Skill

descope-auth

Integrates Descope for login, signup, passwordless auth (OTP, Magic Link, Passkeys), OAuth, SSO, MFA. Detects Next.js, React, or Python/Node.js backends for targeted setup and validation guidance.

React

Next.js

Node

Python

authentication

npx claudepluginhub descope/skills --plugin descope-skills

Tool Access

This skill uses the workspace's default tool permissions.

Preview

Integrate secure, passwordless authentication using Descope Flows and SDKs.

Supporting Assets

references/backend.mdreferences/nextjs.mdreferences/react.md

SKILL.md

Similar Skills

auth

157

Guides Clerk, Descope, and Auth0 authentication setup in Next.js apps. Covers middleware patterns, sign-in/sign-up flows, and Vercel Marketplace provisioning. Use for implementing user auth.

vercel

auth0-quickstart

Detects app framework (React, Next.js, Vue, Angular, Express, Fastify, React Native), sets up Auth0 account/CLI/app, and routes to SDK-specific authentication workflows.

3 files

auth0

create-auth

Scaffolds signin and signup authentication endpoints for Next.js, Express, FastAPI, Go projects with Prisma, Drizzle, PostgreSQL, SQLAlchemy, and database/JWT sessions. Use for adding login/register flows from scratch.

20 files

auth

Stats

Stars6

Forks2

Last CommitFeb 14, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Descope Authentication

Integrate secure, passwordless authentication using Descope Flows and SDKs.

Framework Detection

Detect the user's framework and use the appropriate reference:

If project has...

Use reference

next in package.json

references/nextjs.md

react (no Next.js)

references/react.md

Python/Node.js backend only

references/backend.md

Quick Start (all frameworks)

Get Project ID from https://app.descope.com/settings/project

Set environment variable: NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id>

Follow framework-specific reference

Valid Flow IDs (CRITICAL - do not invent others)

Flow ID

Purpose

sign-up-or-in

Combined signup/login (RECOMMENDED)

sign-up

Registration only

sign-in

step-up

MFA step-up authentication

update-user

Profile updates, add auth methods

Authentication Methods

Method

When to use

OTP (Email/SMS)

Quick verification codes

Magic Link

Passwordless email links

Passkeys

Biometric/WebAuthn (most secure)

OAuth

Social login (Google, GitHub, etc.)

SSO

Enterprise SAML/OIDC

Passwords

Traditional auth (not recommended)

DO NOT (Security Guardrails)

DO NOT parse JWTs manually - always use SDK's validateSession()

DO NOT store tokens in localStorage - SDK handles this securely

DO NOT invent flow IDs - only use IDs from the table above

DO NOT skip server-side validation - always validate on backend

DO NOT expose DESCOPE_MANAGEMENT_KEY in client code

References

references/nextjs.md - Next.js App Router integration

references/react.md - React SPA integration

references/backend.md - Backend session validation

Descope Authentication

Integrate secure, passwordless authentication using Descope Flows and SDKs.

Framework Detection

Detect the user's framework and use the appropriate reference:

If project has...	Use reference
`next` in package.json	`references/nextjs.md`
`react` (no Next.js)	`references/react.md`
Python/Node.js backend only	`references/backend.md`

Quick Start (all frameworks)

Get Project ID from https://app.descope.com/settings/project
Set environment variable: NEXT_PUBLIC_DESCOPE_PROJECT_ID=<your-id>
Follow framework-specific reference

Valid Flow IDs (CRITICAL - do not invent others)

Flow ID	Purpose
`sign-up-or-in`	Combined signup/login (RECOMMENDED)
`sign-up`	Registration only
`sign-in`	Login only
`step-up`	MFA step-up authentication
`update-user`	Profile updates, add auth methods

Authentication Methods

Method	When to use
OTP (Email/SMS)	Quick verification codes
Magic Link	Passwordless email links
Passkeys	Biometric/WebAuthn (most secure)
OAuth	Social login (Google, GitHub, etc.)
SSO	Enterprise SAML/OIDC
Passwords	Traditional auth (not recommended)

DO NOT (Security Guardrails)

DO NOT parse JWTs manually - always use SDK's validateSession()
DO NOT store tokens in localStorage - SDK handles this securely
DO NOT invent flow IDs - only use IDs from the table above
DO NOT skip server-side validation - always validate on backend
DO NOT expose DESCOPE_MANAGEMENT_KEY in client code

References

references/nextjs.md - Next.js App Router integration
references/react.md - React SPA integration
references/backend.md - Backend session validation