How do I install the Descope Auth skill?

Run npx skillmds@latest add descope/descope-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Descope Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Descope Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Descope Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Descope Auth?

descope (@descope) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Descope Auth by descope — Agent Skill

Name: Descope Auth
Author: descope

File contents

Descope Authentication

Integrate secure, passwordless authentication using Descope Flows and SDKs.

Framework Detection

Detect the user's framework and use the appropriate reference:

If project has...	Use reference
`next` in package.json	`references/nextjs.md`
`react` (no Next.js)	`references/react.md`
Python/Node.js backend only	`references/backend.md`

Quick Start (all frameworks)

Get Project ID from https://app.descope.com/settings/project
Set environment variable: NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id>
Follow framework-specific reference
Verify: After setup, confirm the <Descope> component renders the login form. Check the browser console — a missing or invalid Project ID produces a clear Could not load flows error.

Minimal Inline Example (Next.js)

// src/app/login/page.tsx
import { Descope } from '@descope/nextjs-sdk';

export default function LoginPage() {
  return (
    <Descope
      flowId="sign-up-or-in"
      => console.log('Authenticated:', e.detail.user)}
      => console.error('Auth failed:', e.detail)}
    />
  );
}

For React SPA or backend-only setups, see the framework-specific references below.

Valid Flow IDs (CRITICAL - do not invent others)

Flow ID	Purpose
`sign-up-or-in`	Combined signup/login (RECOMMENDED)
`sign-up`	Registration only
`sign-in`	Login only
`step-up`	MFA step-up authentication
`update-user`	Profile updates, add auth methods

Authentication Methods

Method	When to use
OTP (Email/SMS)	Quick verification codes
Magic Link	Passwordless email links
Passkeys	Biometric/WebAuthn (most secure)
OAuth	Social login (Google, GitHub, etc.)
SSO	Enterprise SAML/OIDC
Passwords	Traditional auth (not recommended)

DO NOT (Security Guardrails)

DO NOT parse JWTs manually - always use SDK's validateSession()
DO NOT store tokens in localStorage - SDK handles this securely
DO NOT invent flow IDs - only use IDs from the table above
DO NOT skip server-side validation - always validate on backend
DO NOT expose DESCOPE_MANAGEMENT_KEY in client code

References

references/nextjs.md - Next.js App Router integration
references/react.md - React SPA integration
references/backend.md - Backend session validation

---name: descope-authdescription: Integrate Descope authentication into applications. Use when implementing login, signup, passwordless auth (OTP, Magic Link, Passkeys), OAuth, SSO, or MFA. Detects framework and provides targeted guidance.---# Descope AuthenticationIntegrate secure, passwordless authentication using Descope Flows and SDKs.## Framework DetectionDetect the user's framework and use the appropriate reference:| If project has... | Use reference ||-------------------|---------------|| `next` in package.json | `references/nextjs.md` || `react` (no Next.js) | `references/react.md` || Python/Node.js backend only | `references/backend.md` |## Quick Start (all frameworks)1. Get Project ID from https://app.descope.com/settings/project2. Set environment variable: `NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id>`3. Follow framework-specific reference4. **Verify**: After setup, confirm the `<Descope>` component renders the login form. Check the browser console — a missing or invalid Project ID produces a clear `Could not load flows` error.### Minimal Inline Example (Next.js)```tsx// src/app/login/page.tsximport { Descope } from '@descope/nextjs-sdk';export default function LoginPage() { return ( <Descope flowId="sign-up-or-in" onSuccess={(e) => console.log('Authenticated:', e.detail.user)} onError={(e) => console.error('Auth failed:', e.detail)} /> );}```For React SPA or backend-only setups, see the framework-specific references below.## Valid Flow IDs (CRITICAL - do not invent others)| Flow ID | Purpose ||---------|---------|| `sign-up-or-in` | Combined signup/login (RECOMMENDED) || `sign-up` | Registration only || `sign-in` | Login only || `step-up` | MFA step-up authentication || `update-user` | Profile updates, add auth methods |## Authentication Methods| Method | When to use ||--------|-------------|| OTP (Email/SMS) | Quick verification codes || Magic Link | Passwordless email links || Passkeys | Biometric/WebAuthn (most secure) || OAuth | Social login (Google, GitHub, etc.) || SSO | Enterprise SAML/OIDC || Passwords | Traditional auth (not recommended) |## DO NOT (Security Guardrails)- DO NOT parse JWTs manually - always use SDK's `validateSession()`- DO NOT store tokens in localStorage - SDK handles this securely- DO NOT invent flow IDs - only use IDs from the table above- DO NOT skip server-side validation - always validate on backend- DO NOT expose DESCOPE_MANAGEMENT_KEY in client code## References- `references/nextjs.md` - Next.js App Router integration- `references/react.md` - React SPA integration - `references/backend.md` - Backend session validation

Frequently asked questions

Descope Auth