Member Junction
    Preparing search index...

    Class WorkOSProvider

    WorkOS (AuthKit) authentication provider implementation.

    Validates JWT access tokens minted by WorkOS AuthKit / User Management. These tokens are signed with RS256 and verified against the per-environment JWKS endpoint (https://api.workos.com/sso/jwks/<clientId>); their iss claim is https://api.workos.com/user_management/<clientId>.

    MemberJunction resolves the signed-in user by email, but a WorkOS AuthKit access token only carries identity/session claims (sub, sid, org_id, role, permissions) out of the box — it does not include email. To use WorkOS with MJ you must add the email (and ideally the name) to the token via a WorkOS JWT Template:

    {
      "email": "{{user.email}}",
      "given_name": "{{user.first_name}}",
      "family_name": "{{user.last_name}}"
    }

    See WORKOS.md in this package for the full, step-by-step integration guide.

    Hierarchy (View Summary)

    Index

    Constructors

    constructor

    Properties

    audience clientId? config issuer jwksClient jwksUri name

    Methods

    extractUserInfo getSigningKey matchesIssuer validateConfig

    Constructors

    Properties

    audience: string

    The expected audience for tokens from this provider

    clientId?: string

    OAuth client ID for this provider (used by OAuth proxy for upstream auth)

    config: AuthProviderConfig
    issuer: string

    The issuer URL for this provider (must match the 'iss' claim in tokens)

    jwksClient: JwksClient
    jwksUri: string

    The JWKS endpoint URL for retrieving signing keys

    name: string

    Unique name identifier for this provider

    Methods

    • Extracts user information from a WorkOS AuthKit JWT payload.

      email, given_name, and family_name are expected to be supplied by a WorkOS JWT Template (see class docs). sub is the stable WorkOS user id (user_...). We fall back through standard OIDC claim names so a token shaped by a custom template (e.g. one that only sets name) still resolves a usable identity.

      Parameters

      • payload: JwtPayload

      Returns AuthUserInfo

    Settings

    Member Visibility

    On This Page

    Email is required — and is NOT in a WorkOS token by default
    Constructors
    Properties
    Methods