sourcey
Submit

agents:SKILL.mdmcp.jsonopenapi.yml

← WorkOS

Can an agent create a user with WorkOS AuthKit?

The agent needs you to sign it up or register a client and provide a key or token. You also handle changes to its access. Interface found; job not yet run.

observedProbed revision sha256:80c8b3549c26…

Who does each step

how grades work →

Whether the agent handles it alone or a person has to step in.

  1. 01

    Discover

    Machine

    The vendor's machine-readable docs show the agent where and how to call this job.

  2. 02

    Access

    Workaround · setup

    You give the agent a key or token.

  3. 03

    Onboard

    Workaround · setup

    You sign up or register a client for the agent.

  4. 04

    Pay

    Not applicable

    Nothing to pay for the job.

  5. 05

    Confirm

    Machine

    The response or specification defines errors the agent can distinguish from success.

  6. 06

    Sustain

    Workaround · setup

    You replace or revoke the agent's access when it needs to change.

Access: handing over a key or token.

Onboard: signing up or registering a client for the agent.

Sustain: renewing, replacing or revoking its access.

To remove these handoffs: support OAuth client registration so the agent can register its own client and ask for consent; provide an agent registration route, such as auth.md, a sign-up API or OAuth client registration; provide key management or OAuth refresh and revocation so the agent can maintain its own access.

Agent surfaces

3 kinds · 9 entries
For agents
api.workos.com3 more
mcp.workos.comworkos.com/auth.mdworkos.com/docs/llms.txt
Names the job's endpoint
API
api.workos.com2 more
auth.workos.comapi.workos-test.com
Names the job's endpoint
OAuth
signin.workos.com1 more
mcp.workos.com/mcp
authorization server · protected resource

The probe

13 Oct 2026 · 08:17 UTC · 67.12 s

Each request it sent and what came back; the descriptors it read, counted, with what they named.

Discover48 descriptor reads13 facts
Found
OAuthsignin.workos.comFor agentsworkos.com/auth.mdFor agentsworkos.com/docs/llms.txtAPIapi.workos.comAPIapi.workos-test.comAPIauth.workos.comOAuthmcp.workos.com/mcpOAuthsignin.workos.comOAuthsignin.workos.comOAuthmcp.workos.com/mcpOAuthsignin.workos.comAPIapi.workos.comFor agentsmcp.workos.com
From
signin.workos.com/.well-known/oauth-authorization-server · workos.com/auth.md · workos.com/docs/llms.txt · workos.com/openapi.json · mcp.workos.com/.well-known/oauth-protected-resource/mcp · mcp.workos.com/.well-known/oauth-authorization-server · mcp.workos.com/.well-known/oauth-protected-resource · workos.com/docs/mcp
This endpoint
api.workos.com is named by a descriptor it read
Job requestPOST api.workos.com/user_management/users40162 ms
Request
POST https://api.workos.com/user_management/users
Response
401 · application/json · 26 bytes
Body
sha256:3e7db788e384631f8a9f299d1797e6f8af6d16d643a1c91f9e83ae15212de45c
Exchange
sha256:f12db67789f5d9a793b4119fa87567673e250acba4fd47c3bf299db37550b6e1
Resource metadataGET api.workos.com/.well-known/oauth-protected-resource/user_management/users40453 ms
Request
GET https://api.workos.com/.well-known/oauth-protected-resource/user_management/users
Response
404 · application/json · 70 bytes
Body
sha256:52e09b263706b6d19c2f7246b7c84c343404eeea34bf6dd8998266cbaf2b9905
Exchange
sha256:8a2fcd9a0efb59ec45054cc7a1ebbc7ef128876522f7ae5d3b7034a9753444dd
Resource metadataGET api.workos.com/.well-known/oauth-protected-resource40448 ms
Request
GET https://api.workos.com/.well-known/oauth-protected-resource
Response
404 · application/json · 70 bytes
Body
sha256:52e09b263706b6d19c2f7246b7c84c343404eeea34bf6dd8998266cbaf2b9905
Exchange
sha256:fcdec68bc0a47b0f4125fb38936c43a323c06b78a1c9899c55ede2c1a8a1569a
Job requestsession openedPOST mcp.workos.com/mcp40129 ms
Request
POST https://mcp.workos.com/mcp
Response
401 · application/json · 67 bytes
Body
sha256:66ab62a2b657ff3e9ae1e5466a0ce315fb8b22dfe3f3b7cf15bdf625ae2aef76
Exchange
sha256:46641f340ef3cdfd3f2ffaf4509d8ee8f8a8c17ea69d74488190a76101c8756c
Resource metadataGET mcp.workos.com/.well-known/oauth-protected-resource/mcp20030 ms
Request
GET https://mcp.workos.com/.well-known/oauth-protected-resource/mcp
Response
200 · application/json · 155 bytes
Body
sha256:0bd9eb22ef63cb7b3af25c4d2ba0cda1e3da2196aeae493d21c423ae19649ae2
Exchange
sha256:2467c2560510ab83bcdb40750cbd224091d4cb678d4f31dd062004f38ae48d80
Authorization serverGET signin.workos.com/.well-known/oauth-authorization-server20081 ms
Request
GET https://signin.workos.com/.well-known/oauth-authorization-server
Response
200 · application/json · 1330 bytes
Body
sha256:6d078d62223662da77ed2e6117eb1e3eaf831d9286a207e592c8f66902dfc0e8
Exchange
sha256:887d30dd4ebe76206a5733a503ead8dcc4daad522b869f967083697add14cafb
Declared pageGET workos.com/signup30225 ms
Request
GET https://workos.com/signup
Response
302 · application/octet-stream · 0 bytes
Body
sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Exchange
sha256:0df4940fb3acec0cb53a1d66c8241a3d6657c7b2995d6363adc6c85aad2bd2c6

WorkOS on the startup-offers board

catalog record →

The grade’s badge

One image that keeps itself current, linking here.

Live badge for WorkOS AuthKit, agent grade: B+[![agent grade](https://sourcey.com/badges/agent-readiness/arp_01m4t5af1k3qwqdkf3te0txp21.svg)](https://sourcey.com/c/workos/agent-readiness/workos-authkit/user-create)

Improve the report

Correct it, probe it again, or improve the path.

Report outdated evidenceRequest reassessmentClaim this record
Profile
arp_01m4t5af1k3qwqdkf3te0txp21
Projection
sha256:63e68ebce0ed11748b4475315a55e85bfa6d78948f55eead9b96e765deadab9f
Policy
kind-2026-10-12.2 · sha256:b612172aad277b54461de84e006815126f2df566563954b02f4432a39cad89ac

A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration