8.0.0 ⚠ BREAKING CHANGES
authorization: Consolidate order enums to PaginationOrder
api_keys: Separate organization and user API key types
user_management: Consolidate order enums to PaginationOrder
vault: Add BYOK key deleted event and consolidate key provider enum
types: Consolidate pagination order enums
authorization: Rename RoleAssignment to UserRoleAssignment Features
api_keys: Separate organization and user API key types (956386a authorization: Add new role assignment listing endpoints (956386a authorization: Consolidate order enums to PaginationOrder (956386a authorization: Rename RoleAssignment to UserRoleAssignment (956386a directory_sync: Add name field to directory users (956386a docs: publish YARD API docs + llms.txt to GitHub Pages (#480 117eeac events: Add admin_portal source to event context actor (956386a sso: Add name field to SSO profile (956386a types: Consolidate pagination order enums (956386a user_management: Add get JWT template endpoint (956386a user_management: Add user API key management (956386a user_management: Add user field to membership and organization membership (956386a user_management: Consolidate order enums to PaginationOrder (956386a vault: Add BYOK key deleted event and consolidate key provider enum (956386a 7.1.2 Bug Fixes
decode legacy v6 sealed sessions on unseal (#479 1d8b4aa replace parameter-group hashes with typed variant classes (#473 a66c15b set canonical User-Agent header format (#476 6728358 7.1.0 Features
generated: update generated SDK from spec changes (#465 6c145d2 Bug Fixes
add ruby/setup-ruby to release-please workflow (aa5ebd0 eagerly load configuration.rb to fix WorkOS.configure (#467 eea391c remove stale URN-prefixed alias files breaking Zeitwerk (#466 92b2aa5 update Gemfile.lock in release-please PR and bump action pins (2aa0574 update Zeitwerk autoload for inflections.rb (#460 4fa1332 This is a major release that introduces a fully redesigned SDK architecture. The SDK is now generated from the WorkOS OpenAPI spec , bringing type safety, consistent interfaces, and improved developer ergonomics.
High-Level Changes
Client-centric architecture : The SDK now revolves around an instantiated WorkOS::Client rather than module-level service calls. All product areas are accessed through client methods (e.g., client.organizations, client.user_management, client.sso).
Generated request/response models : Typed models replace raw hashes. Response models no longer inherit from Hash — use accessor methods instead of bracket notation.
Per-request overrides : The new runtime supports request_options: for per-request API key, timeout, base URL, and retry overrides — useful for multi-tenant setups.
Minimum Ruby 3.3+ : The minimum Ruby version has been raised to 3.3.
Renamed services and methods : Several top-level services were renamed (e.g., WorkOS::Portal → client.admin_portal, WorkOS::MFA → client.multi_factor_auth). Method signatures now use explicit keyword arguments.
Session management refactor : AuthKit session sealing, refresh, and authentication flows were overhauled with a dedicated SessionManager on the client instance.
New capabilities : Device code flow, public/PKCE clients, auto_paging_each pagination, and last_response observability on all responses.
Migration Guide
For detailed instructions on updating your application, see the v7 Migration Guide
6.2.0 Features
user-management: add directory_managed to OrganizationMembership (#446 914d824 user-management: add invitation accept endpoint (#448 b5b4da1 Bug Fixes
See CHANGELOG.md for details
What's Changed
Add release-please for automated releases by @workos-sdk-automation[bot] in #435 fix: add invitation_token parameter to authentication methods by @gjtorikian in #438 Update amannn/action-semantic-pull-request action to v6 by @renovate[bot] in #436 chore(main): release workos 6.1.0 by @workos-sdk-automation[bot] in #437 fix: use simple v-prefixed tags and fix gem publish path by @workos-sdk-automation[bot] in #441 fix: revert VERSION extraction to handle simple v-prefixed tags by @workos-sdk-automation[bot] in #442 Full Changelog : v6.0.0...v6.1.0
What's Changed
Add Rakefile to fix release workflow by @workos-sdk-automation[bot] in #426 Use gem-push-command to skip git push in release workflow by @workos-sdk-automation[bot] in #427 Fix release workflow to use OIDC credentials directly by @workos-sdk-automation[bot] in #429 Update actions/create-github-app-token action to v2 by @renovate[bot] in #422 Update peter-evans/create-pull-request action to v8 by @renovate[bot] in #424 Add ability to extract custom claims from the JWT during authentication by @adam-h in #431 Upgrade jwt gem from ~> 2.8 to ~> 3.1 by @workos-sdk-automation[bot] in #433 Allow pluggable encryptors for session seal/unseal by @gjtorikian in #432 v6.0.0 by @workos-sdk-automation[bot] in #434 Full Changelog : v5.31.1...v6.0.0
What's Changed
Add custom_attributes field to OrganizationMembership by @ajworkos in #419 v5.31.1 by @workos-sdk-automation[bot] in #420 Update actions/checkout action to v6 by @renovate[bot] in #421 Add rake as a development dependency by @gjtorikian in #423 New Contributors
@ajworkos made their first contribution in #419 Full Changelog : v5.31.0...v5.31.1
What's Changed
Add context7.json to repo by @nicknisi in #413 Update ruby/setup-ruby action to v1.281.0 by @renovate[bot] in #358 Update actions/checkout action to v6 by @renovate[bot] in #409 Update CODEOWNERS to point to the right Rubyist Team by @gjtorikian in #416 Bump rexml from 3.4.1 to 3.4.2 by @dependabot[bot] in #395 Add list sessions to user management by @adam-h in #415 💎 5.31.0 by @gjtorikian in #418 New Contributors
@gjtorikian made their first contribution in #416 Full Changelog : v5.30.1...v5.31.0
What's Changed
Version bump v5.30.1 by @kendallstrautman in #412 Multiple roles support: Add roles to SSO profile and directory user by @kendallstrautman in #411 Full Changelog : v5.29.0...v5.30.1
⚠️ Misconfigured release version. Use v5.30.1 instead
In this version, the package semver was not updated properly and still references v5.29.0
What's Changed
Multiple roles support: Add roles to SSO profile and directory user by @kendallstrautman in #411 Full Changelog : v5.29.0...v5.30.0
What's Changed
expose authentication object even if expired by @ollym in #398 New Contributors
@ollym made their first contribution in #398 Full Changelog : v5.28.0...v5.29.0
What's Changed
Add ability to resend invitations by @antn in #404 Fix reset_password to handle wrapped API response by @nicknisi in #406 New Contributors
@antn made their first contribution in #404 Full Changelog : v5.27.0...v5.28.0
What's Changed
Add SSO and Domain Verification widget scopes by @adam-h in #396 AuthKit multiple roles support by @csrbarber in #397 Bump to 5.26.0 by @csrbarber in #399 New Contributors
@csrbarber made their first contribution in #397 Full Changelog : v5.25.0...v5.26.0
What's Changed
Add GET /organizations/:orgId/feature-flags support by @stanleyphu in #391 v5.25.0 by @stanleyphu in #393 New Contributors
@stanleyphu made their first contribution in #391 Full Changelog : v5.24.0...v5.25.0
What's Changed
Add screen_hint to Ruby Gem + vcr 6 by @Teyler7 in #389 v5.24.0 by @nholden in #390 Full Changelog : v5.23.0...v5.24.0
What's Changed
Include decoded Feature Flags from the JWT into the payload of a WorkOS Session by @vdyalex in #386 Fix request body construction to only send non-nil values by @nicknisi in #384 Fix SSO error handling to surface detailed validation errors by @nicknisi in #385 New Contributors
@vdyalex made their first contribution in #386 Full Changelog : v5.21.0...v5.22.0
What's Changed
user: allow updating external_id, add to User object by @mxlje in #378 Add permissions to Role by @andrewhampton in #382 New Contributors
@mxlje made their first contribution in #378 @andrewhampton made their first contribution in #382 Full Changelog : v5.20.0...v5.21.0
What's Changed
add missing session param to authenticate_with methods by @jameslcarpino in #375 New Contributors
@jameslcarpino made their first contribution in #375 Full Changelog : v5.18.0...v5.19.0
What's Changed
Bump rexml from 3.2.6 to 3.4.1 by @alexandrule in #359 v5.17.1 by @nicknisi in #364 New Contributors
@alexandrule made their first contribution in #359 Full Changelog : v5.17.0...v5.17.1
What's Changed
Pin third-party actions to currently used SHA by @nickcollisson-workos in #357 Bump rexml from 3.2.6 to 3.3.3 by @dependabot in #318 v5.16.1 by @nicknisi in #362 New Contributors
@nickcollisson-workos made their first contribution in #357 Full Changelog : v5.16.0...v5.16.1
What's Changed
Add domain verification intent in admin portal link generation by @sahilbansal17 in #351 v5.14.0 by @nicknisi in #353 New Contributors
@sahilbansal17 made their first contribution in #351 Full Changelog : v5.13.0...v5.14.0