# WorkOS: Major incident: Degraded AuthKit Behavior

**Summary:** WorkOS reported major AuthKit degradation causing intermittent errors from 2025-12-29 12:26 UTC to 2025-12-29 14:13 UTC, lasting 1 h 47 min. DDoS protection mitigated an attack but produced false positives, causing intermittent 404s for end users; WorkOS adjusted rule sensitivity and marked the incident resolved. _(machine-written, sol)_
- Kind: Major incident · Label: degradation (model (Jev))
- Changed: 2025-12-29 12:26 UTC · Detected: 2026-10-17 18:22 UTC
- [Source: https://stspg.io/dl942ydpcbzd](https://stspg.io/dl942ydpcbzd)
- [Company: WorkOS](https://rewindex.com/company/workos.md)
- Versions: before (none: first archived) → after incident\_version:324/zrjsy0n4fm2n@9384c7c84c94
- Change 1 of 1 for this incident

## What changed

**1. Added: Title**

```diff
+ Degraded AuthKit Behavior
```

**2. Added: Impact**

```diff
+ major
```

**3. Added: Status**

```diff
+ resolved
```

**4. Added: Start time**

```diff
+ 2025-12-29 12:26 UTC
```

**5. Added: Resolved time**

```diff
+ 2025-12-29 14:13 UTC
```

**6. Added: Affected components**

```diff
+ Audit Logs, AuthKit, Core Services - Audit Logs, Core Services - AuthKit
```

**7. Added: Update** (monitoring) · 2025-12-29 12:26 UTC

```diff
+ We are seeing degraded performance of AuthKit resulting in intermittent errors.  The error rate has improved and we are monitoring.
```

**8. Added: Update** (resolved) · 2025-12-29 14:13 UTC

```diff
+ Our DDOS protection mitigated an attack but also resulted in false positives causing end users to see intermittent 404s. We have adjusted the sensitivity of these rules to prevent further false positives.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2025-12-29 12:26 UTC | Major incident: Degraded AuthKit Behavior (this change) | degradation |

All WorkOS changes: [timeline](https://rewindex.com/company/workos/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i681c6afa4716d7 · Markdown: https://rewindex.com/change/i681c6afa4716d7.md · JSON: https://rewindex.com/api/v1/changes/i681c6afa4716d7 · Generated 2026-10-18T03:55:51.368Z