WorkOS account recovery

Connect WorkOS to Nametag to let your AuthKit / User Management users securely reset their own passwords after verifying their identity with a government ID and a live selfie — no help-desk ticket and no un-proofed reset. The steps below cover connecting the directory. For the rest of the setup — self-service permissions, the self-service site, and monitoring — see the self-service account recovery administrator’s guide.

The first thing you’ll need to do is configure self-service permissions.

You’ll also need to gather three pieces of information from WorkOS:

1. Client ID (client_...)
2. API key (sk_...)
3. The environment the key is scoped to (Production, Staging, or Sandbox)

To gather this information:

• Sign in to your WorkOS Dashboard and select the environment you want to protect. WorkOS API keys are scoped to a single environment, so a Sandbox key will not manage Production users.

• Go to API Keys and create a new Secret Key scoped to User Management. Copy the key (sk_...).

  Note: Nametag uses this key only to look up users and perform the resets you permit — it never writes any personal data back into WorkOS.

• Copy your Client ID (client_...) from the same page.

• Paste the Client ID, API key, and environment into Nametag and save. Nametag tests the connection by calling the WorkOS User Management API.

You are entering your WorkOS credential, which Nametag stores encrypted. You never enter a Nametag key here.

What Nametag does on recovery

Once connected, and after a locked-out user proves their identity on the recovery site, Nametag can offer any of the following. Which ones your users see depends on the recovery operations you enable for the directory.

• Password reset link — Nametag asks WorkOS for a one-time password-reset link and shows it to the verified user, who chooses their own new password. Nametag never sees the password.
• Temporary password — Nametag sets a strong, randomly generated password on the account and shows it to the verified user once, for them to change after signing in.
• Temporary access pass — Nametag asks WorkOS for a one-time Magic Auth code and shows it to the verified user. The code expires after 10 minutes.

MFA reset is not available for WorkOS. WorkOS’s User Management API does not expose a way to remove an enrolled authentication factor, so a WorkOS directory offers password recovery only. If a user needs an MFA factor cleared, a WorkOS administrator has to do it in the WorkOS Dashboard.

Nametag holds the verified identity; WorkOS receives only the reset actions. No personal data is written into WorkOS user fields or metadata.