WorkOS: MCP vendor profile
WorkOS AuthKit is a spec-compatible OAuth authorization server for MCP servers, built on WorkOS Connect, with CIMD and optional DCR client registration and resource indicators, as documented by the vendor. In WorkOS, Client ID Metadata Document support is off by default and is enabled in the Dashboard under Connect, Configuration (workos.com).
At a glance
| Listed as | WorkOS (AuthKit for MCP) |
|---|---|
| Type | Auth providers |
| Home | workos.com |
| Price | per MAU above 1 million, per connection |
| Read | 5 November 2026 |
What it does for this layer
WorkOS keeps Dynamic Client Registration as an opt-in for backwards compatibility with MCP clients that do not support CIMD yet (workos.com). WorkOS asks the developer to register the MCP endpoint URL as a Resource Indicator, which clients send as the resource parameter; several resource URLs can be added (workos.com). WorkOS pricing lists the first 1 million monthly active users free and 2,500 USD a month for each additional million (workos.com).
WorkOS prices enterprise SSO connections from 125 USD each for 1 to 15 connections down to 65 USD each for 51 to 100 (workos.com). The WorkOS product menu lists MCP Auth next to auth.md, described as "User registration for agents" (workos.com). WorkOS describes AuthKit as "a spec-compatible OAuth authorization server" that sits in front of an MCP server acting as the resource server (workos.com).
AuthKit's MCP support is built on WorkOS Connect, and its metadata at /.well-known/oauth-authorization-server lists authorize, introspection, register and token endpoints (workos.com).
Products and plans
| Product | What it does | Price |
|---|---|---|
| AuthKit (MCP Auth) | OAuth authorization server for MCP servers with CIMD, DCR and resource indicators. | per MAU above 1 million, per connection; from 0 USD; First 1M MAUs free (source, as of 5 November 2026) |
Standards
| Standard | Part of it | Status | What the page says | Source |
|---|---|---|---|---|
| MCP | authorization server metadata | Supports | AuthKit serves /.well-known/oauth-authorization-server. | workos.com |
| MCP | client ID metadata documents | Supports | CIMD can be enabled in the Dashboard; off by default. | workos.com |
| MCP | dynamic client registration | Supports | DCR can be enabled for backwards compatibility. | workos.com |
| MCP | resource parameter | Supports | MCP endpoint URLs are registered as Resource Indicators. | workos.com |
Checks on its own domain
| Check | Domain | Result | Scanned | Method |
|---|---|---|---|---|
| Ora cached score | workos.com | 86 of 100, grade A | 4 November 2026 | how it was taken |
| Cloudflare agent-readiness scan | workos.com | 40 of 100, L1 Basic Web Presence; 6 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- WorkOS does not host the MCP server; the developer verifies AuthKit tokens in their own server.