Descope

Project ID identifies the Descope project. Management keys provide full API access for user management and configuration. Client SDKs use the project ID for flow execution (client-side safe). Management keys are created in the console with configurable permissions. JWTs are returned on successful authentication for session management. JWKS endpoint provides public keys for JWT validation. Tenant-level settings enable per-customer auth configuration in multi-tenant applications. For agents, the project ID (client-side) and management key (server-side) separation is clean. The management key model is simpler than WorkOS or Stytch's auth models. No OAuth for API access.

REST API at api.descope.com/v1/. Flow execution: the visual builder generates flows that are triggered via SDK or API. Individual auth methods are also accessible via API: /otp/sign-in/email, /magiclink/sign-in/email, /oauth/authorize/{provider}. User management: /user/create, /user/load, /user/update. Tenant management for multi-tenant auth. Access keys for machine-to-machine authentication. Session management with JWT validation. The API supports both flow-driven (recommended — execute a visual flow) and direct (call individual auth methods) patterns. The flow-driven approach is unique: agents trigger a pre-designed auth flow and handle the response, while the flow builder manages the auth logic. This separation of auth logic from application code is Descope's main architectural proposition.

API errors return JSON with statusCode, errorDescription, and errorMessage. Flow execution errors include step-specific failure information. The visual flow builder provides a test mode for debugging auth flows without sending real OTPs or emails. User management errors include field-specific validation details. Rate limits are per-project with generous defaults on the free tier. The main reliability consideration: flows designed in the visual builder can have logic errors (missing conditional branches, incorrect step ordering) — the test mode helps catch these. OTP/magic link delivery depends on email/SMS provider availability. For agents, the flow test mode is the key debugging tool — it simulates the entire auth flow without side effects.

Descope combines a visual flow builder with a traditional API for authentication. For agents, the unique value is the Flow Builder: drag-and-drop design of authentication workflows that combine multiple methods (OTP, magic link, passkeys, social, SSO) with conditional logic, MFA steps, and custom actions. These flows execute via a single API endpoint. The REST API covers user management, access key management (machine-to-machine auth), tenant management, and auth method operations. The generous free tier (7,500 monthly active users) enables production use for smaller applications. For agents wanting to implement complex auth flows quickly — multi-factor with fallback methods, progressive profiling, conditional step-up authentication — the visual builder accelerates development. The trade-off: the visual builder creates vendor dependency for auth flow logic.

Documentation at docs.descope.com covers the Flow Builder, API reference, SDK guides, and integration patterns. The Flow Builder documentation includes visual guides for common auth patterns (passwordless onboarding, MFA setup, SSO connection). SDK documentation covers React, Angular, Vue, Next.js, Flutter, Swift, Kotlin, Python, Go, and Java. The API reference documents all endpoints with parameters and examples. The documentation effectively bridges visual (flow builder) and programmatic (API/SDK) approaches. Getting started guides are framework-specific with complete implementation examples. For agents, the Flow Builder tutorial and the server SDK quick start are the essential starting points. The documentation quality is good for the platform's maturity.