WorkOS through Squiid

What WorkOS is

WorkOS sells the enterprise checklist as an API. Single Sign-On abstracts SAML and OIDC across identity providers so you integrate once rather than per customer, Directory Sync consumes SCIM so users provisioned or removed in a customer's directory appear and disappear in your app, Audit Logs produce the exportable trail security reviews ask for, and the Admin Portal gives the customer's IT team a self-serve page to configure it without your engineers on a call. AuthKit covers ordinary user login for everyone else. AuthKit also covers email, social and passkey login, so a product can start there and add enterprise connections when the first large customer arrives.

For an AI-coded B2B product this is the difference between closing a large deal and spending two months building identity plumbing. The requirements usually arrive at once, late in a sales process, and they are not the kind of thing an agent can improvise: SCIM in particular is a specification with a lot of edge cases per identity provider. Audit logs are the quieter requirement, because a buyer's security team usually asks for an exportable record of who did what.

Why connect it through Squiid

WorkOS is on the Squiid roadmap. When it is connected, Squiid will provision the environment, hold the API key and client secret, and route calls through https://api.squiid.io/v1/workos/... with Authorization: Bearer $SQUIID_API_KEY, with SDKs working by base URL swap (gateway convention). Connection and usage charges will bill at WorkOS's listed price on one Squiid invoice, so an enterprise feature arrives without a separate vendor contract to negotiate first. Connections are configured per customer through the portal rather than in code, which keeps the integration stable as customers are added.

• One account, one key, one bill, one dashboard. WorkOS sits beside every other service your project uses, on the same invoice and the same credit balance.
• Key custody. Squiid holds the WorkOS credentials. Your code carries SQUIID_API_KEY, so WORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_REDIRECT_URI never land in a repository, a preview deployment or an agent’s context.
• Metering you can see. Every call is counted per service and per day, so you know what WorkOS costs before the month ends.
• Pause on zero. When prepaid credits run out the gateway stops authorizing usage instead of running up a bill you did not fund.
• One rotation. Rotating the Squiid key cuts off every agent, worker and deployment at once, with no provider key to hunt down.

What you get

• A provisioned WorkOS environment with keys held by Squiid
• SAML and OIDC SSO through one integration
• SCIM directory sync for user provisioning
• Audit logs and an admin portal for customers
• WorkOS list pricing, no markup

How to connect WorkOS

One variable replaces the provider credentials this service would normally need. Requests go to the gateway and the official SDKs work by pointing their base URL at it (gateway convention).

# .env
# replaces WORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_REDIRECT_URI
SQUIID_API_KEY=sq_live_xxxxxxxxxxxxxxxxxxxxxxxx

# every request: https://api.squiid.io/v1/workos/...
# header:       Authorization: Bearer $SQUIID_API_KEY

Pricing through Squiid

WorkOS charges per enterprise connection per month plus usage for other features, at the provider's listed price. Squiid passes that through at par: one dollar of prepaid credit is one dollar of WorkOS usage, with no markup and no per-request margin.

WorkOS has no subscription attached on Squiid today. If a plan is required for a feature you need, it passes through at the provider’s listed price with no Squiid fee.

Squiid adds no markup to provider prices. There is a free plan at $0 a month with a 15% fee when you top up credits, Solo at $19.97 a month with a top-up fee that starts at 8% and falls to 3.5% as your spend grows, Team from $29.97 a seat a month with the same ladder one point lower, and Custom with a rate of 3% or less. Credits are prepaid, so WorkOS usage stops when the balance reaches zero rather than producing an invoice you did not fund. Auto top-up with a cap keeps production running without handing anyone an open-ended card.

If you leave

Export: users are exported from WorkOS, with password hashes where WorkOS supports it, and imported into an instance in your own account. Squiid never owns your code, your schema or your domain, and the gateway speaks WorkOS's own API, so the client change is a base URL. The handover page lists what happens for every provider in the catalogue.

Works with every coding agent

WorkOS through Squiid is just an HTTP call with a bearer token, so every agentic coding tool can use it with the single key already in your environment:

• Claude Code
• Cursor
• ChatGPT
• Codex
• Grok
• Gemini CLI
• GitHub Copilot
• Windsurf
• Perplexity
• Devin
• Replit
• v0
• Lovable
• Cline

Vibe coding a feature on WorkOS usually means asking for it in plain language and letting the agent write the integration. Because the key is Squiid’s rather than the provider’s, it can do that without ever holding a credential that could be leaked, logged or committed.