tomevault-io Descope Authentication
Integrate secure, passwordless authentication using Descope Flows and SDKs.
Framework Detection
Detect the user's framework and use the appropriate reference:
| If project has... | Use reference |
|---|---|
next in package.json |
references/nextjs.md |
react (no Next.js) |
references/react.md |
| Python/Node.js backend only | references/backend.md |
Quick Start (all frameworks)
- Get Project ID from https://app.descope.com/settings/project
- Set environment variable:
NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id> - Follow framework-specific reference
Valid Flow IDs (CRITICAL - do not invent others)
| Flow ID | Purpose |
|---|---|
sign-up-or-in |
Combined signup/login (RECOMMENDED) |
sign-up |
Registration only |
sign-in |
Login only |
step-up |
MFA step-up authentication |
update-user |
Profile updates, add auth methods |
Authentication Methods
| Method | When to use |
|---|---|
| OTP (Email/SMS) | Quick verification codes |
| Magic Link | Passwordless email links |
| Passkeys | Biometric/WebAuthn (most secure) |
| OAuth | Social login (Google, GitHub, etc.) |
| SSO | Enterprise SAML/OIDC |
| Passwords | Traditional auth (not recommended) |
DO NOT (Security Guardrails)
- DO NOT parse JWTs manually - always use SDK's
validateSession() - DO NOT store tokens in localStorage - SDK handles this securely
- DO NOT invent flow IDs - only use IDs from the table above
- DO NOT skip server-side validation - always validate on backend
- DO NOT expose DESCOPE_MANAGEMENT_KEY in client code
References
references/nextjs.md- Next.js App Router integrationreferences/react.md- React SPA integrationreferences/backend.md- Backend session validation
Converted and distributed by TomeVault — claim your Tome and manage your conversions.