workos 6.1.0 → 7.0.0

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "6.1.0"
+  ".": "7.0.0"
 }

data/.ruby-version

@@ -1 +1 @@
-3.1.4
+3.3.11

data/.standard.yml

@@ -0,0 +1 @@
+ruby_version: 3.3

data/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [7.0.0](https://github.com/workos/workos-ruby/compare/v6.2.0...v7.0.0) (2026-04-20)
+
+This is a major release that introduces a fully redesigned SDK architecture. The SDK is now **generated from the WorkOS OpenAPI spec**, bringing type safety, consistent interfaces, and improved developer ergonomics.
+
+### High-Level Changes
+
+- **Client-centric architecture**: The SDK now revolves around an instantiated `WorkOS::Client` rather than module-level service calls. All product areas are accessed through client methods (e.g., `client.organizations`, `client.user_management`, `client.sso`).
+
+- **Generated request/response models**: Typed models replace raw hashes. Response models no longer inherit from `Hash` — use accessor methods instead of bracket notation.
+
+- **Per-request overrides**: The new runtime supports `request_options:` for per-request API key, timeout, base URL, and retry overrides — useful for multi-tenant setups.
+
+- **Minimum Ruby 3.3+**: The minimum Ruby version has been raised to 3.3.
+
+- **Renamed services and methods**: Several top-level services were renamed (e.g., `WorkOS::Portal` → `client.admin_portal`, `WorkOS::MFA` → `client.multi_factor_auth`). Method signatures now use explicit keyword arguments.
+
+- **Session management refactor**: AuthKit session sealing, refresh, and authentication flows were overhauled with a dedicated `SessionManager` on the client instance.
+
+- **New capabilities**: Device code flow, public/PKCE clients, `auto_paging_each` pagination, and `last_response` observability on all responses.
+
+### Migration Guide
+
+For detailed instructions on updating your application, see the **[v7 Migration Guide](https://github.com/workos/workos-ruby/blob/main/docs/V7_MIGRATION_GUIDE.md)**.
+
+
+## [6.2.0](https://github.com/workos/workos-ruby/compare/v6.1.0...v6.2.0) (2026-03-06)
+
+
+### Features
+
+* **user-management:** add directory_managed to OrganizationMembership ([#446](https://github.com/workos/workos-ruby/issues/446)) ([914d824](https://github.com/workos/workos-ruby/commit/914d824668b70950905d5db666978e9609c9f706))
+* **user-management:** add invitation accept endpoint ([#448](https://github.com/workos/workos-ruby/issues/448)) ([b5b4da1](https://github.com/workos/workos-ruby/commit/b5b4da1c031bc5f688562fdc33506e03b769f650))
+
+
+### Bug Fixes
+
+* update renovate rules ([#443](https://github.com/workos/workos-ruby/issues/443)) ([f156c79](https://github.com/workos/workos-ruby/commit/f156c799e88269493104628760f94b8abaebf542))
+
 ## [6.1.0](https://github.com/workos/workos-ruby/compare/workos-v6.0.0...workos/v6.1.0) (2026-02-10)
 
 

data/Gemfile

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
 gemspec

data/Gemfile.lock

@@ -1,85 +1,131 @@
 PATH
   remote: .
   specs:
-    workos (6.1.0)
-      encryptor (~> 3.0)
+    workos (7.0.0)
       jwt (~> 3.1)
+      logger (~> 1.7)
+      zeitwerk (~> 2.6)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
-    ast (2.4.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    ast (2.4.3)
     base64 (0.3.0)
-    bigdecimal (3.1.7)
-    crack (1.0.0)
+    bigdecimal (4.1.2)
+    crack (1.0.1)
       bigdecimal
       rexml
-    diff-lcs (1.5.1)
-    encryptor (3.0.0)
-    hashdiff (1.1.0)
-    json (2.9.1)
+    drb (2.2.3)
+    hashdiff (1.2.1)
+    json (2.19.4)
     jwt (3.1.2)
       base64
-    language_server-protocol (3.17.0.3)
-    parallel (1.26.3)
-    parser (3.3.7.0)
+    language_server-protocol (3.17.0.5)
+    lint_roller (1.1.0)
+    logger (1.7.0)
+    minitest (6.0.4)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
-    public_suffix (5.0.4)
+    prism (1.9.0)
+    public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
-    rake (13.3.1)
-    regexp_parser (2.10.0)
-    rexml (3.4.2)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.3)
-      rspec-support (~> 3.9.3)
-    rspec-expectations (3.9.4)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.4)
-    rubocop (1.71.0)
+    rake (13.4.2)
+    regexp_parser (2.12.0)
+    rexml (3.4.4)
+    rubocop (1.84.2)
       json (~> 2.3)
-      language_server-protocol (>= 3.17.0)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.36.2, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.37.0)
-      parser (>= 3.3.1.0)
+    rubocop-ast (1.49.1)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-performance (1.26.1)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.75.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
     ruby-progressbar (1.13.0)
-    unicode-display_width (3.1.4)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
-    vcr (6.3.1)
-      base64
-    webmock (3.23.0)
+    standard (1.54.0)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.0)
+      rubocop (~> 1.84.0)
+      standard-custom (~> 1.0.0)
+      standard-performance (~> 1.8)
+    standard-custom (1.0.2)
+      lint_roller (~> 1.0)
+      rubocop (~> 1.50)
+    standard-performance (1.9.0)
+      lint_roller (~> 1.1)
+      rubocop-performance (~> 1.26.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
+    webmock (3.26.2)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    zeitwerk (2.7.5)
 
 PLATFORMS
+  arm64-darwin-25
   ruby
 
 DEPENDENCIES
   bundler (>= 2.0.1)
+  minitest (~> 6.0)
   rake
-  rspec (~> 3.9.0)
-  rubocop (~> 1.71)
-  vcr (~> 6.0)
-  webmock
+  standard (~> 1.49)
+  webmock (~> 3.26)
   workos!
 
+CHECKSUMS
+  addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
+  ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+  crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
+  drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
+  hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
+  json (2.19.4) sha256=670a7d333fb3b18ca5b29cb255eb7bef099e40d88c02c80bd42a3f30fe5239ac
+  jwt (3.1.2) sha256=af6991f19a6bb4060d618d9add7a66f0eeb005ac0bc017cd01f63b42e122d535
+  language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
+  lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  minitest (6.0.4) sha256=df1304664589d40f46089247fdc451f866b0ce0d7cae1457a15fc1eb7d48dca1
+  parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
+  parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
+  prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
+  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
+  rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
+  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+  regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb
+  rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
+  rubocop (1.84.2) sha256=5692cea54168f3dc8cb79a6fe95c5424b7ea893c707ad7a4307b0585e88dbf5f
+  rubocop-ast (1.49.1) sha256=4412f3ee70f6fe4546cc489548e0f6fcf76cafcfa80fa03af67098ffed755035
+  rubocop-performance (1.26.1) sha256=cd19b936ff196df85829d264b522fd4f98b6c89ad271fa52744a8c11b8f71834
+  ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
+  standard (1.54.0) sha256=7a4b08f83d9893083c8f03bc486f0feeb6a84d48233b40829c03ef4767ea0100
+  standard-custom (1.0.2) sha256=424adc84179a074f1a2a309bb9cf7cd6bfdb2b6541f20c6bf9436c0ba22a652b
+  standard-performance (1.9.0) sha256=49483d31be448292951d80e5e67cdcb576c2502103c7b40aec6f1b6e9c88e3f2
+  unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
+  unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
+  webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
+  workos (7.0.0)
+  zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd
+
 BUNDLED WITH
-   2.2.33
+  4.0.3

data/README.md

@@ -1,43 +1,191 @@
 # WorkOS Ruby Library
 
-The WorkOS library for Ruby provides convenient access to the WorkOS API from applications written in Ruby.
+The WorkOS Ruby SDK provides convenient access to the WorkOS API from applications written in Ruby.
 
 ## Documentation
 
-See the [API Reference](https://workos.com/docs/reference/client-libraries) for Ruby usage examples.
+- [Ruby SDK documentation](https://docs.workos.com/sdk/ruby)
+- [API reference](https://workos.com/docs/reference/client-libraries)
 
 ## Installation
 
 Install the package with:
 
-```
+```sh
 gem install workos
 ```
 
 If you're using Bundler to manage your application's gems, add the WorkOS gem to your Gemfile:
 
-```
-source 'https://rubygems.org'
+```ruby
+source "https://rubygems.org"
 
-gem 'workos'
+gem "workos"
 ```
 
 ## Configuration
 
-To use the library you must provide an API key, located in the WorkOS dashboard, as an environment variable `WORKOS_API_KEY`:
+To use the library, provide your WorkOS API key as `WORKOS_API_KEY` and, for AuthKit and SSO flows, your client ID as `WORKOS_CLIENT_ID`:
 
 ```sh
-$ WORKOS_API_KEY=[your api key] ruby app.rb
+WORKOS_API_KEY=sk_test_123 WORKOS_CLIENT_ID=client_123 ruby app.rb
 ```
 
-Or, you may set the key yourself, such as in an initializer in your application load path:
+Or configure the SDK in an initializer:
 
 ```ruby
 # /config/initializers/workos.rb
 
+require "workos"
+require "workos/configuration"
+
 WorkOS.configure do |config|
-  config.key = '[your api key]'
+  config.api_key = ENV.fetch("WORKOS_API_KEY")
+  config.client_id = ENV["WORKOS_CLIENT_ID"]
   config.timeout = 120
+  config.logger = Logger.new($stdout)
+  config.log_level = :info
+end
+
+client = WorkOS.client
+```
+
+## Client patterns
+
+### Singleton (recommended for most apps)
+
+```ruby
+WorkOS.configure do |config|
+  config.api_key = ENV.fetch("WORKOS_API_KEY")
+  config.client_id = ENV["WORKOS_CLIENT_ID"]
+end
+
+WorkOS.client.organizations.list_organizations
+```
+
+### Multi-tenant (one client per API key)
+
+```ruby
+tenant_a = WorkOS::Client.new(api_key: "sk_tenant_a", client_id: "client_a")
+tenant_b = WorkOS::Client.new(api_key: "sk_tenant_b", client_id: "client_b")
+
+tenant_a.organizations.list_organizations
+tenant_b.organizations.list_organizations
+```
+
+### Public / PKCE (browser, mobile, CLI)
+
+```ruby
+public_client = WorkOS::PublicClient.create(client_id: "client_123")
+url, verifier, state = public_client.user_management.get_authorization_url_with_pkce(
+  redirect_uri: "https://example.com/callback"
+)
+```
+
+### Fork safety (Puma / Unicorn)
+
+The SDK caches persistent connections per fiber. After forking, call
+`WorkOS.reset_client` (or `client.shutdown`) to close inherited sockets:
+
+```ruby
+# config/puma.rb
+on_worker_boot { WorkOS.reset_client }
+```
+
+## Per-request options
+
+Every API call accepts `request_options:` for per-call overrides:
+
+```ruby
+organization = WorkOS.client.organizations.get_organization(
+  id: "org_123",
+  request_options: {
+    timeout: 10,
+    extra_headers: {"X-Request-Source" => "admin"},
+    idempotency_key: "org-create-123"
+  }
+)
+```
+
+`Idempotency-Key` is only sent when you provide `request_options[:idempotency_key]`, or when the SDK retries a mutating request after a transient failure.
+
+## Usage Examples
+
+### List organizations
+
+```ruby
+organizations = WorkOS.client.organizations.list_organizations(limit: 10)
+
+organizations.data.each do |organization|
+  puts "#{organization.id}: #{organization.name}"
+end
+```
+
+### Get an organization
+
+```ruby
+organization = WorkOS.client.organizations.get_organization(id: "org_123")
+puts organization.name
+```
+
+### Create a user
+
+```ruby
+user = WorkOS.client.user_management.create_user(
+  email: "marceline@example.com",
+  first_name: "Marceline",
+  last_name: "Abadeer"
+)
+
+puts user.id
+```
+
+### Verify a webhook
+
+```ruby
+payload = request.body.read
+signature = request.env.fetch("HTTP_WORKOS_SIGNATURE")
+secret = ENV.fetch("WORKOS_WEBHOOK_SECRET")
+
+event = WorkOS.client.webhooks.construct_event(
+  payload: payload,
+  sig_header: signature,
+  secret: secret
+)
+
+puts event.event
+```
+
+## Pagination
+
+List endpoints return `WorkOS::Types::ListStruct`, which supports inspecting pagination metadata or iterating through every record automatically.
+
+```ruby
+users = WorkOS.client.user_management.list_users(limit: 100)
+
+users.auto_paging_each do |user|
+  puts user.email
+end
+```
+
+You can also iterate page by page:
+
+```ruby
+users.each_page do |page|
+  puts page.list_metadata
+end
+```
+
+## Error Handling
+
+The SDK raises typed errors for API and transport failures.
+
+```ruby
+begin
+  WorkOS.client.organizations.get_organization(id: "org_123")
+rescue WorkOS::APIError => e
+  warn "#{e.class}: #{e.message}"
+  warn "status=#{e.http_status} request_id=#{e.request_id} code=#{e.code}"
 end
 ```
 
@@ -60,7 +208,7 @@ can move to using the stable version.
 
 ## More Information
 
-* [Single Sign-On Guide](https://workos.com/docs/sso/guide)
-* [Directory Sync Guide](https://workos.com/docs/directory-sync/guide)
-* [Admin Portal Guide](https://workos.com/docs/admin-portal/guide)
-* [Magic Link Guide](https://workos.com/docs/magic-link/guide)
+- [Ruby SDK documentation](https://docs.workos.com/sdk/ruby)
+- [Single Sign-On Guide](https://workos.com/docs/sso/guide)
+- [Directory Sync Guide](https://workos.com/docs/directory-sync/guide)
+- [Admin Portal Guide](https://workos.com/docs/admin-portal/guide)

data/Rakefile

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
 
-require 'bundler/gem_tasks'
-require 'rspec/core/rake_task'
+require "bundler/gem_tasks"
+require "rake/testtask"
 
-RSpec::Core::RakeTask.new(:spec)
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.libs << "lib"
+  t.test_files = FileList["test/**/test_*.rb"]
+end
 
-task default: :spec
+task default: :test