oauthWorkOSProvider when WorkOS AuthKit is the authorization server. MCP clients register with WorkOS, and mcp-use verifies AuthKit access tokens against the resolved MCP resource.
Configure WorkOS
In the WorkOS Dashboard:- Enable Dynamic Client Registration.
- Enable Client ID Metadata Document if your MCP clients use it.
- Add the canonical MCP endpoint as a Resource Indicator.
https://mcp.example.com and the default base path is /mcp, the resource is https://mcp.example.com/mcp.
Configure the server
Pass the AuthKit subdomain explicitly. The provider does not read WorkOS environment variables and does not accept a separateaudience option.
Scope data by organization
WorkOS mapsorg_id to organizationId and the subject to id.
email, emailVerified, name, preferredUsername, firstName, lastName, picture, and sessionId, plus roles. Verified WorkOS permissions are top-level ctx.auth.permissions.
Runnable WorkOS example
Compare with the maintained WorkOS example.
WorkOS AuthKit MCP guide
Configure AuthKit for MCP.
User Context
Use WorkOS identity, organization, and permissions.