Agent skill · software engineering · workos
workos
Use when the user asks for a WorkOS docs URL, term, or dashboard field (Sign-in endpoint, initiate_login_uri, Redirect URI, `WORKOS_*` env vars), or is implementing, debugging, or migrating WorkOS — AuthKit, SSO/SAML, Directory Sync, RBAC, FGA, MFA, Vault, Audit Logs, Admin Portal, Pipes (Connected Apps), Feature Flags, Radar (bot/fraud detection), webhooks, Custom Domains, running the `workos` CLI in agent or sandbox sessions (`WORKOS_MODE`, `workos doctor`), or migrating from Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, or Better Auth. Also triggers on @workos-inc/* imports.
Why this skill is useful
Provides specific commands and workflows for integrating and debugging WorkOS features that the AI wouldn't reliably generate on its own.
What it needs
Requires workos installed locally. Requires workos account access. About 10k tokens when loaded. Last updated 2026-08-06. 43 stars on the source repository.
What this skill does
WorkOS Skill Router How to Use This file is a router, NOT the answer. Before responding to the user: 1. Match the request to a reference file using Rule 0 and the decision tree below. 2. You MUST Read the matched reference file with the Read tool before producing any answer, URL, or code. If you have not Read a reference, you have not followed this skill. 3. Follow the instructions inside the reference (it will tell you which live docs to fetch with WebFetch and which gotchas to avoid). Exception: Widget requests use the workos-widgets skill via the Skill tool — it has its own multi-framework orchestration. Guardrails (apply to every response) These apply regardless of which routing rule fires. They exist because the most common failure mode of past WorkOS agent interactions has been plausibly-shaped fabrication of CLI commands and Dashboard paths. Check for the WorkOS MCP server before reaching for the CLI on workspace-management tasks. If the session has WorkOS MCP tools connected (a server exposing whoami, listoperations, query, and mutate — tool names may carry a client-specific prefix), prefer those tools for reading and changing workspace resources: they already run as the signed-in dashboard user, with no CLI install and no API key. The CLI remains the right surface for bootstrap, seeding, local project config, and diagnostics. The full decision guide is the "Choosing a surface" section of references/workos-management.md. Recover a broken WorkOS MCP connection before relying on it — but never treat MCP setup as a prerequisite for CLI work. When the user asks to set up the WorkOS MCP server, or expects MCP tools that turn out to be missing, unauthenticated, or interrupted during startup, read references/workos-mcp.md first: identify the MCP client and requested configuration scope, and do not modify user-global agent configuration without explicit intent. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills workos/workos