Inbound Apps (OAuth) APIs
These endpoints implement Descope's OAuth 2.0 / OpenID Connect authorization server for Inbound Apps. Third-party applications, backend services, and agentic clients use them to obtain access tokens scoped to your Resources.
For conceptual guidance, grant types, and example requests, see Authorization server endpoints.
Endpoints
| Route | Methods | Description |
|---|---|---|
/oauth2/v1/apps/authorize | GET, POST | Start user authentication and consent (GET, POST) |
/oauth2/v1/apps/token | POST | Issue, refresh, and exchange tokens (Token endpoint) |
/oauth2/v1/apps/revoke | POST | Revoke tokens (Revoke) |
/oauth2/v1/apps/userinfo | GET, POST | Read token claims (GET, POST) |
Base URL: https://api.descope.com (or your custom domain).
Configure Inbound Apps
Use the Management API to create Inbound Apps, rotate secrets, and manage consents programmatically.
For agentic identities (MCP server authorizations), use the dedicated Agentic Identity Management API to search and revoke access.
Try Refresh Session POST
Refresh the current session if it is valid, will not fail if the refresh token is missing or invalid
OAuth 2.0 authorize endpoint (GET) GET
Start the authorization code flow for an [Inbound App](/identity-federation/inbound-apps). Redirect the user-agent to this endpoint with `client_id`, `redirect_uri`, `response_type=code`, `scope`, `state`, and PKCE parameters. See [Authorization server endpoints](/identity-federation/inbound-apps/authorization-server) for the full flow.