Auth.js · Const

Descope

Auth.js provides a built-in Descope sign-in integration. Configure it as an OIDC provider with the Descope client ID, access key, and issuer.

How it works

Descope is configured as a built-in OIDC provider by passing its client ID, client secret, and issuer to the provider factory. Auth.js then includes that provider in its authentication configuration and uses the provider-specific callback route to complete sign-in.

Syntax

Descope(config)

Parameters

Name	Type	Description
`config`	`OIDCUserConfig<DescopeProfile>`	OIDC provider configuration for Descope, including client credentials and issuer.

Returns

OIDCConfig<DescopeProfile>

Key points

Auth.js includes Descope as a ready-made sign-in integration.
Descope's callback endpoint uses the provider identifier descope in the path.
Set AUTH_DESCOPE_ID to the last URL segment of the Descope issuer or to the project ID.
Set AUTH_DESCOPE_SECRET to the access key created in Descope.
Set AUTH_DESCOPE_ISSUER to the issuer URL from the Descope OIDC application.
The built-in provider supplies default settings, reducing the amount of configuration required.

Common mistakes

Descope is treated as an OIDC provider by default, so its issuer and configuration must follow the OpenID Connect setup.

Example: Configure Descope with Auth.js

import { Auth } from "@auth/core"
import Descope from "@auth/core/providers/descope"

const request = new Request(origin)
const response = await Auth(request, {
  providers: [
    Descope({
      clientId: process.env.AUTH_DESCOPE_ID!,
      clientSecret: process.env.AUTH_DESCOPE_SECRET!,
      issuer: process.env.AUTH_DESCOPE_ISSUER!,
    }),
  ],
})

Registers Descope as an OIDC provider with the credentials and issuer supplied by environment variables.

When to use it

Descope sign-in

Add Descope authentication to an Auth.js application using the provider's built-in OIDC settings.

Environment-based OIDC configuration

Connect an Auth.js deployment to a Descope OIDC application through environment-based credentials.

Provider customization

Use the provider's standard setup while changing selected OAuth or OIDC options for an application's needs.

Interview questions

QHow do you configure Descope in Auth.js?

Add the built-in Descope provider to the Auth.js providers array and supply the Descope client ID, access key, and issuer. The provider returns an OIDC configuration used by Auth.js for sign-in.

Follow-up: What callback route must Descope allow? The authorized callback is https://example.com/api/auth/callback/descope, adapted to the application's origin.

QWhich Descope values are required?

The client ID comes from the final segment of the Descope issuer or the project ID, the client secret is the Descope access key, and the issuer is the OIDC issuer URL. These values can be supplied through AUTH_DESCOPE_ID, AUTH_DESCOPE_SECRET, and AUTH_DESCOPE_ISSUER.

Follow-up: Why use an issuer? It lets the OIDC provider configuration identify the Descope authorization server and its endpoints.

QWhat does the Descope provider return?

The provider is exposed as Descope from @auth/core/providers/descope and is called with an OIDCUserConfig containing the provider settings. Its return type is OIDCConfig<DescopeProfile>.

Follow-up: How can defaults be changed? Pass provider configuration overrides to the factory; Auth.js documents customizing built-in OAuth providers for that purpose.

DescopeProfile
OIDCUserConfig
OIDCConfig
customizing a built-in OAuth provider

Source: Descope | Auth.js. Checked 2026-10-15.