SaaS Starter (WorkOS)

Authentication, organizations, roles, and sessions powered by WorkOS. This is the starter-saas-workos pack.

For session flow, middleware, and route guards, see Authentication and Organizations.

What you need

• A WorkOS account and project. Sign up at dashboard.workos.com.
• Google enabled as a social provider inside WorkOS (for the "Login with Google" button). WorkOS handles the Google integration for you, so you do not register a Google OAuth app yourself.
• Resend for transactional email (password reset, org invites). The starter uses the base template's RESEND_API_KEY.
• Postgres and Valkey (base services).

WorkOS credentials

In your WorkOS dashboard, grab:

• Client ID (WORKOS_CLIENT_ID)
• API Key (WORKOS_API_KEY)
• A cookie password of at least 32 characters (WORKOS_COOKIE_PASSWORD). Generate one with openssl rand -base64 32.

Put these in apps/backend/.env.

Google OAuth through WorkOS

Enable Google under Authentication > Google in your WorkOS dashboard. WorkOS gives you the redirect URL to paste into Google; you don't manage the Google app directly.

The pack starts Google sign-in from GET /auth/google/:intent and passes this redirect URI to WorkOS:

http://localhost:3000/auth/google/callback

Register that exact URL in WorkOS > Dashboard > Redirects. In production, swap the origin for your deployed domain:

https://yourdomain.com/auth/google/callback

Environment variables

Admin app

This starter also ships a separate admin app for managing users and organizations. Set SUPER_ADMIN_EMAIL to sign in the first time.