workos-authkit-react
WorkOS AuthKit for React (SPA)
Decision Tree
START
│
├─► Fetch README (BLOCKING)
│ github.com/workos/authkit-react/blob/main/README.md
│ README is source of truth. Stop if fetch fails.
│
├─► Detect Build Tool
│ ├─ vite.config.ts exists? → Vite
│ └─ otherwise → Create React App
│
├─► Set Env Var Prefix
│ ├─ Vite → VITE_WORKOS_CLIENT_ID
│ └─ CRA → REACT_APP_WORKOS_CLIENT_ID
│
└─► Implement per README
Critical: Build Tool Detection
| Marker File | Build Tool | Env Prefix | Access Pattern |
|---|---|---|---|
vite.config.ts |
Vite | VITE_ |
import.meta.env.VITE_* |
craco.config.js or none |
CRA | REACT_APP_ |
process.env.REACT_APP_* |
Wrong prefix = undefined values at runtime. This is the #1 integration failure.
Key Clarification: No Callback Route
The React SDK handles OAuth callbacks internally via AuthKitProvider.
- No server-side callback route needed
- SDK intercepts redirect URI client-side
- Token exchange happens automatically
Just ensure redirect URI env var matches WorkOS Dashboard exactly.
Required Environment Variables
{PREFIX}WORKOS_CLIENT_ID=client_...
{PREFIX}WORKOS_REDIRECT_URI=http://localhost:5173/callback
No WORKOS_API_KEY needed. Client-side only SDK.
Verification Checklist
- README fetched and read
- Build tool detected correctly
- Env var prefix matches build tool
-
.envor.env.localhas required vars - No
nextdependency (wrong skill) - No
react-routerdependency (wrong skill) - AuthKitProvider wraps app root
-
pnpm buildexits 0
Error Recovery
"clientId is required"
Cause: Env var inaccessible (wrong prefix)
Check: Does prefix match build tool? Vite needs VITE_, CRA needs REACT_APP_.
Auth state lost on refresh
Cause: Token persistence issue
Check: Browser dev tools → Application → Local Storage. SDK stores tokens here automatically.
useAuth returns undefined
Cause: Component outside provider tree
Check: Entry file (main.tsx or index.tsx) wraps <App /> in <AuthKitProvider>.
Callback redirect fails
Cause: URI mismatch
Check: Env var redirect URI exactly matches WorkOS Dashboard → Redirects configuration.
More from workos/skills
workos
Use when the user asks for a WorkOS docs URL, term, or dashboard field (Sign-in endpoint, initiate_login_uri, Redirect URI, `WORKOS_*` env vars), or is implementing, debugging, or migrating WorkOS — AuthKit, SSO/SAML, Directory Sync, RBAC, FGA, MFA, Vault, Audit Logs, Admin Portal, Pipes (Connected Apps), Feature Flags, Radar (bot/fraud detection), webhooks, Custom Domains, or migrating from Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, or Better Auth. Also triggers on @workos-inc/* imports.
593workos-widgets
Use when the user is implementing, embedding, or debugging a WorkOS Widget — specifically the User Management, User Profile, Admin Portal SSO Connection, or Admin Portal Domain Verification widgets. Handles the full stack — detecting the frontend (Next.js, React, React Router, TanStack Start, Vite, SvelteKit), generating access tokens via the backend SDK in use (Node, Python, Go, Ruby, PHP, Java, .NET), and wiring up the widget component correctly per the bundled OpenAPI spec. Also use when code imports from @workos-inc/widgets or the user pastes <UserManagement /> or <UserProfile /> JSX.
269workos-authkit-nextjs
Integrate WorkOS AuthKit with Next.js App Router (13+). Server-side rendering required.
64workos-authkit-base
Architectural reference for WorkOS AuthKit integrations. Fetch README first for implementation details.
42workos-authkit-tanstack-start
Integrate WorkOS AuthKit with TanStack Start applications. Full-stack TypeScript with server functions. Use when project uses TanStack Start, @tanstack/start, or vinxi.
28workos-authkit-vanilla-js
Integrate WorkOS AuthKit with vanilla JavaScript applications. No framework required, browser-only. Use when project is plain HTML/JS, doesn't use React/Vue/etc, or mentions vanilla JavaScript authentication.
28