Case Study: WorkOS AuthKit achieves secure MCP app authorization with WorkOS

WorkOS AuthKit launches an MCP app on the 2026-07-28 spec in 2026 with WorkOS

The customer, WorkOS AuthKit, needed to build a secure, interactive MCP application according to the new finalized 2026-07-28 specification. Their challenge was implementing robust, per-tool authorization and a stateless deployment model, moving beyond the simple authentication or hardcoded tokens common in earlier examples.

WorkOS provided the solution through its AuthKit product, which served as the authorization server. This enabled the customer to enforce permissions for specific tools, ensuring only authorized users could perform sensitive actions like expense approval. The result was a securely gated application that could be deployed in a truly stateless manner behind a standard load balancer, fulfilling the requirements of the new MCP spec.

WorkOS AuthKit