descope/descope-auth
skills/descope-auth/SKILL.md
Integrate Descope authentication into applications. Use when implementing login, signup, passwordless auth (OTP, Magic Link, Passkeys), OAuth, SSO, or MFA. Detects framework and provides targeted guidance.
$ install --global
skillsauthnpx skillsauth add descope/skills descope-authInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 13, 2026, 3:18 AM244.5s4 files scanned
SKILL.md
- name:
- descope-auth
- description:
- Integrate Descope authentication into applications. Use when implementing login, signup, passwordless auth (OTP, Magic Link, Passkeys), OAuth, SSO, or MFA. Detects framework and provides targeted guidance.
Descope Authentication
Integrate secure, passwordless authentication using Descope Flows and SDKs.
Framework Detection
Detect the user's framework and use the appropriate reference:
| If project has... | Use reference |
|-------------------|---------------|
| next in package.json | references/nextjs.md |
| react (no Next.js) | references/react.md |
| Python/Node.js backend only | references/backend.md |
Quick Start (all frameworks)
- Get Project ID from https://app.descope.com/settings/project
- Set environment variable:
NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id> - Follow framework-specific reference
- Verify: After setup, confirm the
<Descope>component renders the login form. Check the browser console — a missing or invalid Project ID produces a clearCould not load flowserror.
Minimal Inline Example (Next.js)
// src/app/login/page.tsx
import { Descope } from '@descope/nextjs-sdk';
export default function LoginPage() {
return (
<Descope
flowId="sign-up-or-in"
onSuccess={(e) => console.log('Authenticated:', e.detail.user)}
onError={(e) => console.error('Auth failed:', e.detail)}
/>
);
}
For React SPA or backend-only setups, see the framework-specific references below.
Valid Flow IDs (CRITICAL - do not invent others)
| Flow ID | Purpose |
|---------|---------|
| sign-up-or-in | Combined signup/login (RECOMMENDED) |
| sign-up | Registration only |
| sign-in | Login only |
| step-up | MFA step-up authentication |
| update-user | Profile updates, add auth methods |
Authentication Methods
| Method | When to use | |--------|-------------| | OTP (Email/SMS) | Quick verification codes | | Magic Link | Passwordless email links | | Passkeys | Biometric/WebAuthn (most secure) | | OAuth | Social login (Google, GitHub, etc.) | | SSO | Enterprise SAML/OIDC | | Passwords | Traditional auth (not recommended) |
DO NOT (Security Guardrails)
- DO NOT parse JWTs manually - always use SDK's
validateSession() - DO NOT store tokens in localStorage - SDK handles this securely
- DO NOT invent flow IDs - only use IDs from the table above
- DO NOT skip server-side validation - always validate on backend
- DO NOT expose DESCOPE_MANAGEMENT_KEY in client code
References
references/nextjs.md- Next.js App Router integrationreferences/react.md- React SPA integrationreferences/backend.md- Backend session validation
Related Skills
descope/workos-to-descope
development
VerifiedTrustedCommunity
Use this skill whenever anyone asks about migrating from WorkOS to Descope — whether they're a developer doing it themselves or a technical lead evaluating the move. Triggers on: "how do I migrate from WorkOS", "replace WorkOS with Descope", "we're moving off WorkOS", "WorkOS to Descope", "switch from WorkOS", "our app uses @workos-inc/node / @workos-inc/authkit-nextjs / AuthKit / WorkOS SSO / Directory Sync / SCIM and we want to use Descope instead", or any question about WorkOS features (AuthKit, Organizations, Enterprise SSO, Directory Sync/SCIM, Admin Portal, RBAC, FGA, Audit Logs, Radar, Pipes) in the context of Descope. Works for any language or framework with a Descope SDK. Always use this skill before producing migration guidance — do not rely on memory alone.
9SKILL.mdUpdated Jun 13, 2026
descope/descope-byos-builder
development
VerifiedTrustedCommunity
Use when building React "Bring Your Own Screen" (BYOS) custom UI on top of a Descope flow — takes exported flow JSONs, extracts the real interaction IDs and outputs, generates BYOS components that match hosted parity, and avoids the rediscovery-the-hard-way failure modes (silent form rejection, shared screen-name collisions, anonymous-session stickiness, nested-form hydration errors, wrong form keys, dead-end buttons, missing OAuth provider field).
7SKILL.mdUpdated May 30, 2026
descope/okta-cis-to-descope
development
VerifiedTrustedCommunity
Use this skill whenever anyone asks about migrating from Okta Customer Identity Service (CIS) to Descope — whether they're a developer doing it themselves or a technical lead evaluating the move. Triggers on: "how do I migrate from Okta", "replace Okta CIS with Descope", "we're moving off Okta", "Okta to Descope", "switch from Okta", "our app uses okta-auth-js / @okta/okta-react / @okta/okta-angular / @okta/oidc-middleware / okta-jwt-verifier and we want to use Descope instead", or any question about Okta CIS features (Sign-On Policies, Authorization Servers, Authenticators, Identity Providers, Log Streams, Service Apps, scp claim) in the context of Descope. Works for any language or framework with a Descope SDK. Always use this skill before producing migration guidance — do not rely on memory alone.
7SKILL.mdUpdated May 28, 2026
descope/descope-terraform
development
VerifiedTrustedCommunity
Set up and manage Descope projects with Terraform. Use when configuring authentication infrastructure as code, managing environments, creating roles/permissions, setting up connectors, or deploying Descope project configurations.
6SKILL.mdUpdated May 13, 2026