Introducing Mastra Studio-scoped SSO

You can now bring your own auth to Mastra Studio, letting your team sign in using a preferred SSO provider. Support includes WorkOS, Okta, Auth0, Clerk, and Google.

Often teams want to separate out auth for Mastra’s server vs Studio, where external users of the agent have access to the server, but team members have access to Studio. Now, you can do that easier.

Previously, you could configure SSO on the server, and Studio would inherit it, but there was no separate SSO permissioning available for the Studio.

Set MASTRA_PLATFORM_STUDIO_AUTH=disabled to replace the default platform sign-in with your studio.auth provider. Disabling platform sign-in without configuring studio.auth or server.auth leaves Studio publicly accessible.

Auth matrix

How each combination of settings protects Studio on Mastra platform:

Get started

Install an auth provider package. This example uses WorkOS:

npm install @mastra/auth-workos@latest

Add the provider to studio.auth in your Mastra config. server.auth stays separate and protects your server endpoints:

import { Mastra } from "@mastra/core/mastra";
import { MastraAuthWorkos } from "@mastra/auth-workos";
 
export const mastra = new Mastra({
  server: {
    auth: /* ... */
  },
  studio: {
    auth: new MastraAuthWorkos()
  },
  // ...
});

Add the provider credentials and disable platform auth in your .env:

WORKOS_API_KEY=
WORKOS_CLIENT_ID=
WORKOS_REDIRECT_URI=
WORKOS_COOKIE_PASSWORD=
MASTRA_PLATFORM_STUDIO_AUTH=disabled

For more information and full configuration options, see:

• Bring your own auth
• Studio auth
• Auth overview
• WorkOS
• mastra deploy