From f1d6a983cc03ecafb8c8c80e6b5a9c7a68bb54d7 Mon Sep 17 00:00:00 2001
From: jonatas <jonatascastro12@gmail.com>
Date: Mon, 1 Jun 2026 14:09:58 +0000
Subject: [PATCH 1/2] feat: Forward endpoint URL to migrations package

Resolve the active environment's API base URL and pass it via
WORKOS_API_URL env var so the migrations package respects custom
endpoints (staging, self-hosted, etc.).

Resolves ENT-6103

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 src/bin.ts                      |  4 ++--
 src/commands/migrations.spec.ts | 11 +++++++++++
 src/commands/migrations.ts      |  5 ++++-
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/src/bin.ts b/src/bin.ts
index a8204a9f..31cd1c56 100644
--- a/src/bin.ts
+++ b/src/bin.ts
@@ -2408,10 +2408,10 @@ yargs(rawArgs)
         }),
     async (argv) => {
       await applyInsecureStorage(argv.insecureStorage);
-      const { resolveOptionalApiKey } = await import('./lib/api-key.js');
+      const { resolveOptionalApiKey, resolveApiBaseUrl } = await import('./lib/api-key.js');
       const { getMigrationsPassthroughArgs, runMigrations } = await import('./commands/migrations.js');
       const passthrough = getMigrationsPassthroughArgs(rawArgs);
-      await runMigrations(passthrough, resolveOptionalApiKey({ apiKey: argv.apiKey }));
+      await runMigrations(passthrough, resolveOptionalApiKey({ apiKey: argv.apiKey }), resolveApiBaseUrl());
     },
   )
   .command(
diff --git a/src/commands/migrations.spec.ts b/src/commands/migrations.spec.ts
index 3d94b7ac..1dbc873f 100644
--- a/src/commands/migrations.spec.ts
+++ b/src/commands/migrations.spec.ts
@@ -13,6 +13,7 @@ describe('runMigrations', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     delete process.env.WORKOS_SECRET_KEY;
+    delete process.env.WORKOS_API_URL;
   });
 
   it('sets WORKOS_SECRET_KEY from the provided API key', async () => {
@@ -42,6 +43,16 @@ describe('runMigrations', () => {
     expect(mockParseAsync).toHaveBeenCalledWith(args, { from: 'user' });
   });
 
+  it('sets WORKOS_API_URL when apiBaseUrl is provided', async () => {
+    await runMigrations(['import', '--csv', 'users.csv'], 'sk_test_123', 'https://api.staging.workos.com');
+    expect(process.env.WORKOS_API_URL).toBe('https://api.staging.workos.com');
+  });
+
+  it('does not set WORKOS_API_URL when apiBaseUrl is undefined', async () => {
+    await runMigrations(['import', '--csv', 'users.csv'], 'sk_test_123');
+    expect(process.env.WORKOS_API_URL).toBeUndefined();
+  });
+
   it('removes WorkOS global flags from migrations passthrough args', () => {
     expect(
       getMigrationsPassthroughArgs([
diff --git a/src/commands/migrations.ts b/src/commands/migrations.ts
index 475b911a..9e39e58b 100644
--- a/src/commands/migrations.ts
+++ b/src/commands/migrations.ts
@@ -43,10 +43,13 @@ export function getMigrationsPassthroughArgs(rawArgs: string[]): string[] {
   return passthrough;
 }
 
-export async function runMigrations(args: string[], apiKey?: string): Promise<void> {
+export async function runMigrations(args: string[], apiKey?: string, apiBaseUrl?: string): Promise<void> {
   if (apiKey) {
     process.env.WORKOS_SECRET_KEY = apiKey;
   }
+  if (apiBaseUrl) {
+    process.env.WORKOS_API_URL = apiBaseUrl;
+  }
 
   const { program } = (await import('@workos/migrations/dist/cli/index.js')) as {
     program: {

From 72a874fac752b9ab2e3ab1aab58c91179d88812b Mon Sep 17 00:00:00 2001
From: jonatas <jonatascastro12@gmail.com>
Date: Mon, 1 Jun 2026 14:14:26 +0000
Subject: [PATCH 2/2] fix: Only set WORKOS_API_URL for custom endpoints

Avoid clobbering a user-set WORKOS_API_URL env var when no custom
endpoint is configured. Use getActiveEnvironment()?.endpoint which
returns undefined when no custom endpoint exists.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 src/bin.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/bin.ts b/src/bin.ts
index 31cd1c56..109ebd10 100644
--- a/src/bin.ts
+++ b/src/bin.ts
@@ -2408,10 +2408,12 @@ yargs(rawArgs)
         }),
     async (argv) => {
       await applyInsecureStorage(argv.insecureStorage);
-      const { resolveOptionalApiKey, resolveApiBaseUrl } = await import('./lib/api-key.js');
+      const { resolveOptionalApiKey } = await import('./lib/api-key.js');
+      const { getActiveEnvironment } = await import('./lib/config-store.js');
       const { getMigrationsPassthroughArgs, runMigrations } = await import('./commands/migrations.js');
       const passthrough = getMigrationsPassthroughArgs(rawArgs);
-      await runMigrations(passthrough, resolveOptionalApiKey({ apiKey: argv.apiKey }), resolveApiBaseUrl());
+      const endpoint = getActiveEnvironment()?.endpoint;
+      await runMigrations(passthrough, resolveOptionalApiKey({ apiKey: argv.apiKey }), endpoint);
     },
   )
   .command(