How DSALTA integrates with WorkOS — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to WorkOS using read-only API access to collect compliance evidence automatically. DSALTA syncs your User Management (AuthKit) roster — the user identities in your WorkOS environment, which are your application’s users rather than the colleagues who can sign in to the WorkOS Dashboard — and your WorkOS organizations, then feeds them into your Data Library modules. DSALTA reads both when you connect and again on each Sync from integrations run.
Read-only access. DSALTA never modifies, creates, or deletes resources in your WorkOS account.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the WorkOS user roster — names, emails and account creation dates — which appears on your Access page (the /user_management/users payload DSALTA reads carries no organization role and no account state, so every row is recorded with the role Member and status Active); and your WorkOS resources, which appear on your Inventory page.It calls these WorkOS endpoints:
/organizations
/user_management/users
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your WorkOS environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the WorkOS card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from WorkOS. This can happen if the Secret Key was revoked or rotated in the WorkOS Dashboard.
Data is not syncing
Confirm the Secret Key is still active in WorkOS Dashboard → API Keys, then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find WorkOS, and click Connect to open the connect panel.
2
Open WorkOS API Keys
In the WorkOS Dashboard, open API Keys. The free tier is sufficient; no paid or enterprise plan is required.Pick the environment before you copy anything. Every WorkOS workspace has a separate Staging and Production environment, and API Keys sits in the left sidebar of whichever one is selected. The two environments hold completely separate users and organizations, and each request is scoped to the environment its key belongs to — so use a Production key if you want DSALTA to review your real roster. A Staging key connects successfully but returns your Staging data.
3
Copy your Secret Key
Copy your Secret Key (a test key, sk_test…, works; sk_live… also works). It grants read access to your User Management users and organizations.
Your Staging key is generated for you and can be viewed as often as you need. A Production key only exists once you unlock Production access, and WorkOS shows it a single time — paste it into DSALTA or a password manager immediately, because you cannot read it back afterwards.
Know which roster you are about to review. The key gives DSALTA your User Management (AuthKit) users — WorkOS defines that object as “a user identity in your application”, i.e. the people who sign in to your product, including anyone JIT-provisioned through a customer’s SSO connection. It is not the list of colleagues who can sign in to the WorkOS Dashboard, and WorkOS does not expose that list through either endpoint DSALTA reads. If the two access checks flag hundreds of people who are not on your People page, this is why.
4
Paste the key
Paste the Secret Key into the API Key field of the connect panel — that is the only value DSALTA needs.
5
Finish in DSALTA
Return to the connect panel you opened in step 1, enter the credential you just created, and confirm to complete the connection.
Once connected, WorkOS appears on the Connected tab and the checks below begin reporting after the first sync.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
