WorkOS Skills: AuthKit, SSO and RBAC for agents
WorkOS Skills
Official WorkOS skills: a router and 40 references on AuthKit, SSO, Directory Sync, RBAC, Vault and moves from Auth0 and Clerk
- 46 ★ on the repository
- Last commit
Extended access
Why this level
- The skill directs the agent to run the workos CLI, which creates a WorkOS environment, writes keys to .env.local and commits changes by default
- The WORKOS_API_KEY and WORKOS_CLIENT_ID keys end up in project files
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/workos-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skill directs the agent to run the workos CLI, which creates a WorkOS environment, writes keys to .env.local and commits changes by default
- The WORKOS_API_KEY and WORKOS_CLIENT_ID keys end up in project files
This is third-party code. Review the repository files before installing.
What it does
The WorkOS repository ships agents two skills and more than 40 reference files. The workos skill acts as a router: by task it loads the right reference, be it AuthKit setup, SSO or a user migration, so references need no separate install. The workos-widgets skill integrates widgets across several frameworks and consults the OpenAPI spec on demand. References split into AuthKit setup for Next.js, React, React Router, TanStack Start, SvelteKit and plain JavaScript, backend SDK setup for Node.js, Python, .NET, Go, Ruby, PHP, Kotlin and Elixir, and features: SSO, Directory Sync, RBAC, Vault, events, audit logs, the admin portal, MFA, domains and email. A separate group covers migration from Auth0, Firebase, Clerk, AWS Cognito, Stytch, Supabase Auth, Descope and Better Auth. Each reference opens with documentation links, then lists traps where models err from training data and, when needed, an endpoint table. For a new project the skill first suggests WORKOS_MODE=agent npx workos@latest install: the command provisions an unclaimed WorkOS environment with no account and writes keys to .env.local.
Who it is for. Developers adding WorkOS AuthKit, enterprise SSO or directory sync who ask an agent to do it without invented SDK methods.
Good fit when
- A Next.js project needs sign-in through AuthKit with a callback and sign-out
- An enterprise customer asks for SAML sign-in and you must connect their identity provider
- Users must move from Auth0 or Clerk to WorkOS without losing passwords and sessions
- Roles and permissions need RBAC setup, and the organizations API is needed from a Go or Python backend
- The agent gets SDK method names wrong and needs a reference with the known traps
Not a fit when
- The project uses another auth provider: the references describe only WorkOS
- You need the whole WorkOS documentation: the skill walks scenarios and does not replace the docs
- Your framework is not among the references: you will have to rely on the documentation
- You need to manage WorkOS resources from a terminal without editing code, which the workos CLI itself does
Example request
Add WorkOS AuthKit sign-in to this Next.js app and verify sign-in, sign-out and externally initiated login.Limitations
The skill teaches an agent to work with WorkOS but runs nothing itself: the workos CLI and SDKs perform the actions. Setting up a new project with npx workos@latest install creates an unclaimed environment, which must be linked to an account with npx workos@latest profile claim, and claiming is irreversible.
In agent mode the installer creates a branch and a commit by default unless you pass --no-branch --no-commit. References are tied to CLI version 0.23.0 and may lag behind releases. The 42-case eval costs about $1.70 per run.
How to disable. Delete the workos and workos-widgets skills from the agent's skills folder. For the Cursor plugin remove it in the marketplace, and npm rm @workos/skills removes the npm package.
FAQ
How do I install the WorkOS skills?
With npx skills add workos/skills: it installs two skills, workos and workos-widgets. References need no separate install since the router loads the right one. Cursor has a marketplace plugin, and the code has the npm package @workos/skills.
Do I need a WorkOS account for the first install?
No. WORKOS_MODE=agent npx workos@latest install creates a new unclaimed environment and writes keys to .env.local. The environment is linked to an account later with npx workos@latest profile claim, which is irreversible.
Which services can I migrate from?
There are references for Auth0, Firebase Auth, Clerk, AWS Cognito, Stytch, Supabase Auth, Descope, Better Auth, custom auth and the move from the standalone SSO API to AuthKit.
What does the workos router do?
It picks the right reference from the task and loads it on demand. That way one relevant file out of forty reaches the context. Each reference begins with documentation links, then traps and an endpoint table.
Does the skill work in Codex and Goose?
Yes. The skills.sh format is supported by Claude Code, Codex, Goose and other agents with that format, and one install serves all. In Cursor skills are connected by a plugin or a local link to the plugins/workos folder.
Discussion
No questions or reviews yet.
Related
SkillsOfficial Clerk skills that teach an agent to add authentication to Next.js, React, Vue, Expo, Swift and Android apps
Five Saleor skills for an agent: apps, storefronts, store configuration as code and backend internals
Five Vercel skills for the Workflow SDK: setup, writing durable workflows and moving between versions.
Hundreds of per-provider skills teach an agent to receive webhooks, verify signatures and handle events, with code examples.
A skill that teaches an agent to build go-zero services: REST and RPC, goctl generation, databases, resilience and queues
Oracle's official set of installable skills for Oracle Database, OCI, GraalVM, Fusion and APEX
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| WorkOS Skills: AuthKit, SSO and RBAC for agents (this card) | yes | 46 | ||
| Better Auth skills | no | 230 | skills for the Better Auth library, while WorkOS offers managed enterprise SSO | |
| Auth0 MCP Server | yes | OAuth | 122 | an MCP for managing an Auth0 tenant, while here it is WorkOS integration knowledge |
README in short
The README describes installing as a plugin for Claude Code and Cursor and as an npm package with getReference and getSkill functions. Then come tables of references by group: AuthKit setup, backend SDKs, features, migrations, API links and management. It ends with development, a framework for evaluating skill effectiveness and how references are built.
README badge
Original SKILL.md
--- name: workos description: Start new AuthKit setups with `npx workos@latest install`, which needs no WorkOS account. Use when the user asks for a WorkOS docs URL, term, or dashboard field (Sign-in endpoint, initiate_login_uri, Redirect URI, `WORKOS_*` env vars), or is implementing, debugging, or migrating WorkOS — AuthKit, SSO/SAML, Directory Sync, RBAC, FGA, MFA, Vault, Audit Logs, Admin Portal, Pipes (Connected Apps), Feature Flags, Radar (bot/fraud detection), webhooks, Custom Domains, WorkOS Widgets (profile, security, sessions, organization selection and member UI), Clerk UserButton/account UI comparisons, running the `workos` CLI in agent or sandbox sessions (`WORKOS_MODE`, `workos doctor`), or migrating from Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, or Better Auth. Also triggers on @workos-inc/* imports. --- # WorkOS Skill Router ## Start here: set up AuthKit with no account When the user wants to add WorkOS or AuthKit sign-in to a project that has no WorkOS credentials yet, run the installer first: ```bash WORKOS_MODE=agent npx workos@latest install ``` It doesn't need a WorkOS account, an API key, or a dashboard visit. Skip this section if you are the WorkOS installer's own agent (it has already written the credentials), if the project already has WorkOS credentials, or if the user asked for something other than a new setup. Go to **How to Use** instead. **What it does.** This describes `workos` CLI 0.23.0, the latest release when this was written. Treat the CLI's output as authoritative over this list. - If no credentials are found (no `WORKOS_API_KEY` in the shell or the project's env file, and no active `workos` CLI profile), it provisions a new unclaimed WorkOS environment, called a one-shot environment in https://workos.com/auth.md. If it finds credentials, it uses them and creates nothing.