Mastra Studio adds its own SSO authentication
Mastra's blog announced that Mastra Studio now supports bring-your-own authentication, letting teams sign in with a preferred SSO provider; supported options include WorkOS, Okta, Auth0, Clerk and Google. Previously SSO could be configured on the server and inherited by Studio, but there was no separate Studio-level permissioning; now server.auth and studio.auth can be set independently so external agent users reach the server while team members reach Studio. Setup requires setting MASTRA_PLATFORM_STUDIO_AUTH=disabled with a configured studio.auth provider and @mastra/core 1.42.0 or later, and Mastra warns that disabling platform sign-in without configuring studio.auth or server.auth leaves Studio publicly accessible.
The change lets teams keep Studio access restricted separately from the authentication that protects server endpoints, where before Studio only inherited the server's SSO configuration.
You can now bring your own auth to Mastra Studio, letting your team sign in using a preferred SSO provider. Support includes WorkOS, Okta, Auth0, Clerk, and Google.
Often teams want to separate out auth for Mastra’s server vs Studio, where external users of the agent have access to the server, but team members have access to Studio. Now, you can do that easier.
Your browser does not support the video tag.
Previously, you could configure SSO on the server, and Studio would inherit it, but there was no separate SSO permissioning available for the Studio.
Set MASTRA_PLATFORM_STUDIO_AUTH=disabled to replace the default platform sign-in with your studio.auth provider. Disabling platform sign-in without configuring studio.auth or server.auth leaves Studio publicly accessible.
Auth matrix
How each combination of settings protects Studio on Mastra platform: