Mastra Studio 新增獨立 SSO 設定

You can now bring your own auth to Mastra Studio, letting your team sign in using a preferred SSO provider. Support includes WorkOS, Okta, Auth0, Clerk, and Google.

Often teams want to separate out auth for Mastra’s server vs Studio, where external users of the agent have access to the server, but team members have access to Studio. Now, you can do that easier.

Previously, you could configure SSO on the server, and Studio would inherit it, but there was no separate SSO permissioning available for the Studio.

Set MASTRA_PLATFORM_STUDIO_AUTH=disabled to replace the default platform sign-in with your studio.auth provider. Disabling platform sign-in without configuring studio.auth or server.auth leaves Studio publicly accessible.

Auth matrix

How each combination of settings protects Studio on Mastra platform:

`MASTRA_PLATFORM_STUDIO_AUTH`	`studio.auth`	`server.auth`	Studio login
not set	any	any	Platform sign-in
`disabled`	set	any	`studio.auth`
`disabled`	not set	set	`server.auth`
`disabled`	not set	not set	None (public)

Get started

Install an auth provider package. This example uses WorkOS:

npm install @mastra/auth-workos@latest

note

Requires @mastra/core@1.42.0 or later, added in PR #17722.

Add the provider to studio.auth in your Mastra config. server.auth stays separate and protects your server endpoints:

import { Mastra } from "@mastra/core/mastra";
import { MastraAuthWorkos } from "@mastra/auth-workos";
 
export const mastra = new Mastra({
  server: {
    auth: /* ... */
  },
  studio: {
    auth: new MastraAuthWorkos()
  },
  // ...
});

Add the provider credentials and disable platform auth in your .env:

WORKOS_API_KEY=
WORKOS_CLIENT_ID=
WORKOS_REDIRECT_URI=
WORKOS_COOKIE_PASSWORD=
MASTRA_PLATFORM_STUDIO_AUTH=disabled

For more information and full configuration options, see: