v8.0.0

What's Changed

• chore(deps): update jest monorepo by @renovate[bot] in #832
• Release v8.0.0: Universal Runtime Support & API Modernization by @nicknisi in #1370

Breaking Change

This is a breaking change that drops support for Node 16 and Node 18.

✨ New Features

PKCE Authentication for Public Clients
• API key is now optional - initialize with just clientId for public client apps
• New getAuthorizationUrlWithPKCE() method generates PKCE challenge internally
• authenticateWithCode() auto-detects client mode (public vs confidential)
• New createWorkOS() factory with compile-time type safety - TypeScript errors if you use server-only methods on public clients
• Use case: Build mobile apps, desktop apps, SPAs with secure WorkOS auth without exposing API keys

Universal Runtime Support
• SDK now works seamlessly across Node.js, Deno, Bun, and Cloudflare Workers
• Runtime-specific exports automatically detected via package.json conditions
• Dual build strategy: ESM unbundled (optimal tree-shaking), CJS inlines ESM-only deps
• No more lib/node_modules/ issues that broke Electron packaging

Better TypeScript Types
• SSO authorization options now use discriminated unions (must specify exactly one of: connection, organization, or provider)
• Public vs confidential client types enforced at compile time
• Improved type inference across the board

🔥 Most Exciting Changes

1. You can now build mobile/desktop apps with WorkOS - PKCE support means no backend proxy needed for client apps
2. Deploy to Cloudflare Workers/edge - Full edge runtime support with proper exports
3. Type-safe public clients - TypeScript catches security mistakes at compile time
4. Works everywhere - Node, Deno, Bun, Workers all tested and verified

⚠️ Breaking Changes

Minimum Node.js version: 20+ (Node 16 and 18 both have reached EOL)

Removed deprecated methods:
• Vault: createSecret() → use createObject()
• Vault: listSecrets() → use listObjects()
• Vault: readSecret() → use readObject()
• Vault: updateSecret() → use updateObject()
• Vault: deleteSecret() → use deleteObject()
• MFA: verifyFactor() → use verifyChallenge()
• User Management: sendMagicAuthCode() → use sendMagicCode()

API Changes:
• listOrganizationMemberships() now requires userId OR organizationId
• Directory Sync: user fields moved to customAttributes (e.g., user.customAttributes?.emails)
• SSO: stricter types - must specify one of connection, organization, or provider (not multiple)
• Organizations: removed allowProfilesOutsideOrganization and domains fields
• Events: dsync.deactivated → dsync.deleted

Package structure:
• Now ESM-first with dual CJS/ESM exports
• Removed internal HTTP/crypto provider classes (public API unchanged)

• Install: npm install @workos-inc/node@8
• Migration Guide: V8_MIGRATION_GUIDE.md

Questions? Hit me up!

Full Changelog: v7.82.0...v8.0.0