WorkOS

Overview

Use WorkOS credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	workos
Category	Developer Tools
Credential Type	Bearer Token

Step 1: Get Credentials

Log in to the WorkOS Dashboard

Log in to the WorkOS Dashboard at dashboard.workos.com.

Go to API Keys

Go to API Keys at dashboard.workos.com/api-keys.

Copy your API Key

Copy the API key (prefixed sk_) for the environment the integration targets — the Staging key is pre-generated and can be viewed any time; a Production key is generated by you and is shown only once, so store it immediately.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add WorkOS

Go to Managed Secrets > Add Provider > WorkOS.

Enter credentials

Paste your API Key into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://api.workos.com/sso/connections",
    grant_id="YOUR_GRANT_ID",
)

Notes

• WorkOS API keys are scoped to their environment (Staging or Production) and can perform any WorkOS API request — keep them server-side. Requests with a wrong key return 401.
• See the WorkOS API authentication reference for details.

sendInvitation projects email, organization_id, expires_in_days, inviter_user_id, role_slug, and locale. Invitations use the singular role_slug; the membership-only role_slugs field is rejected. Existing conditions on role_slugs fail closed and must be reviewed for migration to role_slug. createMagicAuth also projects invitation_token, ip_address, user_agent, radar_auth_attempt_id, and signals_id alongside email.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
sendInvitation	admin, send	POST	/user_management/invitations
createMagicAuth	send	POST	/user_management/magic_auth
listInvitations	read	GET	/user_management/invitations
authenticate	write	POST	/user_management/authenticate
createPasswordReset	write	POST	/user_management/password_reset
createUser	write	POST	/user_management/users
getUser	read	GET	/user_management/users/{id}
listUsers	read	GET	/user_management/users
updateUser	write	PUT	/user_management/users/{id}
deleteUser	delete	DELETE	/user_management/users/{id}
getAuthorizationUrl	read	GET	/user_management/authorize
createOrganizationMembership	admin	POST	/user_management/organization_memberships
listOrganizationMemberships	read	GET	/user_management/organization_memberships
createOrganization	write	POST	/organizations
getOrganization	read	GET	/organizations/{id}
listOrganizations	read	GET	/organizations
updateOrganization	write	PUT	/organizations/{id}
deleteOrganization	delete	DELETE	/organizations/{id}
createOrganizationDomain	admin	POST	/organization_domains
verifyOrganizationDomain	admin	POST	/organization_domains/{id}/verify
createAuditLogEvent	write	POST	/audit_logs/events
createAuditLogExport	write	POST	/audit_logs/exports
createWebhookEndpoint	admin	POST	/webhook_endpoints
listWebhookEndpoints	read	GET	/webhook_endpoints
generatePortalLink	admin	POST	/portal/generate_link
getConnection	read	GET	/connections/{id}
listConnections	read	GET	/connections
listDirectories	read	GET	/directories
listDirectoryGroups	read	GET	/directory_groups
listDirectoryUsers	read	GET	/directory_users
listEvents	read	GET	/events
ssoAuthorize	read	GET	/sso/authorize
ssoProfile	read	GET	/sso/profile
ssoToken	read	POST	/sso/token