Uploaded July 2026 | Updated September 2026, 3 days ago
Reading data and deleting an account shouldn't get the same trust — Step-Up Auth makes sure they don't. AuthKit now gates a specific operation behind a fresh verification, keeps the session intact, and knows exactly when the user last proved it was them. The re-auth challenge matches however the user originally signed in — password prompt, or forced back through SSO. WorkOS
Watch it live: blocking (then approving) a money transfer in a demo banking app. Then the code behind it — every AuthKit token now carries an auth_time claim, the Unix timestamp of the user's last active authentication, and refresh tokens don't bump it. Pass max_age to /user_management/authorize to force re-authentication once a session passes your freshness threshold, and every step-up fires an authentication.reauthenticated event with the user ID, session ID, method used, and new auth_time. WorkOS + 2
Full writeup + code: workos.com/blog/step-up-authentication
Chapters
00:00 What step-up auth solves
01:55 Live demo: blocking a money transfer
02:35 The code: auth_time and re-auth events
Reading data and deleting an account shouldn't get the same trust — Step-Up Auth makes sure they don't. AuthKit now gates a specific operation behind a fresh verification, keeps the session intact, and knows exactly when the user last proved it was them. The re-auth challenge matches however the user originally signed in — password prompt, or forced back through SSO. WorkOS
Watch it live: blocking (then approving) a money transfer in a demo banking app. Then the code behind it — every AuthKit token now carries an auth_time claim, the Unix timestamp of the user's last active authentication, and refresh tokens don't bump it. Pass max_age to /user_management/authorize to force re-authentication once a session passes your freshness threshold, and every step-up fires an authentication.reauthenticated event with the user ID, session ID, method used, and new auth_time. WorkOS + 2
Full writeup + code: workos.com/blog/step-up-authentication
Chapters
00:00 What step-up auth solves
01:55 Live demo: blocking a money transfer
02:35 The code: auth_time and re-auth events
