@betterportal/auth-workos
v10.1.53
Published
BetterPortal WorkOS auth service for Node.js
Maintainers
Readme
BetterPortal WorkOS Auth Service
WorkOS AuthKit provider for BetterPortal. The service redirects users to WorkOS, exchanges the callback code server-side with the WorkOS Node SDK, issues BetterPortal tokens, and refreshes BP tokens from the WorkOS refresh token.
Per-app service config requires:
clientIdapiKey
Optional config:
providerdefaults toauthkitconnectionId,organizationId,domainHintscopesroleClaimPathdefaults toroles- service config
workosStatePathdefaults to./workos-state.json; set it to a persistent path such as/data/workos-state.jsonin production - service config
syncIntervalSecondsdefaults to21600and retries stale permission/role sync every 6 hours
Registry org: betterportal.
After-login and after-logout destinations are app-owned app.auth.redirects view references configured in Tenants & Apps, not provider addon fields.
Role sync keeps BP as the permission source of truth. WorkOS permission slugs are short service-owned keys, bp_<shortId>_<read|create|update|delete>, with the full tenant/service/view mapping stored in workosStatePath. Roles are mirrored per app from WorkOS role slugs into BP app roles.
