Skip to main content
Use oauthWorkOSProvider when WorkOS AuthKit is the authorization server. MCP clients register with WorkOS, and mcp-use verifies AuthKit access tokens against the resolved MCP resource.

Configure WorkOS

In the WorkOS Dashboard:
  1. Enable Dynamic Client Registration.
  2. Enable Client ID Metadata Document if your MCP clients use it.
  3. Add the canonical MCP endpoint as a Resource Indicator.
For example, if the deployed origin is https://mcp.example.com and the default base path is /mcp, the resource is https://mcp.example.com/mcp.

Configure the server

Pass the AuthKit subdomain explicitly. The provider does not read WorkOS environment variables and does not accept a separate audience option.

Scope data by organization

WorkOS maps org_id to organizationId and the subject to id.
The mapped user also includes optional email, emailVerified, name, preferredUsername, firstName, lastName, picture, and sessionId, plus roles. Verified WorkOS permissions are top-level ctx.auth.permissions.

Runnable WorkOS example

Compare with the maintained WorkOS example.

WorkOS AuthKit MCP guide

Configure AuthKit for MCP.

User Context

Use WorkOS identity, organization, and permissions.