The Executor cloud host implements a multi-tenant authentication system designed for high isolation and secure resource scoping. It integrates WorkOS AuthKit for identity management, utilizing sealed session cookies for browser-based access and JWT/API Key authentication for programmatic and CLI access.
The system is built on the Effect framework, ensuring that authentication state is propagated through the request lifecycle via the IdentityProvider service.
The cloud host supports three primary authentication vectors:
wos-session apps/cloud/src/auth/workos.ts11device-login flow (OAuth 2.0 Device Authorization Grant) apps/cloud/src/auth/api.ts47-56The WorkOSAuthProvider serves as the central adapter. It folds various resolution strategies into a single authenticate call consumed by the ExecutionStackMiddleware apps/cloud/src/auth/workos-auth-provider.ts1-7
Sources: apps/cloud/src/auth/workos-auth-provider.ts107-160 apps/cloud/src/auth/workos.ts157-180
Executor Cloud enforces strict organization-scoped access control. A Principal (the authenticated entity) must be associated with an organizationId to access protected resources like Tools, Integrations, and Policies apps/cloud/src/auth/workos-auth-provider.ts136-145
For browser sessions, the active organization is determined by the ORG_SELECTOR_HEADER or the URL slug (e.g., /my-org/tools). The authorizeOrganizationSelector function validates that the authenticated accountId has membership in the requested organizationId or slug apps/cloud/src/auth/handlers.ts101-120
| Component | Responsibility | Code Reference |
|---|---|---|
CloudAuthApi | Endpoints for org switching, creation, and invites. | apps/cloud/src/auth/api.ts174-207 |
UserStoreService | Drizzle-backed store for mapping users to organizations. | apps/cloud/src/auth/context.ts23-29 |
authorizeOrganization | Validates account-to-org membership in Postgres. | apps/cloud/src/auth/organization.ts46-49 |
Sources: apps/cloud/src/auth/handlers.ts101-120 apps/cloud/src/auth/api.ts174-207
The WorkOSClient (provided via WorkOS from @workos-inc/node/worker) handles the heavy lifting of OAuth flows and session sealing.
WORKOS_COOKIE_PASSWORD. If a session is expired but valid, the system attempts a background refresh apps/cloud/src/auth/workos.ts184-200nonce and returnTo path into a wos-login-state cookie apps/cloud/src/auth/handlers.ts169-179DbService)In Cloudflare Workers, I/O objects cannot be shared across requests. The DbService uses postgres.js with max: 1 to ensure fresh TCP sockets per request apps/db/db.ts53-68
Sources: apps/cloud/src/db/db.ts138-141 apps/cloud/src/auth/context.ts39-42
Multi-tenancy is also enforced via seat limits managed by the AutumnService.
AccountHttpApi refuses invitations with a 403 Forbidden if the seat count (including pending invites) exceeds the limit e2e/cloud/member-invite-seat-limit.test.ts113-124Sources: e2e/cloud/member-invite-seat-limit.test.ts28-124 e2e/cloud/billing-trial-checkout-stale.test.ts74-82
The Model Context Protocol (MCP) plane uses a specialized auth provider that shares the same looksLikeJwt discriminator as the main API apps/cloud/src/auth/workos-auth-provider.ts105 It validates tokens specifically for MCP sessions, ensuring that tool invocations are correctly attributed to the owning organization and account.
Sources: apps/cloud/src/auth/workos-auth-provider.ts102-105 apps/cloud/src/mcp/auth.ts1-10