---
title: "WorkOS Connector | Tajo"
description: "Implementation notes for building and operating the WorkOS connector in Tajo."
url: https://tajo.io/docs/connectors/workos/
markdown: https://tajo.io/docs/connectors/workos.md
lang: en-US
author: "Set Noa"
author_url: https://tajo.io/set-noa/
robots: noindex
---

# WorkOS Connector

[Set Noa](https://tajo.io/set-noa/)

Connector status: In progress Being built. Not verified yet.

| Source field | Destination field | Sample value |
| --- | --- | --- |
| `record.id` | `source_id` | `record_1042` |
| `record.updated_at` | `updated_at` | `2026-10-18T08:00:00Z` |
| `record.value` | `value` | `sample_value` |

Connector implementation

## Build the WorkOS integration

Authentication, organizations and Directory Sync for B2B apps (AuthKit, User Management, SSO, SCIM)

Identity & SSO

*WorkOS connector flow from source system to Tajo mapping and Brevo activation.*

## Implementation Overview

**Build target**

Implement a WorkOS connector that authenticates to the vendor surface, normalizes source records in Tajo, and activates eligible data in Brevo.

**Current status**

Treat this as an implementation guide. Build and validate the auth, mapping, sync, and operations paths before production use.

**Primary surface**

github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml

| Property | Value |
| --- | --- |
| Integration surface | OpenAPI |
| Status | In progress |
| Category | Identity & SSO |
| Setup complexity | medium |
| Vendor documentation | [workos.com/docs/reference](https://workos.com/docs/reference) |
| Allowed host | Not recorded |
| Base URL | Not recorded |
| OpenAPI schema | [github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml](https://github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml) |
| MCP server | Not recorded |
| Last researched | 2026-10-30 |

Official OpenAPI 3.1.1 document (MIT); eight operations vendored. Bearer API key (sk\_test\_ for staging, sk\_live\_ for production; the body is the base64 of key\_…). Lists page by after in creation order; no updated-since filter, so deltas read the Events API (90 days kept, 30 days a request). AuthKit is free up to 1 million monthly active users, with a staging environment.

## Authentication

- Use [github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml](https://github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml) to generate or validate typed API clients and request models.
- Keep [workos.com/docs/reference](https://workos.com/docs/reference) linked from the connector runbook so operators can confirm vendor behavior during incidents.
- Store credentials per Tajo workspace and keep tenant-specific secrets out of connector configuration files.
- Add a credential smoke test that verifies read access to a harmless resource before running backfills or enabling webhooks.

## Data To Sync

Start with these inferred data domains, then confirm exact vendor resources and permissions from the source documentation:

- Contact and identity records

The connector should make source records idempotent by keeping a stable key such as a vendor object ID, email address, event ID, ticket ID, order ID, or campaign ID. If the vendor only exposes list APIs, Tajo should store the cursor strategy and replay policy explicitly.

## Sync Shape

| Resource | Direction | Conflict handling |
| --- | --- | --- |
| `users` | bidirectional | source\_wins, loop guard none |
| `user_changes` | inbound | n/a |
| `organizations` | inbound | n/a |
| `organization_changes` | inbound | n/a |
| `organization_memberships` | inbound | n/a |
| `membership_changes` | inbound | n/a |
| `directories` | inbound | n/a |
| `directory_users` | inbound | n/a |
| `directory_user_changes` | inbound | n/a |
| `directory_groups` | inbound | n/a |

WorkOS is the record of its users; the one write back (update\_user) sets names and metadata keys the buyer names, which no read here turns into a write again.

## Mapping To Tajo/Brevo

#### `users` → Brevo contact

Requires: **custom attribute creation**.

| Source field | Brevo destination | Via | Note |
| --- | --- | --- | --- |
| `tajo_email_marketing_consent` | `filter` | — | the canonical consent pair: consent is always false (WorkOS records no marketing consent), so no user passes on WorkOS’s record alone |

Read for context and not projected: `user_changes`, `organizations`, `organization_changes`, `organization_memberships`, `membership_changes`, `directories`, `directory_users`, `directory_user_changes`, `directory_groups`.

The conventions that apply to every connector — stable external IDs, normalization, backfill and sync strategy, error handling, and the builder checklist — are documented once under “Applies to every connector” on the [connector catalog](https://tajo.io/docs/connectors).

## Sources

- [Vendor documentation](https://workos.com/docs/reference)
- [OpenAPI or schema source](https://github.com/workos/openapi-spec/blob/main/spec/open-api-spec.yaml)
- [github.com/workos/openapi-spec](https://github.com/workos/openapi-spec)
- [workos.com/docs/events/data-syncing/events-api](https://workos.com/docs/events/data-syncing/events-api)
- [workos.com/docs/reference/rate-limits](https://workos.com/docs/reference/rate-limits)
- [workos.com/pricing](https://workos.com/pricing)