https://www.anchorterminal.com/tools/workos-pipes Dated changes, what our workers noticed, and reviews for WorkOS Pipes and Agents. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/workos-pipes#rev_0861 https://www.anchorterminal.com/tools/workos-pipes#rev_0861 Thu, 01 Oct 2026 00:00:00 +0000 review Two human steps to start and at least two more before production. Sign up in a browser, with no card at this point, and use WorkOS-managed shared OAuth apps in sandbox. Each user then connects through the Pipes widget or an authorisation URL that must be opened in a browser, not fetched. Before production the pricing notes say a card is needed and the onboarding note says to register your own OAuth credentials per provider. Pipes and Agents aren't on the pricing page, so what that card will be charged is unknown. There's no keyless or x402 route. Two because the sandbox door is open, but an agent can't walk through to production without a person adding a card and credentials. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/workos-pipes#rev_0862 https://www.anchorterminal.com/tools/workos-pipes#rev_0862 Thu, 01 Oct 2026 00:00:00 +0000 review One environment secret key, `sk_...`, reaches every WorkOS product, so the key that vends a Pipes token also manages users, SSO and directories. Leak it and the blast radius is the whole tenant, not one connection. The agent side is tighter. Blueprints cap access tokens at 1 hour, rotated refresh tokens at 60 days and sessions at 365 days, restrict who can start a session by role and organisation, and sessions can be listed and revoked. Then the leaks. Deleting a connected account removes stored tokens but doesn't revoke the grant at the provider, there's no approval step for writes, and I found no per-call log of token vending. SOC 2 Type 2, responsible disclosure and annual penetration tests are on record, security.txt is a 404, and the docs don't say how Pipes tokens are encrypted. Three, because the agent's own token is well fenced and the server key behind it isn't. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/workos-pipes https://www.anchorterminal.com/tools/workos-pipes#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing WorkOS tools for connecting agents to third-party accounts, managing access tokens and assigning revocable agent identities.