Descope is a customer and agentic identity access management (CIAM) platform founded in 2022 by veterans of Sentrigo and Demisto (acquired by Palo Alto Networks). Its signature is drag-and-drop Descope Flows — a visual authentication-flow builder — paired with passwordless methods (passkeys, magic link, OTP, social, biometric), risk-based MFA, SSO/SAML/SCIM, fine-grained authorization, and a growing Agentic Identity Hub that issues scoped OAuth tokens to AI agents and MCP servers. Descope ships SDKs for every mainstream language and framework, a CLI, Terraform/Pulumi providers, self-hostable hosted-auth app, and prebuilt migration tools from Auth0, Cognito, Firebase, and Keycloak. Free tier covers 7,500 MAUs forever; paid tiers start at $249/month.
Descope publishes 15 API contracts indexed on the APIs.io network, including Apps API, Auth API, Custom Attributes API, and 12 more. Tagged areas include Authentication, Identity, CIAM, Passwordless, and Passkeys.
The Descope catalog on APIs.io includes 1 Spectral governance ruleset.
Descope’s developer surface includes authentication, developer portal, documentation, getting-started guide, API reference, developer console, signup flow, and 57 more developer resources.
Regulatory Posture applies to this provider. Its tags matched the
Horizontal (data, software, accessibility, platform) regime, so
Regulatory Posture carries 15 points of the composite.
If this regime is wrong for your business, say so on your
provider repo — the
applicability map is public and we will correct it.
Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it
carries 10 points of the composite. It is scored from the published contracts
themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already
holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in
front of it, and the first time that check is skipped a duplicate record is created.
Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet,
not penalised by it.
The six quality facets above are damped to 75 points between them,
because the conditional facet above carries the other
25. That is why each facet's contribution is shown against a damped
maximum: raising a quality facet moves the composite by 75% of its nominal
weight, not 100%. The full arithmetic is at apis.io/rating/.
Show this score on your site.
It updates itself when the score changes. Paste this where you link to your API docs:
<a href="https://apis.io/providers/descope/"><img src="https://apis.io/badge/descope/card.svg" alt="Descope on APIs.io — Kin Score by API Evangelist"></a>
Other styles, a README pill and a shields.io endpoint are on the badge page.
Raise your score.
Agent readiness — checks not met, largest first (exact, from this profile):
Idempotency+9 pts — OpenAPI mutating operations declare an idempotency key — a header, a request-body property, or a named de-duplication token whose own description says so (verified); else common[].type matches /idempoten/i (documented)
Stable Error Semantics+8 pts — OpenAPI $refs a shared error schema across 4xx/5xx responses (verified), else common[].type includes ErrorCatalog / ErrorCodes / DeclineCodes
A2A Agent Card+8 pts — a2a/-a2a.yml manifest, graded on conformance.grade against A2A 1.0.0
Rate-Limit Signaling+7 pts — OpenAPI responses document X-RateLimit-* / RateLimit headers (verified), else a rate_limits artifact or RateLimits link (documented)
Request/Response Examples+7 pts — share of operations carrying request/response examples; else an Examples / Code Samples link
Descope is an area vendor: providers adopt it to run part of their developer surface. This is the Kin Score checks its features can move for a provider that adopts it, what each one really earns, and what it earns nothing for.
identitycapability map4 features checked 2026-09-25 · rubric v0.22.0
Descope’s strongest Kin Score lever is its MCP Express SDK, which serves protected-resource metadata from the provider’s own MCP server and so can earn the verified RFC 9728 tier. Its own discovery documents, rich as they are (authorization_code, CIBA, token exchange, a registration endpoint), sit under a project path, so the served tiers of auth clarity, delegated identity and dynamic client registration are not read; the provider reaches only the OpenAPI fallback tiers it writes itself. Not detectable from the registry today, so capability-only.
Agent Readiness21.5 of 139 pts
Contract Quality4.0 of 211 pts
Discoverability6.0 of 54 pts
Regulatory7.0 of 108 pts
Check
Earns
Through
Machine-Readable Authpartial Agent ReadinessThe served tier needs a root discovery document on a provider host; Descope’s live under a project path (the api.descope.com root answers none), so only the OpenAPI fallback is reachable.
Protected Resource Metadata Agent ReadinessRun its MCP/API server with the SDK on a host on its record, so /.well-known/oauth-protected-resource (naming Descope in authorization_servers) is served there. Descope’s own mcp.descope.com serves one.
Registration Without a Humanconditional Agent ReadinessOnly if the provider’s host answers the root /.well-known/oauth-authorization-server with Descope’s metadata (e.g. the SDK’s own AS-metadata endpoint on the MCP host) and that host is on its record.
Across 8977 providers that publish a contract, adopting Descope would move 8959. Median lift: composite +1.1 (90th percentile +1.1), agent readiness +8.6 (+10.1). Conditional rows excluded.
What Descope ships that earns nothing (2)
Custom domain (CNAME) — The fetched custom-domain page covers auth/session APIs and cookies, not the issuer; discovery stays under a project path either way.
Agentic Identity Hub — User consent to agent access is not an AI usage preference or Web Bot Auth / HTTP Message Signatures agent identity.
A model, not a score. Adopting this vendor changes a provider's Kin Score only when the provider publishes the resulting artifacts on its own surface; nothing here writes a score, and no sponsorship or partnership can. The rating is not for sale → · Full vendor facets artifact
Markets this provider is in provisional
The Kin Score Market layer reads a provider inside its market:
its position, and how deep its integrations go. Depth is only comparable within a position. Provisional and unweighted:
not part of the Kin Score or agent readiness.
Registered MCP server and declares compatibility are report only — not weighted.
Undeclared means we found nothing we can read, so there is no number: we never infer integrations.
Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.
Drag-and-drop Descope Flows for designing authentication, signup, MFA, step-up, and account-recovery journeys with no code
Passwordless authentication — magic links, enchanted links, passkeys/WebAuthn, OTP (email/SMS/voice/IM), nOTP push, TOTP authenticator apps, and Google One Tap
Social login and OIDC federation with 30+ providers
SAML 2.0 inbound and outbound SSO with self-service IdP configuration for B2B customers
WS-Federation IdP support for Microsoft enterprise tenants
SCIM 2.0 user and group provisioning
Fine-grained authorization (FGA / ReBAC) modeled after Google Zanzibar with schema, relation, and policy APIs
Role-based access control with company/project/tag-scoped management keys
Multi-tenant architecture with delegated admin widgets for B2B customer self-service
Risk-based / adaptive MFA via flow conditional logic and connectors (reCAPTCHA, Fingerprint, ipQualityScore)
Add passwordless sign-up/sign-in (passkeys, magic link, social) to consumer apps with adaptive MFA and account-takeover protection.
B2B Enterprise SSO
Let business customers self-serve SAML/OIDC SSO and SCIM provisioning without per-tenant engineering work, using delegated admin widgets.
Auth Migration
Migrate users from Auth0, Cognito, Firebase, Keycloak, and other IdPs with prebuilt Python-based migration tools that preserve password hashes where possible.
Agentic Identity for AI Agents
Issue scoped OAuth tokens to AI agents and MCP servers using progressive scoping, token vaulting, and per-agent audit trails via the Agentic Identity Hub.
Multi-Tenant SaaS
Model tenant hierarchies, delegated admin, per-tenant SSO, and tenant-scoped RBAC/FGA from a single Descope project.
Fine-Grained Authorization
Replace homegrown permission systems with a Zanzibar-style schema, relations, and policies via the FGA Management API.
Mobile Authentication
Native passkey, biometric, and social login in iOS, Android, React Native, and Flutter apps using Descope's mobile SDKs.
Compliance-Driven Auth
Use audit logs, custom message templates, MFA enforcement, and SOC 2 / GDPR controls to satisfy regulated-industry requirements.
aid: descope
url: https://raw.githubusercontent.com/api-evangelist/descope/refs/heads/main/apis.yml
apis:
- aid: descope:descope-apps-api
name: Descope Apps API
description: The Apps API from Descope — 4 operation(s) for apps.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Application
tags_raw:
- Apps
properties:
- type: OpenAPI
url: openapi/descope-apps-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-auth-api
name: Descope Auth API
description: The Auth API from Descope — 52 operation(s) for auth.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Authentication
tags_raw:
- Auth
properties:
- type: OpenAPI
url: openapi/descope-auth-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-custom-attributes-api
name: Descope Custom Attributes API
description: The Custom Attributes API from Descope — 3 operation(s) for custom attributes.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Custom Attributes
properties:
- type: OpenAPI
url: openapi/descope-custom-attributes-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-email-api
name: Descope Email API
description: The Email API from Descope — 10 operation(s) for email.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Email
properties:
- type: OpenAPI
url: openapi/descope-email-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-embedded-link-api
name: Descope Embedded Link API
description: The Embedded Link API from Descope — 1 operation(s) for embedded link.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Embedded Link
properties:
- type: OpenAPI
url: openapi/descope-embedded-link-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-fedcm-api
name: Descope Fedcm API
description: The Fedcm API from Descope — 2 operation(s) for fedcm.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Fedcm
properties:
- type: OpenAPI
url: openapi/descope-fedcm-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-instant-message-im-api
name: Descope Instant Message (IM) API
description: The Instant Message (IM) API from Descope — 5 operation(s) for instant message (im).
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Instant Message (IM)
properties:
- type: OpenAPI
url: openapi/descope-instant-message-im-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-keys-api
name: Descope Keys API
description: The Keys API from Descope — 2 operation(s) for keys.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Keys
properties:
- type: OpenAPI
url: openapi/descope-keys-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-mgmt-api
name: Descope Mgmt API
description: The Mgmt API from Descope — 276 operation(s) for mgmt.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Mgmt
properties:
- type: OpenAPI
url: openapi/descope-mgmt-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-scim-api
name: Descope Scim API
description: The Scim API from Descope — 6 operation(s) for scim.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- SCIM
tags_raw:
- Scim
properties:
- type: OpenAPI
url: openapi/descope-scim-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-text-message-sms-api
name: Descope Text Message (SMS) API
description: The Text Message (SMS) API from Descope — 9 operation(s) for text message (sms).
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Text Message (SMS)
properties:
- type: OpenAPI
url: openapi/descope-text-message-sms-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-verification-api
name: Descope Verification API
description: The Verification API from Descope — 1 operation(s) for verification.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Verification
properties:
- type: OpenAPI
url: openapi/descope-verification-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-voice-message-phone-api
name: Descope Voice Message (Phone) API
description: The Voice Message (Phone) API from Descope — 5 operation(s) for voice message (phone).
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- Voice Message (Phone)
properties:
- type: OpenAPI
url: openapi/descope-voice-message-phone-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-well-known-api
name: Descope .well Known API
description: The .well Known API from Descope — 6 operation(s) for .well known.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- .well Known
properties:
- type: OpenAPI
url: openapi/descope-well-known-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
- aid: descope:descope-oauth2-api
name: Descope Oauth2 API
description: The Oauth2 API from Descope — 30 operation(s) for oauth2.
humanURL: https://docs.descope.com/api
baseURL: https://api.descope.com
tags:
- OAuth
- Authentication
tags_raw:
- Oauth2
- Authentication
properties:
- type: OpenAPI
url: openapi/descope-oauth2-api-openapi.yml
- type: Documentation
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/auth-methods
- type: APIReference
url: https://docs.descope.com/api/openapi-spec
- type: Documentation
url: https://docs.descope.com/manage
- type: APIReference
url: https://docs.descope.com/api
- type: Documentation
url: https://docs.descope.com/inbound-apps
- type: Documentation
url: https://docs.descope.com/scim
- type: Documentation
url: https://docs.descope.com/jwks
name: Descope
tags:
- Authentication
- Identity
- CIAM
- Passwordless
- Passkeys
- MFA
- SSO
- OAuth
- OpenID Connect
- SAML
- SCIM
- Authorization
- FGA
- Agentic Identity
- MCP
- Identity Federation
tags_raw:
- Authentication
- Identity
- CIAM
- Passwordless
- Passkeys
- MFA
- SSO
- OAuth
- OIDC
- SAML
- SCIM
- Authorization
- FGA
- Agentic Identity
- MCP
- Identity Federation
kind: contract
deliveryModel:
model: saas
open_source: false
commercial: true
callable_host: true
label: Hosted service · you call their endpoint
confidence: high
source:
- openapi
- pricing
generated: '2026-08-28'
method: derived
accessModel:
pricing: freemium
onboarding: self-serve
trial: false
try_now: true
public: false
gated: none
gated_source:
- onboarding
label: Freemium · Self-serve signup
confidence: medium
source:
- plans
- authentication
- security
generated: '2026-11-06'
method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/descope.png
access: 3rd-Party
common:
- type: Plans
url: plans/descope-plans-pricing.yml
- type: CapabilityMap
url: capabilities/descope-capability-edges.yml
name: Descope Business Capability Map
- type: VendorFacets
url: vendor-facets/descope-vendor-facets.yml
- type: Website
url: https://www.descope.com/
- type: AgenticAccess
url: agentic-access/descope-agentic-access.yml
- type: TrustCenter
url: security/descope-trust-center.yml
- type: DomainSecurity
url: security/descope-domain-security.yml
- type: Authentication
url: authentication/descope-authentication.yml
- url: https://www.descope.com
type: Portal
- url: https://docs.descope.com
type: Documentation
- url: https://docs.descope.com/getting-started
type: GettingStarted
- url: https://docs.descope.com/api/openapi-spec
type: APIReference
- url: https://app.descope.com
type: Console
- url: https://www.descope.com/sign-up
type: Signup
- url: https://www.descope.com/pricing
data:
- id: free
name: Free Forever
entries:
- geo: Global
unit: 7500
label: Monthly Active Users
limit: 7500
price: 0
metric: mau
timeFrame: month
description: No-cost tier with 7,500 MAUs. No overages allowed — upgrade required to exceed limits.
elements:
- name: All authentication methods (OTP, magic link, passkeys, social, SSO, MFA)
- name: Drag-and-drop Descope Flows
- name: Role-based access control
- name: Multi-factor authentication
- name: Community support
description: Free tier for development, prototypes, and small applications.
- id: pro
name: Pro
entries:
- geo: Global
unit: 1
label: Starting Price
price: 249
metric: month
timeFrame: month
description: Annual billing. Includes 10,000 MAUs; usage-based overages apply.
- geo: Global
unit: 10000
label: Included MAUs
limit: 10000
metric: mau
timeFrame: month
description: Monthly active users included in the Pro tier.
elements:
- name: Everything in Free
- name: Custom domain
- name: Google One Tap
- name: CI/CD integration
- name: Web and Slack support
description: Production-ready tier for growing applications.
- id: growth
name: Growth
entries:
- geo: Global
unit: 1
label: Starting Price
price: 799
metric: month
timeFrame: month
description: Annual billing. Includes 25,000 MAUs; usage-based overages apply.
- geo: Global
unit: 25000
label: Included MAUs
limit: 25000
metric: mau
timeFrame: month
description: Monthly active users included in the Growth tier.
elements:
- name: Everything in Pro
- name: Bot protection
- name: 1M included anonymous users
- name: SCIM provisioning
- name: Fine-grained authorization (FGA)
description: For scaling B2B and B2C applications needing enterprise auth features.
- id: enterprise
name: Enterprise
entries:
- geo: Global
unit: 1
label: Custom
price: Call
metric: contract
timeFrame: year
description: Custom MAU limits and tiered volume discounts.
elements:
- name: Everything in Growth
- name: Tiered volume discounts
- name: Dedicated customer success engineer
- name: Custom deployments (single-tenant, private cloud, on-prem)
- name: Unlimited test users
- name: Unlimited anonymous users
- name: Premium support
description: For large enterprises with custom deployment and compliance requirements.
name: Plans
type: Plans
- url: https://www.descope.com/pricing
name: Pricing
type: Pricing
- url: https://www.descope.com/terms
type: TermsOfService
- url: https://www.descope.com/privacy
type: PrivacyPolicy
- url: https://descopestatus.com
type: StatusPage
- url: https://www.descope.com/blog
type: Blog
- url: https://www.descope.com/contact
type: Support
- url: https://www.descope.com/customers
type: CaseStudies
- url: https://www.descope.com/learn
type: Training
name: Learning Center
- url: https://www.descope.com/learn/post/agentic-identity-hub
type: Documentation
name: Agentic Identity Hub
- url: https://github.com/descope
type: GitHubOrganization
- url: https://github.com/descope/node-sdk
name: Node.js SDK
type: SDKs
- url: https://github.com/descope/python-sdk
name: Python SDK
type: SDKs
- url: https://github.com/descope/go-sdk
name: Go SDK
type: SDKs
- url: https://github.com/descope/descope-java
name: Java SDK
type: SDKs
- url: https://github.com/descope/descope-dotnet
name: .NET SDK
type: SDKs
- url: https://github.com/descope/descope-php
name: PHP SDK
type: SDKs
- url: https://github.com/descope/descope-ruby-sdk
name: Ruby SDK
type: SDKs
- url: https://github.com/descope/descope-swift
name: Swift (iOS) SDK
type: SDKs
- url: https://github.com/descope/descope-kotlin
name: Kotlin (Android) SDK
type: SDKs
- url: https://github.com/descope/descope-react-native
name: React Native SDK
type: SDKs
- url: https://github.com/descope/descope-flutter
name: Flutter SDK
type: SDKs
- url: https://github.com/descope/descope-js
name: JavaScript / React / Next.js / Vue / Angular / Web Components
type: SDKs
- url: https://github.com/descope/django-descope
name: Django Plugin
type: SDKs
- url: https://github.com/descope/passport-descope
name: Passport.js Strategy
type: SDKs
- url: https://github.com/descope/descope-wordpress
name: WordPress Plugin
type: Plugins
- url: https://github.com/descope/descopecli
name: descopecli
type: CLI
- url: https://github.com/descope/terraform-provider-descope
name: Terraform Provider
type: Tools
- url: https://github.com/descope/pulumi-descope
name: Pulumi Provider
type: Tools
- url: https://github.com/descope/auth-hosting
name: Auth Hosting (self-hostable Flows UI)
type: Tools
- url: https://github.com/descope/virtualwebauthn
name: VirtualWebAuthn (WebAuthn test tool)
type: Tools
- url: https://github.com/descope/mcp-express
name: MCP Express
type: Tools
- url: https://github.com/descope/mcp-go
name: MCP Go
type: Tools
- url: https://github.com/descope/descope-mcp
name: Descope MCP SDKs
type: Tools
- url: https://github.com/descope/skills
name: Descope Authentication Skills for AI Agents
type: Tools
- url: https://github.com/descope/ai
name: Descope Official AI Repository
type: Tools
- url: https://github.com/descope/descope-migration
name: Generic Migration Tool
type: Tools
- url: https://github.com/descope/descope-auth0-migration
name: Auth0 Migration Tool
type: Tools
- url: https://github.com/descope/descope-cognito-migration
name: Amazon Cognito Migration Tool
type: Tools
- url: https://github.com/descope/descope-firebase-migration
name: Firebase Migration Tool
type: Tools
- url: https://github.com/descope/descope-keycloak-migration
name: Keycloak Migration Tool
type: Tools
- url: https://github.com/descope/project-cicd-template
name: Project CI/CD Template (GitHub Actions)
type: Tools
- url: https://github.com/descope/project-gitlab-cicd-pipeline
name: Project CI/CD Template (GitLab)
type: Tools
- url: https://github.com/descope/sbt-aws-descope
name: AWS SaaS Builder Toolkit Integration
type: Tools
- url: https://www.linkedin.com/company/descope
type: LinkedIn
- url: https://twitter.com/descopeinc
type: Twitter
- url: https://www.youtube.com/@descopeinc
type: YouTube
- url: https://authtown.unstructured.chat
type: Forums
name: AuthTown Community
- type: Features
data:
- Drag-and-drop Descope Flows for designing authentication, signup, MFA, step-up, and account-recovery journeys with no
code
- Passwordless authentication — magic links, enchanted links, passkeys/WebAuthn, OTP (email/SMS/voice/IM), nOTP push, TOTP
authenticator apps, and Google One Tap
- Social login and OIDC federation with 30+ providers
- SAML 2.0 inbound and outbound SSO with self-service IdP configuration for B2B customers
- WS-Federation IdP support for Microsoft enterprise tenants
- SCIM 2.0 user and group provisioning
- Fine-grained authorization (FGA / ReBAC) modeled after Google Zanzibar with schema, relation, and policy APIs
- Role-based access control with company/project/tag-scoped management keys
- Multi-tenant architecture with delegated admin widgets for B2B customer self-service
- Risk-based / adaptive MFA via flow conditional logic and connectors (reCAPTCHA, Fingerprint, ipQualityScore)
- Step-up authentication for sensitive transactions
- 50+ outbound connectors (HTTP, audit, AWS, Segment, Salesforce, HubSpot, Twilio, SendGrid, Slack, etc.)
- Inbound third-party app OAuth — Descope as an OIDC/OAuth 2.1 authorization server
- Agentic Identity Hub with MCP server registration, per-agent OAuth scopes, and token vaulting for AI agents (Claude, ChatGPT,
Cursor, etc.)
- OAuth 2.1, PKCE, JAR (RFC 9101), DPoP, CIBA, and device authorization flows
- Anonymous-to-known user merging
- Account takeover prevention with disposable-email/burner detection (go-free-email-providers)
- Custom domains for hosted authentication pages
- Hosted Flow app (React) with full source available for self-hosting
- Terraform and Pulumi providers for declarative project management
- CLI (`descopecli`) for project snapshot, import, export, and CI/CD pipelines
- Audit log API and analytics API
- Free 7,500 MAU forever tier
sources:
- https://www.descope.com
- https://docs.descope.com
- https://docs.descope.com/api/openapi-spec
- https://www.descope.com/pricing
- https://github.com/descope
updated: '2026-05-25'
- type: UseCases
data:
- name: B2C Customer Authentication
description: Add passwordless sign-up/sign-in (passkeys, magic link, social) to consumer apps with adaptive MFA and account-takeover
protection.
- name: B2B Enterprise SSO
description: Let business customers self-serve SAML/OIDC SSO and SCIM provisioning without per-tenant engineering work,
using delegated admin widgets.
- name: Auth Migration
description: Migrate users from Auth0, Cognito, Firebase, Keycloak, and other IdPs with prebuilt Python-based migration
tools that preserve password hashes where possible.
- name: Agentic Identity for AI Agents
description: Issue scoped OAuth tokens to AI agents and MCP servers using progressive scoping, token vaulting, and per-agent
audit trails via the Agentic Identity Hub.
- name: Multi-Tenant SaaS
description: Model tenant hierarchies, delegated admin, per-tenant SSO, and tenant-scoped RBAC/FGA from a single Descope
project.
- name: Fine-Grained Authorization
description: Replace homegrown permission systems with a Zanzibar-style schema, relations, and policies via the FGA Management
API.
- name: Mobile Authentication
description: Native passkey, biometric, and social login in iOS, Android, React Native, and Flutter apps using Descope's
mobile SDKs.
- name: Compliance-Driven Auth
description: Use audit logs, custom message templates, MFA enforcement, and SOC 2 / GDPR controls to satisfy regulated-industry
requirements.
- type: Integrations
data:
- name: AWS
description: SaaS Builder Toolkit integration, Cognito migration, and IAM role assumption from GCP via OIDC GitHub Action.
- name: Cloudflare
description: Workers-based redirect worker for tenant-level SSO migration.
- name: Terraform
description: Official `terraform-provider-descope` for managing projects, flows, tenants, and SSO declaratively.
- name: Pulumi
description: Official `pulumi-descope` provider.
- name: WordPress
description: Descope auth plugin replacing native WordPress login.
- name: Django
description: '`django-descope` plugin for first-class Django auth integration.'
- name: Passport.js
description: '`passport-descope` strategy for Node.js apps using Passport.'
- name: Next.js / React / Vue / Angular / SvelteKit
description: Client SDKs and Flow web components shipped under `descope-js`.
- name: Salesforce / HubSpot / Segment / Twilio / SendGrid / Slack / S3 / Snowflake
description: 50+ outbound connectors invoked from inside Flows to enrich users, send messages, and stream events.
- name: Anthropic Claude / OpenAI / Cursor / MCP Clients
description: Agentic Identity Hub issues short-lived, scoped tokens to AI agents via MCP server registration and per-agent
OAuth.
- type: Solutions
data:
- name: Customer Identity (CIAM)
description: Drop-in B2C authentication with Flows, passwordless methods, and progressive profiling.
- name: Workforce-Adjacent B2B Identity
description: SAML SSO, SCIM, delegated admin, and tenant management for SaaS vendors selling to enterprises.
- name: Agentic Identity
description: OAuth issuance, MCP server registration, and credential vaulting for AI agents and autonomous workflows.
- name: Migration & Modernization
description: Tooling to lift users off legacy IdPs (Auth0, Cognito, Firebase, Keycloak) onto a modern, passwordless-first
platform.
- type: Portal
url: https://www.descope.com
- type: Documentation
url: https://docs.descope.com
created: '2026-05-25T00:00:00.000Z'
modified: '2026-09-16'
position: Consuming
description: Descope is a customer and agentic identity access management (CIAM) platform founded in 2022 by veterans of Sentrigo
and Demisto (acquired by Palo Alto Networks). Its signature is drag-and-drop Descope Flows — a visual authentication-flow
builder — paired with passwordless methods (passkeys, magic link, OTP, social, biometric), risk-based MFA, SSO/SAML/SCIM,
fine-grained authorization, and a growing Agentic Identity Hub that issues scoped OAuth tokens to AI agents and MCP servers.
Descope ships SDKs for every mainstream language and framework, a CLI, Terraform/Pulumi providers, self-hostable hosted-auth
app, and prebuilt migration tools from Auth0, Cognito, Firebase, and Keycloak. Free tier covers 7,500 MAUs forever; paid
tiers start at $249/month.
maintainers:
- FN: Kin Lane
email: info@apievangelist.com
X: apievangelist
url: https://apievangelist.com
specificationVersion: '0.23'
Descope API — frequently asked questions
Does Descope have an API?
Yes. APIs.io lists 15 APIs from Descope, including Descope Apps API, Descope Auth API and Descope Custom Attributes API, and 12 more.
Is there an OpenAPI specification for the Descope API?
Yes. APIs.io indexes 15 OpenAPI specifications for Descope, each linked for download from this page.
How do I authenticate with the Descope API?
Descope uses bearer-token authentication (http · 1 scheme). The details are profiled on APIs.io as Descope Authentication.
How much does the Descope API cost?
Descope publishes its prices; its Free Forever plan is $0 as of 2026-10-28. APIs.io lists 4 pricing plans for Descope, with each plan's price, limits and inclusions under Pricing on this page.
Does Descope have an MCP server?
Yes. APIs.io lists 1 MCP server for Descope: Remote MCP server at mcp.descope.com over HTTP.
Is the Descope API ready for AI agents?
Descope has a Kin Score of 66.0 out of 100 (strong) and an Agent Readiness score of 32.2 (agent-ready), scored by API Evangelist on 2026-11-06.
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
Kin Score
How this is scored →
It updates itself when the score changes. Paste this where you link to your API docs: