nejcblotout

<p>Blotout EdgeTag is a Personalization Platform for Growth Marketers. We enable the restoration of ID when cookies are deprecated. Our current offering allows advertisers to restore post-iOS identity issues and stitch users across devices when consented.</p>


Blotout EdgeTag

Blotout EdgeTag is a Personalization Platform for Growth Marketers. Allows advertisers to restore identity issues and stitch users when consented.

Gustavo Bordoni

<p>Integration with WorkOS connects your WordPress site with <a href="https://workos.com" rel="nofollow ugc">WorkOS</a> for enterprise-grade identity management.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.2 or higher</li>
<li>PHP 7.4 or higher</li>
<li>A <a href="https://workos.com" rel="nofollow ugc">WorkOS</a> account with API credentials</li>
</ul>
<h4>Custom AuthKit</h4>
<ul>
<li><strong>WordPress-hosted React login</strong> — no redirect to WorkOS for password, magic code, signup, invitation, or MFA. Mounts on wp-login.php, a shortcode (<code>[workos:login]</code>), and a dedicated <code>/workos/login/{profile}</code> route.</li>
<li><strong>Login Profiles</strong> — admin-defined presets (enabled sign-in methods, pinned organization, signup/invite toggles, MFA policy, branding) edited from <strong>WorkOS <span aria-hidden="true" class="wp-exclude-emoji">→</span> Login Profiles</strong>. The organization picker loads live from WorkOS so admins pick an org by name instead of pasting raw IDs.</li>
<li><strong>Per-profile custom URL paths</strong> — assign any profile its own URL (e.g. <code>/members</code>, <code>/team/login</code>) on top of the canonical <code>/workos/login/{profile}</code> rewrite. When the default profile owns a custom path, <code>/wp-login.php</code> 302s to it (preserving every inbound query arg). Reserved core paths can’t be claimed.</li>
<li><strong>Already-signed-in handling</strong> — visitors who hit any AuthKit surface while logged in are 302’d to their post-login destination (or, in the shortcode, see an inline “You’re already signed in” notice with a Continue link).</li>
<li><strong><code>forward_query_args</code> per-profile toggle</strong> — opt-in passing of marketing/analytics query args (<code>utm_*</code>, <code>ref</code>, etc.) onto the post-login destination. WP and plugin internals are always stripped.</li>
<li><strong>Sign-in methods</strong> — email + password, magic code, social OAuth (Google, Microsoft, GitHub, Apple), and passkey. Each profile chooses its own subset.</li>
<li><strong>MFA</strong> — TOTP, SMS, and WebAuthn/passkey with in-app enrollment + challenge. Profile-level <code>mfa.enforce</code> (<code>never</code>/<code>if_required</code>/<code>always</code>) and factor allowlist are applied at login time.</li>
<li><strong>Self-serve sign-up + invitation acceptance + in-app password reset</strong> — all handled by the React shell; no third-party pages.</li>
<li><strong>Branding controls</strong> — per-profile heading, subheading, primary color (with WordPress admin-color presets), and logo with a three-mode toggle (<code>default</code> falls back to the Site Icon then a bundled WP logo, <code>custom</code> uses the chosen image, <code>none</code> hides the logo).</li>
<li><strong>Embed & URLs in the editor</strong> — every Login Profile shows copyable input fields for its canonical URL, optional custom-path URL, and shortcode so admins can paste them into pages or share them with users.</li>
<li><strong>WorkOS Radar</strong> anti-fraud integration optional via <code>WORKOS_RADAR_SITE_KEY</code>.</li>
<li><strong>Profile routing rules</strong> — send incoming logins to a specific profile based on <code>redirect_to</code>, referrer host, or user role.</li>
</ul>
<h4>Authentication</h4>
<ul>
<li><strong>Single Sign-On (SSO)</strong> — legacy AuthKit redirect mode, per-profile selectable for SAML/OIDC connections.</li>
<li><strong>Headless mode</strong> — intercept WordPress’s <code>authenticate</code> filter for custom login forms.</li>
<li><strong>Legacy Login Button</strong> — Gutenberg block and classic widget (AuthKit-redirect flow).</li>
<li><strong>Login Bypass</strong> — Access the native WordPress login form via <code>?fallback=1</code> when WorkOS is unavailable.</li>
<li><strong>Password Reset Integration</strong> — Redirect password reset to WorkOS or fall back to WordPress.</li>
<li><strong>Registration Redirect</strong> — Redirect registration to WorkOS AuthKit.</li>
<li><strong>REST API Authentication</strong> — Verify WorkOS access tokens for headless/API usage.</li>
</ul>
<h4>User & Organization Management</h4>
<ul>
<li><strong>Directory Sync</strong> — Automatic user provisioning and deprovisioning via SCIM.</li>
<li><strong>Role Mapping</strong> — Map WorkOS organization roles to WordPress roles.</li>
<li><strong>Organization Management</strong> — Multi-tenant organization support.</li>
<li><strong>Entitlement Gate</strong> — Require organization membership to log in.</li>
</ul>
<h4>Redirects</h4>
<ul>
<li><strong>Role-Based Login Redirects</strong> — Send users to different URLs after login based on their WordPress role.</li>
<li><strong>Role-Based Logout Redirects</strong> — Send users to different URLs after logout based on their WordPress role.</li>
</ul>
<h4>Admin Tools</h4>
<ul>
<li><strong>Activity Logging</strong> — Local database table with admin viewer for tracking authentication and sync events.</li>
<li><strong>Audit Logging</strong> — Forward WordPress events to WorkOS Audit Logs.</li>
<li><strong>Diagnostics Page</strong> — System health checks, configuration status, and connectivity tests.</li>
<li><strong>Onboarding Wizard</strong> — Guided setup for initial plugin configuration and user sync.</li>
<li><strong>Admin Bar Badge</strong> — Shows the active WorkOS environment in the admin bar.</li>
<li><strong>WP-CLI Commands</strong> — Full CLI access for scripting, bulk operations, and diagnostics.</li>
</ul>
<h4>Privacy & Security</h4>
<p>This plugin transmits user data (email, name) to WorkOS for authentication and directory sync. No data is sent until you configure API credentials and users authenticate. API keys are stored in the WordPress database or can be defined as constants in wp-config.php. See the “External services” section for full details on data transmitted.</p>
<h3>Support</h3>
<ul>
<li><a href="https://github.com/bordoni/integration-workos" rel="nofollow ugc">Documentation & Source Code</a></li>
<li><a href="https://github.com/bordoni/integration-workos/issues" rel="nofollow ugc">Report a Bug</a></li>
<li><a href="https://workos.com/docs" rel="nofollow ugc">WorkOS Documentation</a></li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the <a href="https://workos.com" rel="nofollow ugc">WorkOS API</a> (<code>https://api.workos.com</code>) to provide enterprise identity management features for WordPress.</p>
<h4>Authentication (SSO)</h4>
<p>When a user logs in via WorkOS AuthKit or headless mode, the plugin sends an authorization code (and, in headless mode, the user’s email and password) to WorkOS to exchange for user identity data and access tokens. This happens each time a user authenticates through WorkOS.</p>
<h4>User Management</h4>
<p>When the site administrator creates, updates, or syncs users between WordPress and WorkOS, the plugin sends user profile data (email, first name, last name) to the WorkOS API.</p>
<h4>Directory Sync</h4>
<p>The plugin receives incoming webhook requests from WorkOS containing directory and user data for automatic provisioning and deprovisioning. The webhook endpoint URL is registered with WorkOS by the site administrator.</p>
<h4>Organization Management</h4>
<p>When managing organizations, the plugin sends and retrieves organization data (name, membership details, role assignments) to and from the WorkOS API.</p>
<h4>Audit Logging</h4>
<p>When audit logging is enabled, the plugin sends WordPress event data (action performed, actor, target, and metadata) to the WorkOS Audit Logs API on each tracked event.</p>
<h4>Token Verification</h4>
<p>When REST API authentication is enabled, the plugin fetches JSON Web Key Sets (JWKS) from WorkOS (<code>https://api.workos.com/sso/jwks/{client_id}</code>) to verify access tokens. The JWKS response is cached locally for one hour.</p>
<h4>Service links</h4>
<p>WorkOS is provided by WorkOS, Inc.</p>
<ul>
<li><a href="https://workos.com/legal/terms" rel="nofollow ugc">Terms of Service</a></li>
<li><a href="https://workos.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a></li>
</ul>


Integration with WorkOS

Enterprise identity management for WordPress powered by WorkOS. SSO, directory sync, MFA, and user management.

Blotout EdgeTag vs Integration with WorkOS