WorkOS Python Library

https://github.com/workos/workos-python
Admin
Python client library for accessing the WorkOS API with support for SSO, user management, directory...
Tokens:42,279
Snippets:460
Trust Score:9.9
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### v5 Client Construction

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of client construction in v5.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_test_123", client_id="client_123")
```

--------------------------------

### v6 SyncPage example

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of iterating over a `SyncPage` object in v6.

```python
page = client.organizations.list_organizations()

for organization in page:
    print(organization.id)

assert page.before is None or isinstance(page.before, str)
assert page.after is None or isinstance(page.after, str)
```

--------------------------------

### v6 Client Construction

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Examples of client construction in v6, showing different configurations.

```python
from workos import WorkOSClient

server_client = WorkOSClient(api_key="sk_test_123")
public_client = WorkOSClient(client_id="client_123")
hybrid_client = WorkOSClient(api_key="sk_test_123", client_id="client_123")
```

--------------------------------

### v6 AsyncPage example

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of iterating over an `AsyncPage` object in v6.

```python
page = await async_client.organizations.list_organizations()

items = [organization async for organization in page]
```

--------------------------------

### v5 authenticate_with_code example

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of using `session=` with `authenticate_with_code` in v5.

```python
response = client.user_management.authenticate_with_code(
    code=code,
    session={"seal_session": True, "cookie_password": COOKIE_PASSWORD},
)
sealed = response.sealed_session
```

--------------------------------

### v6 authenticate_with_code example

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of using `authenticate_with_code` in v6, with manual session sealing.

```python
from workos.session import seal_session_from_auth_response

response = client.user_management.authenticate_with_code(code=code)

sealed = seal_session_from_auth_response(
    access_token=response.access_token,
    refresh_token=response.refresh_token,
    user=response.user.to_dict(),
    impersonator=(
        response.impersonator.to_dict()
        if response.impersonator
        else None
    ),
    cookie_password=COOKIE_PASSWORD,
)
```

--------------------------------

### Create Organization Examples

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ORGANIZATIONS.md

Demonstrates creating organizations with various configurations including metadata and external IDs.

```python
# Create basic organization
org = client.organizations.create_organization(name="Acme Corp")
print(f"Created: {org.id}")

# Create with domain and metadata
org = client.organizations.create_organization(
    name="Tech Startup",
    domains=["techstartup.com"],
    metadata={"tier": "enterprise", "plan": "premium"}
)

# Create with external ID for tracking
org = client.organizations.create_organization(
    name="Customer ABC",
    external_id="cust_12345",
    domains=["abc.example.com"]
)
```

--------------------------------

### Generate PKCE Pair Example

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Usage example for generating a full PKCE pair and using it in an OAuth authorization URL.

```python
from workos import PKCEPair

pkce_pair = client.pkce.generate()
# PKCEPair(
#   code_verifier='ZjN0Yv...',
#   code_challenge='E9Mz...',
#   code_challenge_method='S256'
# )

# Use in OAuth flow
auth_url = client.sso.get_authorization_url(
    client_id="client_...",
    redirect_uri="https://yourapp.com/callback",
    state=generate_random_state()
    # Include code_challenge in query params
)
```

--------------------------------

### v5 Model Imports

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of model imports in v5.

```python
from workos.types.organizations.organization import Organization
from workos.types.portal.portal_link_intent import PortalLinkIntent
```

--------------------------------

### Implement Complete SSO Flow

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/SSO.md

A full example demonstrating user redirection, callback handling, profile retrieval, and logout.

```python
import secrets
from workos import WorkOSClient, NotFoundError

client = WorkOSClient(api_key="sk_...", client_id="client_...")

# 1. Redirect user to authorization URL
def start_sso(request):
    state = secrets.token_urlsafe(32)
    request.session['oauth_state'] = state
    
    auth_url = client.sso.get_authorization_url(
        connection="conn_...",
        redirect_uri="https://yourapp.com/sso/callback",
        state=state
    )
    return redirect(auth_url)

# 2. Handle authorization callback
def sso_callback(request):
    # Verify state
    if request.args.get('state') != request.session.get('oauth_state'):
        return "Invalid state", 401
    
    # Get authorization code
    code = request.args.get('code')
    
    # Exchange code for tokens (via User Management API)
    try:
        auth_response = client.user_management.authenticate_with_code(
            code=code
        )
    except Exception as e:
        return f"Authentication failed: {e}", 401
    
    # Get user profile
    profile = client.sso.get_profile(
        access_token=auth_response.access_token
    )
    
    # Create/update user in your app
    user = get_or_create_user(
        email=profile.email,
        first_name=profile.first_name,
        last_name=profile.last_name
    )
    
    # Create session
    request.session['user_id'] = user.id
    
    return redirect('/dashboard')

# 3. Logout
def logout(request):
    profile_id = get_user_profile_id(request.session['user_id'])
    
    try:
        logout_response = client.sso.authorize_logout(
            profile_id=profile_id
        )
        logout_url = client.sso.get_logout_url(
            token=logout_response.logout_token
        )
        del request.session['user_id']
        return redirect(logout_url)
    except NotFoundError:
        # Profile doesn't exist, just clear session
        del request.session['user_id']
        return redirect('/')
```

--------------------------------

### List Organizations Examples

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ORGANIZATIONS.md

Demonstrates various ways to list, paginate, and filter organizations.

```python
# List first 10 organizations
page = client.organizations.list_organizations()
for org in page.data:
    print(f"{org.name} ({org.id})")

# List all organizations with auto-pagination
page = client.organizations.list_organizations(limit=100)
for org in page.auto_paging_iter():
    print(org.name)

# Search organizations by domain
page = client.organizations.list_organizations(
    domains=["example.com"],
    limit=50
)

# Search by name
page = client.organizations.list_organizations(
    search="Acme",
    limit=25
)
```

--------------------------------

### v6 Model Imports

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of preferred model imports in v6.

```python
from workos.organizations.models import Organization
from workos.common.models import GenerateLinkIntent
```

--------------------------------

### SSO Logout Flow Example

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/SSO.md

Demonstrates the sequence of generating a logout token and building the redirect URL.

```python
# Get logout token
response = client.sso.authorize_logout(profile_id="prof_...")
logout_token = response.logout_token

# Build logout redirect URL
logout_url = client.sso.get_logout_url(token=logout_token)

# Redirect user to logout_url to complete SSO logout
```

--------------------------------

### Initiate SSO Flows

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/SSO.md

Examples of generating authorization URLs for connections, organizations, OAuth providers, and using login hints.

```python
import secrets

# Generate state for CSRF protection
state = secrets.token_urlsafe(32)

# Initiate SSO via connection
auth_url = client.sso.get_authorization_url(
    connection="conn_...",
    redirect_uri="https://yourapp.com/sso/callback",
    state=state
)

# Redirect user to auth_url
# User authenticates at IdP and browser redirects to:
# https://yourapp.com/sso/callback?code=code_...&state=state

# Initiate SSO via organization
auth_url = client.sso.get_authorization_url(
    organization="org_...",
    redirect_uri="https://yourapp.com/sso/callback",
    state=state
)

# Initiate OAuth with provider
auth_url = client.sso.get_authorization_url(
    provider="Google",
    provider_scopes=["openid", "email", "profile"],
    redirect_uri="https://yourapp.com/sso/callback",
    state=state
)

# With hints
auth_url = client.sso.get_authorization_url(
    connection="conn_...",
    redirect_uri="https://yourapp.com/sso/callback",
    login_hint="user@example.com",  # Pre-fill email
    state=state
)
```

--------------------------------

### v6 Temporary Compatibility Imports

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of temporary compatibility imports in v6.

```python
from workos.types.organizations import Organization
```

--------------------------------

### v5 authenticate_with_code with session=None

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of passing `session=None` in v5.

```python
# v5
response = client.user_management.authenticate_with_code(code=code, session=None)
```

--------------------------------

### Generate Code Verifier Example

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Usage example for generating a code verifier with a specific byte length.

```python
verifier = client.pkce.generate_code_verifier(length=128)
print(verifier)  # "ZjN0YV..."
```

--------------------------------

### Install WorkOS Python SDK

Source: https://github.com/workos/workos-python/blob/main/README.md

Use pip to install the library. Requires Python 3.10 or higher.

```bash
pip install workos
```

--------------------------------

### Generate Code Challenge Example

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Usage example for generating a code challenge from a verifier string.

```python
verifier = client.pkce.generate_code_verifier()
challenge = client.pkce.generate_code_challenge(verifier)
print(challenge)  # "E9Mz..."
```

--------------------------------

### Authenticate with Password Usage

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Example of authenticating a user and accessing the resulting token and user object.

```python
response = client.user_management.authenticate_with_password(
    email="user@example.com",
    password="password"
)

access_token = response.access_token
user = response.user
```

--------------------------------

### v6 WorkOSClient with max_retries=0

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of initializing `WorkOSClient` with `max_retries=0` to disable default retries.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_test_123", max_retries=0)
```

--------------------------------

### v6 authenticate_with_code with broader sealed payload

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of sealing the full auth response in v6 for behavior closer to v5.

```python
from workos.session import seal_data

response = client.user_management.authenticate_with_code(code=code)

sealed = seal_data(response.to_dict(), COOKIE_PASSWORD)
```

--------------------------------

### v6 authenticate_with_code with session=None

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of dropping the `session=` argument in v6 when it was `None` in v5.

```python
# v6
response = client.user_management.authenticate_with_code(code=code)
```

--------------------------------

### Integrate Admin Portal with Flask

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ADMIN_PORTAL.md

A complete example demonstrating how to generate Admin Portal links for various intents within a Flask application, protected by an admin-only middleware.

```python
from flask import Flask, render_template, redirect
from workos import WorkOSClient
from functools import wraps

app = Flask(__name__)
client = WorkOSClient(api_key="sk_...", client_id="client_...")

# Middleware to check if user is organization admin
def require_admin(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        user = get_current_user()
        org = get_user_organization(user)
        if not user_is_admin(user, org):
            return "Unauthorized", 403
        return f(*args, **kwargs)
    return decorated_function

@app.route("/settings")
@require_admin
def organization_settings():
    """Organization admin settings page."""
    org = get_user_organization(get_current_user())
    
    # Generate Admin Portal link
    response = client.admin_portal.generate_link(
        organization=org.id,
        return_url="https://yourapp.com/settings"
    )
    
    return render_template(
        "settings.html",
        admin_portal_url=response.link,
        organization=org
    )

@app.route("/settings/sso")
@require_admin
def manage_sso():
    """Redirect to Admin Portal SSO section."""
    org = get_user_organization(get_current_user())
    
    response = client.admin_portal.generate_link(
        organization=org.id,
        intent="sso",
        return_url="https://yourapp.com/settings"
    )
    
    return redirect(response.link)

@app.route("/settings/members")
@require_admin
def manage_members():
    """Redirect to Admin Portal member management."""
    org = get_user_organization(get_current_user())
    
    response = client.admin_portal.generate_link(
        organization=org.id,
        intent="members",
        return_url="https://yourapp.com/settings"
    )
    
    return redirect(response.link)

@app.route("/settings/audit-logs")
@require_admin
def view_audit_logs():
    """Redirect to Admin Portal audit logs."""
    org = get_user_organization(get_current_user())
    
    response = client.admin_portal.generate_link(
        organization=org.id,
        intent="audit_logs",
        return_url="https://yourapp.com/settings"
    )
    
    return redirect(response.link)

def get_current_user():
    """Get authenticated user from session."""
    pass

def get_user_organization(user):
    """Get user's organization."""
    pass

def user_is_admin(user, org):
    """Check if user is admin of organization."""
    pass

if __name__ == "__main__":
    app.run(debug=True)
```

--------------------------------

### Exception classes were renamed and normalized

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Illustrates the change in exception naming from `*Exception` to `*Error` and provides examples of old and new exception handling.

```python
from workos.exceptions import NotFoundException

try:
    client.organizations.get_organization("org_123")
except NotFoundException:
    ...
```

```python
from workos import NotFoundError

try:
    client.organizations.get_organization("org_123")
except NotFoundError as exc:
    request_id = exc.request_id
    status_code = exc.status_code
```

--------------------------------

### Search Command

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Shell command to search for specific patterns during migration.

```shell
rg 'workos\.client|workos\.async_client|client\.portal|client\.fga|model_dump|model_validate|Exception|workos\.types|session=|seal_session'
```

--------------------------------

### Access Profile Data

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/SSO.md

Example of retrieving and accessing user profile attributes after exchanging an authorization code.

```python
# After exchanging authorization code for access token
profile = client.sso.get_profile(access_token="token_...")
print(f"Email: {profile.email}")
print(f"Name: {profile.first_name} {profile.last_name}")
print(f"Attributes: {profile.attributes}")
```

--------------------------------

### Get Webhook Endpoint

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/WEBHOOKS.md

Fetches details for a specific webhook endpoint by its unique identifier.

```python
endpoint = client.webhooks.get_webhook_endpoint("webhook_...")
print(f"URL: {endpoint.url}")
print(f"Events: {endpoint.events}")
```

--------------------------------

### Old client module paths were removed

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Illustrates the change in import paths for WorkOS client classes from v5 to v6.

```python
from workos.client import WorkOSClient
from workos.async_client import AsyncWorkOSClient
```

```python
from workos import WorkOSClient, AsyncWorkOSClient
```

--------------------------------

### Initialize PKCE Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Demonstrates initializing sync and async clients and accessing the PKCE generation method.

```python
from workos import WorkOSClient, AsyncWorkOSClient

sync_client = WorkOSClient(client_id="client_...", is_public=True)
async_client = AsyncWorkOSClient(client_id="client_...")

# Both have identical sync methods
pkce_pair = sync_client.pkce.generate()
```

--------------------------------

### Configure SDK via Environment Variables

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Sets up the SDK using standard environment variables.

```bash
export WORKOS_API_KEY=sk_...
export WORKOS_CLIENT_ID=client_...
export WORKOS_BASE_URL=https://api.workos.com
export WORKOS_REQUEST_TIMEOUT=60
```

--------------------------------

### Configure SDK via Constructor

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Initializes the client with configuration parameters directly in the constructor.

```python
client = WorkOSClient(
    api_key="sk_...",
    client_id="client_...",
    base_url="https://api.workos.com",
    request_timeout=60
)
```

--------------------------------

### Initialize and Use WorkOSClient

Source: https://github.com/workos/workos-python/blob/main/README.md

Synchronous client usage for listing and creating organizations.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_1234", client_id="client_1234")

# List organizations
page = client.organizations.list_organizations()
for org in page.auto_paging_iter():
    print(org.name)

# Create an organization
org = client.organizations.create_organization(name="Acme Corp")
print(org.id)
```

--------------------------------

### Initialize Synchronous and Asynchronous Clients

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Demonstrates how to instantiate both sync and async WorkOS clients. Async variants are coroutines and require the await keyword.

```python
from workos import WorkOSClient, AsyncWorkOSClient

# Synchronous
client = WorkOSClient(api_key="sk_...", client_id="client_...")
orgs = client.organizations.list_organizations()

# Asynchronous
async_client = AsyncWorkOSClient(api_key="sk_...", client_id="client_...")
orgs = await async_client.organizations.list_organizations()
```

--------------------------------

### v6 request_options for per-request retry override

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Example of overriding retry behavior for a specific request using `request_options`.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_test_123")

client.organizations.list_organizations(
    request_options={
        "timeout": 5,
        "max_retries": 0,
    }
)
```

--------------------------------

### Initialize WorkOS Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Instantiate the WorkOS client with required API credentials and optional configuration parameters.

```python
client = WorkOSClient(
    api_key="sk_...",                     # Required for server-side
    client_id="client_...",               # Required
    base_url="https://api.workos.com",   # Optional
    request_timeout=60,                   # Optional
    max_retries=3,                        # Optional
    jwt_leeway=0.0                        # Optional
)
```

--------------------------------

### List Organizations with Auto-Pagination

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Demonstrates initializing the WorkOS client and iterating through organizations using auto-pagination.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_...", client_id="client_...")

# List with auto-pagination
for org in client.organizations.list_organizations().auto_paging_iter():
    print(f"{org.name} ({org.id})")
```

--------------------------------

### Initialize Actions Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Instantiate the Actions helper from the WorkOS client.

```python
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_...", client_id="client_...")
actions = client.actions
```

--------------------------------

### Initialize Async Actions Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Instantiate the Actions helper using the asynchronous WorkOS client.

```python
from workos import AsyncWorkOSClient

async_client = AsyncWorkOSClient(api_key="sk_...", client_id="client_...")
actions = async_client.actions
```

--------------------------------

### Implement PKCE OAuth Flow

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Demonstrates the steps to generate a PKCE pair, store the verifier, and construct the authorization URL for an OAuth flow.

```python
from workos import create_public_client
import secrets

# 1. Create public client (no API key)
client = create_public_client(client_id="client_...")

# 2. Generate PKCE pair
pkce_pair = client.pkce.generate()

# 3. Store verifier in session (needed at token exchange)
session['pkce_verifier'] = pkce_pair.code_verifier

# 4. Redirect user to authorization URL
state = secrets.token_urlsafe(32)
session['oauth_state'] = state

auth_url = client.sso.get_authorization_url(
    redirect_uri="https://yourapp.com/callback",
    connection="conn_...",
    state=state
)
# Add PKCE challenge to auth URL params (handled by your OAuth library)

# User authenticates at IdP and is redirected back with code

# 5. At callback, verify state
if request.args.get('state') != session.get('oauth_state'):
    return "Invalid state", 401

# 6. Exchange code for token (using PKCE verifier from step 3)
# Pass pkce_pair.code_verifier when exchanging authorization code
# This is typically done by your OAuth library (e.g., authlib)
```

--------------------------------

### Initialize WorkOS Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Initialize the WorkOS client with your API key and client ID.

```python
from workos import WorkOSClient

client = WorkOSClient(
    api_key="sk_...",
    client_id="client_..."
)
```

--------------------------------

### Initialize Public WorkOS Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/CLIENT_SETUP.md

Use create_public_client for browser, mobile, or CLI applications where API keys cannot be stored securely.

```python
from workos import create_public_client

client = create_public_client(
    client_id="client_...",
    base_url="https://api.workos.com",
    request_timeout=60
)
```

--------------------------------

### Initialize Public Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Creates a public client for browser or mobile applications that do not use an API key.

```python
from workos import create_public_client

client = create_public_client(client_id="client_...")
# No API key attachment
```

--------------------------------

### Import PKCE Utilities

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Import the PKCE utility class for use in your application.

```python
from workos import PKCE
```

--------------------------------

### `fga` is removed

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Shows the removal of the `client.fga` accessor in v6.

```python
fga = client.fga
```

```python
# No v6 replacement is available in this branch.
```

--------------------------------

### Authentication Configuration

Source: https://github.com/workos/workos-python/blob/main/_autodocs/CLIENT_SETUP.md

Details on the required credentials for initializing the SDK.

```APIDOC
## Authentication

### Description
The SDK requires either an API Key for server-side operations or a Client ID for public client flows (OAuth/OIDC).

### Credentials
- **API Key** (api_key / WORKOS_API_KEY) - Required for server-side usage; provides full access.
- **Client ID** (client_id / WORKOS_CLIENT_ID) - Required for OAuth/OIDC flows and public client usage.

### Note
For public client usage (browser, mobile), use `create_public_client()` to ensure the API key is not included in requests.
```

--------------------------------

### Verify Actions Request Header

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Signature verification method definition and usage example for validating incoming request headers.

```python
def verify_header(
    self,
    *,
    payload: bytes | str,
    sig_header: str,
    secret: str,
    tolerance: int = 30
) -> None:
```

```python
def handle_action(request):
    """Handle incoming AuthKit Actions request."""
    try:
        client.actions.verify_header(
            payload=request.body,
            sig_header=request.headers["X-WorkOS-Signature-Timestamp"],
            secret="signer_...",
            tolerance=30
        )
    except ValueError as e:
        return {"error": str(e)}, 401

    # Signature verified, process action
    return {"status": "ok"}
```

--------------------------------

### Initialize Synchronous WorkOS Client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/CLIENT_SETUP.md

Use the WorkOSClient for standard server-side operations requiring an API key.

```python
from workos import WorkOSClient

client = WorkOSClient(
    api_key="sk_...",
    client_id="client_...",
    base_url="https://api.workos.com",
    request_timeout=60,
    max_retries=3
)
```

--------------------------------

### Get SSO Logout URL

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/SSO.md

Defines the method signature for generating the final logout redirect URL using a token.

```python
def get_logout_url(
    self,
    *,
    token: str,
    request_options: RequestOptions | None = None,
) -> str
```

--------------------------------

### Create a New User

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/USER_MANAGEMENT.md

Create a user with optional password, profile details, and organization associations.

```python
def create_user(
    self,
    *,
    email: str,
    password: PasswordPlaintext | PasswordHashed | None = None,
    first_name: str | None = None,
    last_name: str | None = None,
    email_verified: bool | None = None,
    organizations: list[str] | None = None,
    invitation_token: str | None = None,
    external_id: str | None | NotGiven = NOT_GIVEN,
    metadata: dict[str, str] | None | NotGiven = NOT_GIVEN,
    request_options: RequestOptions | None = None,
) -> UserCreateResponse
```

```python
from workos.user_management import PasswordPlaintext

# Create user with plaintext password
user = client.user_management.create_user(
    email="newuser@example.com",
    password=PasswordPlaintext(password="initial_password"),
    first_name="John",
    last_name="Doe",
    organizations=["org_..."]
)
print(f"Created user: {user.user.id}")
```

--------------------------------

### Python 3.10+ is now required

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Comparison of Python version requirements between v5 and v6 of the WorkOS Python SDK.

```toml
[project]
requires-python = ">=3.8"
```

```toml
[project]
requires-python = ">=3.10"
```

--------------------------------

### `portal` became `admin_portal`

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Demonstrates the renaming of the `portal` attribute to `admin_portal` and the change in the `generate_link` argument from `organization_id` to `organization`.

```python
link = client.portal.generate_link(
    organization_id="org_123",
    intent="sso",
)
```

```python
link = client.admin_portal.generate_link(
    organization="org_123",
    intent="sso",
)
```

--------------------------------

### Apply RequestOptions

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Demonstrates passing request options to an API method call.

```python
result = client.organizations.list_organizations(
    request_options={
        "timeout": 10,
        "max_retries": 5,
        "extra_headers": {"X-Custom-Header": "value"},
        "base_url": "https://staging.workos.com"
    }
)
```

--------------------------------

### Models are no longer Pydantic models

Source: https://github.com/workos/workos-python/blob/main/docs/V6_MIGRATION_GUIDE.md

Compares the model handling in v5 using Pydantic APIs with v6 using `from_dict()` and `to_dict()`.

```python
from workos.types.audit_logs.audit_log_event import AuditLogEvent

event = AuditLogEvent.model_validate(payload)
body = event.model_dump()
```

```python
from workos.audit_logs.models import AuditLogEvent

event = AuditLogEvent.from_dict(payload)
body = event.to_dict()
```

--------------------------------

### Bulk User Creation and Invitation in Python

Source: https://github.com/workos/workos-python/blob/main/_autodocs/COMMON_PATTERNS.md

Functions for creating users from a CSV file and sending bulk invitations to a specific organization.

```python
from workos.user_management import PasswordPlaintext
import csv

def bulk_create_users_from_csv(csv_file_path: str, org_id: str):
    """Create multiple users from CSV file."""
    created = []
    failed = []
    
    with open(csv_file_path, 'r') as f:
        reader = csv.DictReader(f)
        for row in reader:
            try:
                user = client.user_management.create_user(
                    email=row['email'],
                    first_name=row.get('first_name'),
                    last_name=row.get('last_name'),
                    password=PasswordPlaintext(
                        password=row['password']
                    ) if row.get('password') else None,
                    organizations=[org_id]
                )
                created.append(user.user)
            except Exception as e:
                failed.append({
                    "email": row['email'],
                    "error": str(e)
                })
    
    return {"created": len(created), "failed": failed}

def send_bulk_invitations(email_list: list[str], org_id: str):
    """Send invitations to multiple users."""
    invitations = []
    
    for email in email_list:
        try:
            invitation = client.user_management.send_invitation(
                email=email,
                organization_id=org_id,
                expires_in_days=7
            )
            invitations.append({
                "email": email,
                "token": invitation.token
            })
        except Exception as e:
            print(f"Failed to invite {email}: {e}")
    
    return invitations
```

--------------------------------

### PKCE OAuth Flow

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Demonstrates the steps to implement a PKCE-based OAuth flow using the WorkOS public client.

```APIDOC
## PKCE OAuth Flow

### Description
This flow allows for secure authentication using Proof Key for Code Exchange (PKCE). It involves generating a PKCE pair, redirecting the user to the authorization URL, and exchanging the authorization code for a token using the stored verifier.

### Usage
1. Initialize the public client.
2. Generate a PKCE pair using `client.pkce.generate()`.
3. Store the `code_verifier` in the user session.
4. Generate the authorization URL via `client.sso.get_authorization_url()`.
5. Verify the state parameter upon callback.
6. Exchange the authorization code for a token, providing the `code_verifier`.
```

--------------------------------

### create_public_client

Source: https://github.com/workos/workos-python/blob/main/_autodocs/CLIENT_SETUP.md

Initializes a public client for applications that cannot securely store an API key.

```APIDOC
## create_public_client(client_id, base_url, request_timeout)

### Description
Creates a public client instance for PKCE-only flows in browser, mobile, or CLI environments.

### Parameters
- **client_id** (str) - Optional - WorkOS client ID.
- **base_url** (str) - Optional - API base URL.
- **request_timeout** (int) - Optional - HTTP request timeout in seconds.
```

--------------------------------

### Configure Environment Variables

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Set required and optional environment variables for authentication and client behavior.

```bash
export WORKOS_API_KEY=sk_...              # API key for authentication
export WORKOS_CLIENT_ID=client_...        # Client ID for OAuth flows
export WORKOS_BASE_URL=...                # API base URL (optional)
export WORKOS_REQUEST_TIMEOUT=60          # Request timeout in seconds
```

--------------------------------

### View SDK Directory Structure

Source: https://github.com/workos/workos-python/blob/main/_autodocs/MANIFEST.md

Displays the file organization of the WorkOS Python SDK documentation.

```text
/workspace/home/output/
├── INDEX.md                    # Start here for navigation
├── README.md                   # Quick start guide
├── CLIENT_SETUP.md            # Client configuration
├── ERRORS.md                  # Error handling
├── PAGINATION.md              # Pagination and lists
├── HELPER_UTILITIES.md        # Cryptographic helpers
├── TYPES_AND_MODELS.md        # Type definitions
├── COMMON_PATTERNS.md         # Code patterns
├── MANIFEST.md                # This file
└── api-reference/
    ├── ORGANIZATIONS.md       # Organization API
    ├── SSO.md                 # SSO API
    ├── USER_MANAGEMENT.md     # User auth and management
    ├── WEBHOOKS.md            # Webhook management
    └── ADMIN_PORTAL.md        # Admin portal links
```

--------------------------------

### Handle ConfigurationError in Python

Source: https://github.com/workos/workos-python/blob/main/_autodocs/ERRORS.md

Catch configuration errors that occur when the client is initialized without required credentials.

```python
from workos import ConfigurationError

try:
    client = WorkOSClient()  # No api_key or client_id provided
except ConfigurationError as e:
    print(f"Configuration error: {e.message}")
```

--------------------------------

### create_user

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/USER_MANAGEMENT.md

Create a new user in the system.

```APIDOC
## create_user

### Description
Create a new user.

### Parameters
- **email** (str) - Required - User email
- **password** (PasswordPlaintext | PasswordHashed | None) - Optional - Initial password
- **first_name** (str | None) - Optional - First name
- **last_name** (str | None) - Optional - Last name
- **email_verified** (bool | None) - Optional - Mark email as verified
- **organizations** (list[str] | None) - Optional - Organization IDs to add user to
- **invitation_token** (str | None) - Optional - Invitation token
- **external_id** (str | None | NotGiven) - Optional - External identifier
- **metadata** (dict[str, str] | None | NotGiven) - Optional - Custom metadata
- **request_options** (RequestOptions | None) - Optional - Per-request options override

### Returns
UserCreateResponse
```

--------------------------------

### Authenticate with Password and MFA Handling

Source: https://github.com/workos/workos-python/blob/main/_autodocs/COMMON_PATTERNS.md

Handles password authentication with error catching for MFA challenges and email verification requirements. Requires the WorkOS client to be initialized.

```python
from workos import MfaChallengeError, EmailVerificationRequiredError

def authenticate_user(email: str, password: str):
    """Authenticate user with password, handling MFA flow."""
    try:
        response = client.user_management.authenticate_with_password(
            email=email,
            password=password
        )
        return {
            "success": True,
            "access_token": response.access_token,
            "user": response.user
        }
    
    except MfaChallengeError as e:
        # MFA required
        return {
            "success": False,
            "requires_mfa": True,
            "pending_token": e.pending_authentication_token,
            "methods": [f["type"] for f in e.authentication_factors]
        }
    
    except EmailVerificationRequiredError as e:
        # Email verification required
        return {
            "success": False,
            "requires_email_verification": True,
            "email": e.email,
            "verification_id": e.email_verification_id
        }

def verify_mfa_totp(totp_code: str, pending_token: str, challenge_id: str):
    """Complete MFA TOTP verification."""
    response = client.user_management.authenticate_with_totp(
        code=totp_code,
        pending_authentication_token=pending_token,
        authentication_challenge_id=challenge_id
    )
    return response.access_token
```

--------------------------------

### Authenticate with password using AsyncUserManagement

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/USER_MANAGEMENT.md

Initializes an asynchronous client and authenticates a user via email and password.

```python
async_client = AsyncWorkOSClient(api_key="sk_...", client_id="client_...")

# All methods are identical but return coroutines
response = await async_client.user_management.authenticate_with_password(
    email="user@example.com",
    password="password"
)
```

--------------------------------

### Initialize and Use AsyncWorkOSClient

Source: https://github.com/workos/workos-python/blob/main/README.md

Asynchronous client usage for non-blocking API calls.

```python
from workos import AsyncWorkOSClient

async_client = AsyncWorkOSClient(api_key="sk_1234", client_id="client_1234")

page = await async_client.organizations.list_organizations()
async for org in page.auto_paging_iter():
    print(org.name)
```

--------------------------------

### Model Initialization with Defaults

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Models are defined with required fields and optional fields that default to None.

```python
@dataclass(slots=True)
class SyncPage:
    data: list[Organization]            # Required
    list_metadata: ListMetadata          # Required
    _fetch_page: Callable | None = None  # Optional, defaults to None
```

--------------------------------

### Reuse Client Instance

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Instantiate the client once and reuse it throughout the application lifecycle to improve performance.

```python
client = WorkOSClient(...)  # Create once
# Reuse for all requests in your app
```

--------------------------------

### Create Organization Method Definition

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ORGANIZATIONS.md

Defines the signature for creating a new organization.

```python
def create_organization(
    self,
    *,
    name: str,
    allow_profiles_outside_organization: bool | None = None,
    domains: list[str] | None = None,
    domain_data: list[OrganizationDomainData] | None = None,
    metadata: dict[str, str] | None | NotGiven = NOT_GIVEN,
    external_id: str | None | NotGiven = NOT_GIVEN,
    request_options: RequestOptions | None = None,
) -> Organization
```

--------------------------------

### Create and List Organizations

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Use these methods to manage organization records and retrieve lists with automatic pagination.

```python
# Create
org = client.organizations.create_organization(
    name="Acme Corp",
    domains=["acme.com"],
    metadata={"plan": "enterprise"}
)

# List all with auto-pagination
for org in client.organizations.list_organizations().auto_paging_iter():
    print(f"{org.name} ({org.id})")

# Filter by domain
page = client.organizations.list_organizations(domains=["acme.com"])
```

--------------------------------

### Import Page Type

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Use SyncPage with generic type arguments for paginated API responses.

```python
from workos import SyncPage
from workos.organizations.models import Organization

def list_all_orgs(client) -> SyncPage[Organization]:
    return client.organizations.list_organizations()
```

--------------------------------

### generate

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Generates a complete PKCE pair containing a verifier and its corresponding challenge.

```APIDOC
## generate()

### Description
Generates a complete PKCE pair object.

### Returns
- (PKCEPair) A dataclass containing:
  - code_verifier (str): Random verifier
  - code_challenge (str): SHA-256 hash of verifier
  - code_challenge_method (Literal["S256"]): Always "S256"
```

--------------------------------

### Handling Optional and Required Fields

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Demonstrates how to handle required fields, omit optional fields using NOT_GIVEN, and set optional fields to None.

```python
# name is required
# metadata is optional (omit it)
# external_id is optional (omit or set to None)
org = client.organizations.create_organization(
    name="Acme",  # Required
    metadata=NOT_GIVEN,  # Omit
    external_id=None  # Set to null
)
```

--------------------------------

### Import Organization Type

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Use the Organization model for type hinting in function signatures.

```python
from workos.organizations.models import Organization

def process_organization(org: Organization) -> str:
    return f"{org.name} ({org.id})"
```

--------------------------------

### Import WorkOS SDK components

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Use these import statements to access the WorkOS client, error handling, pagination utilities, and resource models.

```python
# Main client classes
from workos import WorkOSClient, AsyncWorkOSClient, create_public_client

# Error types
from workos import (
    WorkOSError,
    NotFoundError,
    BadRequestError,
    AuthenticationError,
    AuthorizationError,
    RateLimitExceededError,
    ServerError,
    # ... and others
)

# Pagination
from workos import SyncPage, AsyncPage, ListMetadata

# Type definitions
from workos import RequestOptions, NOT_GIVEN, NotGiven

# Helper utilities
from workos import Actions, AsyncActions, PKCE, PKCEPair

# Specific resource models
from workos.organizations.models import Organization
from workos.user_management.models import User, AuthenticateResponse
from workos.sso.models import Connection, Profile
from workos.webhooks.models import WebhookEndpoint
from workos.admin_portal.models import PortalLinkResponse
```

--------------------------------

### Paginate with filters and manual cursor

Source: https://github.com/workos/workos-python/blob/main/_autodocs/PAGINATION.md

Demonstrates filtering results and manually fetching the next page using the after cursor.

```python
# List organizations matching criteria, paginate through results
page = client.organizations.list_organizations(
    limit=20,
    search="Acme",
    domains=["acme.com"]
)

for org in page:
    print(org.name)
    
if page.has_more():
    next_page = client.organizations.list_organizations(
        limit=20,
        after=page.after,
        search="Acme",
        domains=["acme.com"]
    )
```

--------------------------------

### Implement SSO Connection and Logout

Source: https://github.com/workos/workos-python/blob/main/_autodocs/COMMON_PATTERNS.md

Patterns for generating SSO authorization URLs and handling the SSO logout flow for users.

```python
def setup_sso_connection(
    org_id: str,
    connection_type: str,
    domain: str,
    provider_config: dict
):
    """Create and configure SSO connection."""
    # This typically involves creating the connection
    # via the Admin Portal or using provider-specific setup
    
    # Get the authorization URL for SSO
    auth_url = client.sso.get_authorization_url(
        organization=org_id,
        redirect_uri="https://yourapp.com/sso/callback"
    )
    
    return {
        "connection_type": connection_type,
        "auth_url": auth_url,
        "domain": domain
    }

def handle_sso_logout(user_id: str, org_id: str):
    """Complete SSO logout flow."""
    # Get user's SSO profile ID
    user = client.user_management.get_user(user_id)
    
    # Find the SSO profile associated with user
    profile_id = get_sso_profile_for_user(user_id)
    
    if not profile_id:
        return None
    
    # Authorize logout
    logout_response = client.sso.authorize_logout(
        profile_id=profile_id
    )
    
    # Get logout redirect URL
    logout_url = client.sso.get_logout_url(
        token=logout_response.logout_token
    )
    
    return logout_url
```

--------------------------------

### Create and list organizations with AsyncWorkOSClient

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ORGANIZATIONS.md

Use the AsyncWorkOSClient for asynchronous organization management. All methods return coroutines and support auto-paging iterators.

```python
from workos import AsyncWorkOSClient

async_client = AsyncWorkOSClient(api_key="sk_...", client_id="client_...")

# All methods are identical but return coroutines
org = await async_client.organizations.create_organization(name="Acme")
page = await async_client.organizations.list_organizations()
async for org in page.auto_paging_iter():
    print(org.name)
```

--------------------------------

### Generate Admin Portal Link with Return URL

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ADMIN_PORTAL.md

Include a return_url to redirect users back to a specific page within your application after they finish in the portal.

```python
from urllib.parse import urlencode

def get_admin_portal_link(org_id, section, return_to_page):
    """Generate Admin Portal link with dynamic return URL."""
    return_url = f"https://yourapp.com{return_to_page}"
    
    response = client.admin_portal.generate_link(
        organization=org_id,
        intent=section,
        return_url=return_url
    )
    
    return response.link
```

--------------------------------

### Generate Async Admin Portal Link

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/ADMIN_PORTAL.md

Use the AsyncWorkOSClient for non-blocking operations when generating portal links.

```python
async_client = AsyncWorkOSClient(api_key="sk_...", client_id="client_...")

response = await async_client.admin_portal.generate_link(
    organization="org_...",
    intent="sso"
)
```

--------------------------------

### Import Enums

Source: https://github.com/workos/workos-python/blob/main/_autodocs/TYPES_AND_MODELS.md

Use SDK enums to ensure type-safe values for configuration parameters.

```python
from workos.common.models.pagination_order import PaginationOrder

order: PaginationOrder = "asc"  # Type-safe enum value
```

--------------------------------

### Import ListMetadata

Source: https://github.com/workos/workos-python/blob/main/_autodocs/PAGINATION.md

Import the ListMetadata class for accessing cursor-based pagination metadata.

```python
from workos import ListMetadata

# Available on page.list_metadata
```

--------------------------------

### Handle NotFoundError (404)

Source: https://github.com/workos/workos-python/blob/main/_autodocs/ERRORS.md

Catch exceptions when a requested resource does not exist.

```python
from workos import NotFoundError

try:
    client.organizations.get_organization("org_nonexistent")
except NotFoundError as e:
    print(f"Not found: {e.message}")
    print(f"Request ID: {e.request_id}")
```

--------------------------------

### Import AsyncPage

Source: https://github.com/workos/workos-python/blob/main/_autodocs/PAGINATION.md

Import the AsyncPage class used for asynchronous API list methods.

```python
from workos import AsyncPage
```

--------------------------------

### Run Tests

Source: https://github.com/workos/workos-python/blob/main/_autodocs/INDEX.md

Execute the test suite using the pytest command.

```bash
pytest tests/
```

--------------------------------

### sign_response

Source: https://github.com/workos/workos-python/blob/main/_autodocs/HELPER_UTILITIES.md

Builds and signs an Actions response to be returned to WorkOS.

```APIDOC
## sign_response

### Description
Generates a signed response object for an AuthKit Action.

### Parameters
- **action_type** (str) - Required - "authentication" or "user_registration"
- **verdict** (str) - Required - "Allow" or "Deny"
- **error_message** (str | None) - Optional - Error message if verdict is "Deny"
- **secret** (str) - Required - Actions signing secret

### Returns
- dict[str, Any]: Dictionary containing object, payload, and signature keys
```

--------------------------------

### User Search and Pagination in Python

Source: https://github.com/workos/workos-python/blob/main/_autodocs/COMMON_PATTERNS.md

Methods for retrieving all users within an organization using auto-paging and finding a specific user by email.

```python
def find_all_users_by_organization(org_id: str):
    """Retrieve all users in an organization."""
    all_users = []
    page = client.user_management.list_users(
        organization_id=org_id,
        limit=100
    )
    
    for user in page.auto_paging_iter():
        all_users.append(user)
    
    return all_users

def find_user_by_email(email: str):
    """Find user by email address."""
    page = client.user_management.list_users(
        email=email,
        limit=1
    )
    
    if page.data:
        return page.data[0]
    return None
```

--------------------------------

### Complete Webhook Integration with Flask

Source: https://github.com/workos/workos-python/blob/main/_autodocs/api-reference/WEBHOOKS.md

A full implementation showing how to receive, verify, and process webhook events in a Flask application.

```python
from flask import Flask, request, jsonify
from workos import WorkOSClient
import json

app = Flask(__name__)
client = WorkOSClient(api_key="sk_...", client_id="client_...")

# Setup webhook endpoint once
# endpoint = client.webhooks.create_webhook_endpoint(
#     url="https://yourapp.com/webhooks",
#     events=["user.created", "user.updated", "organization.created"]
# )
# Store endpoint.secret safely

WEBHOOK_SECRET = "whsec_..."  # Load from environment

@app.route("/webhooks", methods=["POST"])
def handle_webhook():
    # Get signature header
    sig_header = request.headers.get("X-WorkOS-Signature")
    
    # Verify and parse webhook
    try:
        event = client.webhooks.construct_event(
            payload=request.data,
            sig_header=sig_header,
            endpoint_secret=WEBHOOK_SECRET
        )
    except ValueError as e:
        print(f"Webhook signature verification failed: {e}")
        return jsonify({"error": "Signature verification failed"}), 401
    except json.JSONDecodeError:
        return jsonify({"error": "Invalid JSON"}), 400
    
    # Process event
    event_type = event.get("type")
    event_data = event.get("data")
    
    print(f"Received webhook event: {event_type}")
    
    if event_type == "user.created":
        print(f"New user created: {event_data.get('email')}")
    elif event_type == "user.updated":
        print(f"User updated: {event_data.get('id')}")
    elif event_type == "organization.created":
        print(f"New organization: {event_data.get('name')}")
    
    # Acknowledge receipt (must respond within 30 seconds)
    return jsonify({"status": "received"}), 200

if __name__ == "__main__":
    app.run(port=5000)
```

--------------------------------

### Import SyncPage

Source: https://github.com/workos/workos-python/blob/main/_autodocs/PAGINATION.md

Import the SyncPage class used for synchronous API list methods.

```python
from workos import SyncPage
```

--------------------------------

### AsyncWorkOSClient

Source: https://github.com/workos/workos-python/blob/main/_autodocs/CLIENT_SETUP.md

Initializes an asynchronous WorkOS client for non-blocking server-side applications.

```APIDOC
## AsyncWorkOSClient(api_key, client_id, base_url, request_timeout, max_retries)

### Description
Initializes the asynchronous WorkOS client for non-blocking operations.

### Parameters
- **api_key** (str) - Optional - WorkOS API key.
- **client_id** (str) - Optional - WorkOS client ID.
- **base_url** (str) - Optional - API base URL.
- **request_timeout** (int) - Optional - HTTP request timeout in seconds.
- **max_retries** (int) - Optional - Maximum number of automatic retries.
```

--------------------------------

### Access Typed Models

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Demonstrates using dataclass models with type annotations for IDE autocompletion.

```python
from workos.organizations.models import Organization

org: Organization = client.organizations.get_organization("org_...")
print(org.name)  # IDE autocompletion works
```

--------------------------------

### Webhook Integration

Source: https://github.com/workos/workos-python/blob/main/_autodocs/README.md

Configure webhook endpoints and verify incoming event payloads using the provided signature header.

```python
# Setup endpoint (once)
endpoint = client.webhooks.create_webhook_endpoint(
    url="https://yourapp.com/webhooks",
    events=["user.created", "user.updated"]
)

# Verify and process incoming webhook
event = client.webhooks.construct_event(
    payload=request.body,
    sig_header=request.headers["X-WorkOS-Signature"],
    endpoint_secret=endpoint.secret
)

if event["type"] == "user.created":
    handle_user_created(event["data"])
```
Tokens:
Raw