Skip to main content
Send the access token as:
The server verifies signature, issuer, audience, time claims, subject, and organization identity before mapping workspace membership and role. Expired, wrong-audience, or wrong-organization tokens fail closed. Interactive CLI and IDE clients use WorkOS device authorization and refresh their session through secure operating-system credential storage. Automation should use a contracted service identity with least privilege and a short-lived token; never embed an interactive refresh token in CI.
Last modified on July 28, 2026