the demo. All of it gets scored in the security review before anyone signs. The invisible stack always emerges between a model that works and a product that scales. The only real choice is when you build it👇️

On June 8 a researcher found a memory-corruption bug in Zoom. A day later they had a zero-click exploit working on every platform Zoom ships, off fewer than 20 prompts to a public AI model. Nothing in your auth config would have stopped that. What it decides is what's still live afterward. Set AuthKit's refresh tokens to 24 hours with an inactivity timeout underneath, and a credential stolen off a laptop Monday morning is dead before anyone writes the postmortem. Most teams are running about a week, so the same theft is still minting access the following Monday, long after the malware is gone and the ticket is closed. Patch speed is your vendor's clock. This number is yours. Session lifetime isn't a UX setting you loosen when people complain about getting logged out. It's the expiry date on your worst day. Full guide 👇️

Join us for an unscripted conversation with The Pragmatic Engineer , Gergely Orosz, and WorkOS founder Michael Grinich, on how Gergely became one of the most-read and most-listened-to voices in software, and where AI is taking engineering next. 🗓️ September 17 ⌚️ 5:30 pm 📍 WorkOS NYC HQ Request to join👇️