WorkOS Offers Relay to Keep AI Agent API Credentials Out of Context

What changed

WorkOS is offering Relay, an early-access service that routes an AI agent’s API calls through WorkOS, attaches credentials server-side and limits requests to approved provider hosts. Its related Pipes service handles OAuth, token refresh and encrypted credential storage.

Why it matters

The practical idea is simple: keep powerful tokens out of the agent’s working context. An agent reading a webpage, Jira comment or inbox may encounter instructions planted by an attacker; if credentials sit in that same process, those tokens are exposed alongside the content.

Relay could reduce that particular blast radius by separating the agent from the credentials it needs. But it is not a complete security boundary. WorkOS says permissions and other outbound paths still need separate controls, and there is no adoption, security-testing, performance or incident data yet. The sensible view is an early-access building block, not proof that prompt injection or unauthorized actions have been solved.