canonical: https://jentic.com/apis/descope.com/descope # Descope API The Descope API gives AI agents programmatic control over authentication and identity for a project. Agents run passwordless sign-up and sign-in flows over one-time codes, magic links, enchanted links, and OAuth, then validate, refresh, and revoke the resulting sessions. Beyond end-user auth, agents administer users, tenants, roles, permissions, and access keys, and drive third-party OAuth application flows. Requests present a bearer token scoped to the project. ## For AI agents Run passwordless sign-in, session, and user-management flows for a Descope project. Authenticates with a project bearer token. ## Scope Does not host your application UI or store business data. Use for authentication, session, and identity management only. ## Capabilities - Run passwordless sign-up and sign-in over one-time codes, magic links, and enchanted links - Validate, refresh, and revoke user sessions - Read the current user's details and session history - Administer users, tenants, roles, and permissions in a project - Issue and exchange access keys for machine authentication - Drive third-party OAuth application authorize and token flows - Sign a user out of one session or all active sessions ## Use cases ### Agent-Managed Authentication via Jentic AI agents drive Descope authentication through Jentic without holding the project token in context. An agent searches by intent, receives the matching operation schema, and runs a passwordless flow or validates a session end to end. Jentic injects the bearer token at execution time, so the agent never sees the secret while it manages sign-in and sessions for a project. Example prompt: Search Jentic for 'validate a Descope session', load the POST `/v1/auth/validate` schema, and check the session with Jentic-managed credentials ### Passwordless Login Automation An agent runs an end-to-end passwordless login: it starts a sign-in over a one-time code or magic link, waits for the user to confirm, verifies the token, and receives a session. Descope supports several factors, so the agent can pick the channel that fits the user and complete authentication without a password anywhere in the flow. Example prompt: Call POST `/v1/auth/magiclink/verify` to confirm the token, then POST `/v1/auth/validate` to validate the resulting session ### Session Lifecycle Control An agent keeps a user's session healthy over a long-running task: it validates the session before each sensitive step, refreshes it as it nears expiry, and signs the user out when the task ends. Descope exposes explicit validate, refresh, and sign-out operations, so the agent controls the full session lifecycle rather than guessing at token state. Example prompt: Call POST `/v1/auth/refresh` to extend a session, then POST `/v1/auth/logout` to sign the user out when done ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/v1/auth/enchantedlink/signin/email` | Start a passwordless enchanted-link sign-in by email | | POST | `/v1/auth/magiclink/verify` | Verify a magic link token and create a session | | POST | `/v1/auth/validate` | Validate an active session | | POST | `/v1/auth/refresh` | Refresh an expiring session | | GET | `/v1/auth/me` | Read the current user's details | | POST | `/v1/auth/logout` | Sign the current user out of their session | ## Key resources - **Authentication flows** — Passwordless sign-up and sign-in over one-time codes, magic links, enchanted links, and OAuth - **Sessions** — Validate, refresh, and revoke sessions and read the current user's details - **Management** — Administer users, tenants, roles, permissions, and access keys for a project - **OAuth applications** — Authorize, token, and userinfo endpoints for third-party OAuth applications ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 38 / 100 - **Maturity:** Non-Ready - **Dimensions:** - Foundational Compliance: 45 / 100 - Developer Experience & Jentic Compatibility: 56 / 100 - AI-Readiness & Agent Experience: 21 / 100 - Agent Usability: 43 / 100 - Security: 60 / 100 - AI Discoverability: 68 / 100 - **View full report:** https://jentic.com/apis/descope.com/descope/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring the Descope API by hand means managing a project bearer token for each credential type, sequencing sign-up, verify, and validate calls, and handling refresh and revoke yourself. Through Jentic you install once, import the Descope API from the API Directory, store the token, and your agent calls it. - **Permission scoping:** You choose which Descope operations your agent may call, so a rule can allow session validation and user lookups while withholding user deletion, role edits, or access-key issuance. Scoping is by operation, so state-changing calls stay out unless you grant them. - **Credential handling:** Your Descope bearer token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'validate a session' or 'refresh a token', and Jentic returns the matching Descope operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Auth0** — Alternative identity platform for login and user management - **Okta** — Alternative enterprise identity and access management - **Stytch** — Alternative passwordless and session authentication platform ## FAQ ### What authentication does the Descope API use? The Descope API authenticates requests with a bearer token sent in the Authorization header, per its OpenAPI spec. Depending on the operation the token is a project ID, a JWT, a session JWT, an access key, or a management key. Through Jentic, the token is stored encrypted by your own Jentic One instance and injected at call time, so it never enters the agent's prompt or logs. ### Can I run passwordless sign-in with the Descope API? Yes. Start a flow such as POST `/v1/auth/enchantedlink/signin/email`, confirm the token with POST `/v1/auth/magiclink/verify`, then validate the resulting session with POST `/v1/auth/validate.` ### What are the rate limits for the Descope API? The OpenAPI spec does not specify rate limits; check the Descope documentation for current limits. Through Jentic, requests run from your own instance, so you control the pacing of the agent's calls. ### How do I validate a session with the Descope API through Jentic? Search Jentic for 'validate a Descope session', load the returned POST `/v1/auth/validate` operation with its input schema, and your agent checks the session with credentials injected at call time. To run it on your own infrastructure, install Jentic One from its GitHub repo. ### Is there a Descope MCP server? You don't need an MCP server to give your agent the Descope API. Jentic connects it directly from the API Directory: import it, store your token, and your agent calls it, discovering operations on demand instead of loading a separate server's tool definitions into its context. ### Can I limit what my agent is allowed to do with the Descope API? Yes. You choose which Descope operations your agent may call, so you can allow read-only checks like validating a session or reading user details while withholding user deletion or role changes. Scoping is by operation, so the agent invokes only the endpoints you approve.