v1/auth/oauth/authorize/updateAuthorization
Descope Project ID:Refresh JWT Project ID:Refresh JWT as bearer token.
In: header
Query Parameters
When false (default), the identity is linked only if the provider's email is already one of the user's login IDs. When true, it is linked even without a common identifier.
falseRequest Body
application/json
falseCustom claims to include in the JWT as key-value pairs. Keys must be strings; values can be strings, numbers, or booleans.
{
"claim-name": "claim-value"
}falselength <= 254relevant only for enchanted links in the point in time - other methods will ignore this field
bytesLink a social login (OAuth) identity to a signed-in user
Links an OAuth identity to a user who is already signed in, such as when they connect a Google account from your app's settings. This is not a sign-in endpoint. The bearer token is <Project ID>:<Refresh JWT>, and the identity is linked to that user.
By default, the provider's email must already be one of the user's login IDs, or the request fails. Set allowAllMerge to true to skip this check.
When to use allowAllMerge
Use it only when the user starts the linking themselves, for example to link a personal Google account to a work email. It doesn't check email verification and relies on the refresh JWT alone, so don't use it to merge identities at sign-in. See Risks in Merging SSO and Non-SSO Identities.
It is separate from the SSO mergeUsers and allowMergeUsersWithMultipleTenants settings, which merge SSO users at sign-in.
Next Steps
Call Exchange Code from the page at redirectUrl to complete the linking.
See Also
- See Social Login (OAuth) with Flows for the Update User / OAuth flow action. Its Merge without a common identifier (like email) option is the flow equivalent of
allowAllMerge. - See The User Object for further details on how to identify users and their contact information such as email addresses and phone number.
curl -X POST "https://api.descope.com/v1/auth/oauth/authorize/update?provider=string" \ -H "Content-Type: application/json" \ -d '{}'{ "url": "string", "errorId": "string"}export interface Response {url?: stringerrorId?: string}