WorkOS account recovery
Connect WorkOS (AuthKit / User Management) to Nametag for self-service password and MFA reset.
Connect WorkOS to Nametag to let your AuthKit / User Management users securely reset their own passwords and multifactor authentication (MFA) after verifying their identity with a government ID and a live selfie — no help-desk ticket and no un-proofed reset. The steps below cover connecting the directory. For the rest of the setup — self-service permissions, the self-service site, and monitoring — see the self-service account recovery administrator’s guide.
The first thing you’ll need to do is configure self-service permissions.
You’ll also need to gather three pieces of information from WorkOS:
- Client ID (
client_...) - API key (
sk_...) - The environment the key is scoped to (Production, Staging, or Sandbox)
To gather this information:
-
Sign in to your WorkOS Dashboard and select the environment you want to protect. WorkOS API keys are scoped to a single environment, so a Sandbox key will not manage Production users.
-
Go to API Keys and create a new Secret Key scoped to User Management. Copy the key (
sk_...).Note: Nametag uses this key only to look up users and perform the resets you permit — it never writes any personal data back into WorkOS.
-
Copy your Client ID (
client_...) from the same page. -
Paste the Client ID, API key, and environment into Nametag and save. Nametag tests the connection by calling the WorkOS User Management API.
You are entering your WorkOS credential, which Nametag stores encrypted. You never enter a Nametag key here.
What Nametag does on recovery
Once connected, and after a locked-out user proves their identity on the recovery site, Nametag calls WorkOS to:
- Reset password — triggers WorkOS’s password-reset email so the user sets a new password.
- Reset MFA — deletes every enrolled authentication factor so the user re-enrolls on next sign-in.
- Force re-authentication — revokes active sessions after an MFA reset.
Nametag holds the verified identity; WorkOS receives only the reset actions. No personal data is written into WorkOS user fields or metadata.