Install Jentic One Beta

Connect the Descope API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Descope API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdescope.com%2Fdescope" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdescope.com%2Fdescope" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Descope API.

Run passwordless sign-up and sign-in over one-time codes, magic links, and enchanted links

Validate, refresh, and revoke user sessions

Read the current user's details and session history

Administer users, tenants, roles, and permissions in a project

Issue and exchange access keys for machine authentication

GET STARTED

Start building with Descope API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Descope API for, with concrete tasks.

★ Agent-Managed Authentication via Jentic

AI agents drive Descope authentication through Jentic without holding the project token in context. An agent searches by intent, receives the matching operation schema, and runs a passwordless flow or validates a session end to end. Jentic injects the bearer token at execution time, so the agent never sees the secret while it manages sign-in and sessions for a project.

Search Jentic for 'validate a Descope session', load the POST /v1/auth/validate schema, and check the session with Jentic-managed credentials

Passwordless Login Automation

An agent runs an end-to-end passwordless login: it starts a sign-in over a one-time code or magic link, waits for the user to confirm, verifies the token, and receives a session. Descope supports several factors, so the agent can pick the channel that fits the user and complete authentication without a password anywhere in the flow.

Call POST /v1/auth/magiclink/verify to confirm the token, then POST /v1/auth/validate to validate the resulting session

Session Lifecycle Control

An agent keeps a user's session healthy over a long-running task: it validates the session before each sensitive step, refreshes it as it nears expiry, and signs the user out when the task ends. Descope exposes explicit validate, refresh, and sign-out operations, so the agent controls the full session lifecycle rather than guessing at token state.

Call POST /v1/auth/refresh to extend a session, then POST /v1/auth/logout to sign the user out when done

Key Endpoints

240 endpoints — the descope api gives ai agents programmatic control over authentication and identity for a project.

METHOD

PATH

DESCRIPTION

POST

/v1/auth/enchantedlink/signin/email

Start a passwordless enchanted-link sign-in by email

POST

/v1/auth/magiclink/verify

Verify a magic link token and create a session

POST

/v1/auth/validate

Validate an active session

POST

/v1/auth/refresh

Refresh an expiring session

GET

/v1/auth/me

Read the current user's details

POST

/v1/auth/logout

Sign the current user out of their session

POST

/v1/auth/enchantedlink/signin/email

Start a passwordless enchanted-link sign-in by email

POST

/v1/auth/magiclink/verify

Verify a magic link token and create a session

POST

/v1/auth/validate

Validate an active session

POST

/v1/auth/refresh

Refresh an expiring session

GET

/v1/auth/me

Read the current user's details

POST

/v1/auth/logout

Sign the current user out of their session

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Descope API by hand means managing a project bearer token for each credential type, sequencing sign-up, verify, and validate calls, and handling refresh and revoke yourself. Through Jentic you install once, import the Descope API from the API Directory, store the token, and your agent calls it.

Permission scoping

You choose which Descope operations your agent may call, so a rule can allow session validation and user lookups while withholding user deletion, role edits, or access-key issuance. Scoping is by operation, so state-changing calls stay out unless you grant them.

Credential isolation

Your Descope bearer token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'validate a session' or 'refresh a token', and Jentic returns the matching Descope operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using Descope API through Jentic.

What authentication does the Descope API use?

The Descope API authenticates requests with a bearer token sent in the Authorization header, per its OpenAPI spec. Depending on the operation the token is a project ID, a JWT, a session JWT, an access key, or a management key. Through Jentic, the token is stored encrypted by your own Jentic One instance and injected at call time, so it never enters the agent's prompt or logs.

Can I run passwordless sign-in with the Descope API?

Yes. Start a flow such as POST /v1/auth/enchantedlink/signin/email, confirm the token with POST /v1/auth/magiclink/verify, then validate the resulting session with POST /v1/auth/validate.

What are the rate limits for the Descope API?

The OpenAPI spec does not specify rate limits; check the Descope documentation for current limits. Through Jentic, requests run from your own instance, so you control the pacing of the agent's calls.

How do I validate a session with the Descope API through Jentic?

Search Jentic for 'validate a Descope session', load the returned POST /v1/auth/validate operation with its input schema, and your agent checks the session with credentials injected at call time. To run it on your own infrastructure, install Jentic One from its GitHub repo.

Is there a Descope MCP server?

You don't need an MCP server to give your agent the Descope API. Jentic connects it directly from the API Directory: import it, store your token, and your agent calls it, discovering operations on demand instead of loading a separate server's tool definitions into its context.

Can I limit what my agent is allowed to do with the Descope API?

Yes. You choose which Descope operations your agent may call, so you can allow read-only checks like validating a session or reading user details while withholding user deletion or role changes. Scoping is by operation, so the agent invokes only the endpoints you approve.

Descope API

AI ReadinessNon-Ready (F)38/100

See full scorecard

Official vendor OpenAPI document · agent-readyIdentity AuthAuthenticationbearer240 EndpointsREST

For Agents

Run passwordless sign-in, session, and user-management flows for a Descope project. Authenticates with a project bearer token.

Use for: I want to start a passwordless sign-in with a one-time code, Verify a magic link token and create a session, Validate an active session token, Refresh an expiring session

Not supported: Does not host your application UI or store business data. Use for authentication, session, and identity management only.

The Descope API gives AI agents programmatic control over authentication and identity for a project. Agents run passwordless sign-up and sign-in flows over one-time codes, magic links, enchanted links, and OAuth, then validate, refresh, and revoke the resulting sessions. Beyond end-user auth, agents administer users, tenants, roles, permissions, and access keys, and drive third-party OAuth application flows. Requests present a bearer token scoped to the project.

Jentic One on Github View OpenAPI Document

Show dimension breakdown

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: DSignals: 4

80%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: CSignals: 4

Example Density

How richly the API is illustrated with examples.

100%

Example Validity

Percentage of examples that conform to their schemas.

25%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

100%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: FSignals: 4

12%

Description Coverage

Coverage of descriptions across API elements.

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

24%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

48%

Summary Coverage

Coverage of summaries across operations/tags/info.

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: D-Signals: 1

43%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

Security

Trust, risk posture, and security compliance.

Grade: B-Signals: 1

60%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: B+Signals: 1

68%

Descriptive Richness

Clarity and depth of descriptions across API elements.

Connect the Descope API to your agent

Capabilities

Start building with Descope API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

Descope API

Jentic AI Readiness Score

Descope API

Foundational Compliance

Lint Results

Resolution Completeness

Specification Validity

Structural Integrity

Developer Experience & Jentic Compatibility

Example Density

Example Validity

Response Coverage

Tooling Readiness

AI-Readiness & Agent Experience

Description Coverage

Error Standardization

OperationId Quality

Summary Coverage

Agent Usability

Complexity Comfort

Security

Authentication Strength

AI Discoverability

Descriptive Richness