# WorkOS MCP

Vendor: WorkOS  
Category: other  
Auth: API_KEY  
Composio slug: `workos`

WorkOS provides enterprise identity and user management APIs for organizations, directory sync, connections, invitations, and users.

## Verdict

WorkOS manages enterprise authentication, directory sync, and user provisioning from inside Switchy. @mention it to create organizations, grant memberships, provision passwordless users, or inspect SSO connections without leaving your workspace. Teams using WorkOS for AuthKit or Directory Sync get the most value — you can script onboarding flows, audit access, or troubleshoot connection issues in plain English. Note that this MCP requires an API key with appropriate scopes; destructive operations like deleting users or organizations are permanent and cannot be undone.

## Tools

- **Create Organization** — Create a WorkOS organization in the connected environment.
- **Create Organization Membership** — Grant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated.
- **Create User** — Create a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords.
- **Delete Organization** — Permanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID.
- **Delete Organization Membership** — Permanently remove an organization membership and its access. Prefer deactivation when access may need to be restored.
- **Delete User** — Permanently delete an AuthKit user. This cannot be undone and may remove the user's access.
- **Get Connection** — Get one WorkOS connection by ID.
- **Get Directory** — Get one WorkOS Directory Sync directory by ID.
- **Get Directory Group** — Get one WorkOS Directory Sync group by its exact group ID.
- **Get Directory User** — Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by this directory user ID.
- **Get Invitation** — Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.
- **Get Organization** — Get one WorkOS organization by its WorkOS ID or external ID.
- **Get Organization Membership** — Get one WorkOS AuthKit organization membership by ID.
- **Get User** — Get one WorkOS AuthKit user by WorkOS ID or external ID.
- **List Connections** — List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name.
- **List Directories** — List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.
- **List Directory Groups** — List one page of WorkOS Directory Sync groups for a directory, a directory user, or both.
- **List Directory Users** — List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per second per directory; on HTTP 429, honor R
- **List Invitations** — List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.
- **List Organization Memberships** — List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.
- **List Organizations** — List one page of WorkOS organizations, optionally filtered by domain or organization name.
- **List Users** — List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address.
- **Resend Invitation** — Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token and acceptance URL.
- **Revoke Invitation** — Revoke a pending AuthKit invitation so it can no longer be accepted.
- **Send Invitation** — Create an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intentional. The output omits the sensitive ac
- **Set Organization Membership Status** — Activate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active.
- **Update Organization** — Update selected properties of an existing WorkOS organization.
- **Update Organization Membership Roles** — Replace the role assignment on an existing WorkOS organization membership.
- **Update User** — Update selected profile fields on an AuthKit user without invoking email delivery flows.

## Setup

1. Create or open a Switchy Project.
2. Open Integrations and connect WorkOS.
3. Authorise through api_key.
4. Teammates can now @-mention WorkOS tools in chat.

---
Last verified: 2026-10-17T02:00:10.360Z  
Canonical URL: https://switchy.build/directory/mcps/workos