External Token Connectors
External Token Connectors in Descope enable hybrid authentication by allowing you to generate custom tokens at the end of authentication flows. These connectors allow you to keep using your existing token format and infrastructure—whether it's Firebase, Supabase, or a custom token format—while leveraging Descope Flows for identity orchestration.
How External Token Connectors Work
External Token Connectors are configured in the Connectors page and generate tokens when a flow completes:
- The configured token connector is invoked automatically
- The connector generates a token in the format you've configured (Firebase, Supabase, or custom)
- The external token is included in the authentication response alongside Descope's session tokens
- Your backend can use the external token for authorization and integration with existing services
Note
If External Token is enabled at a flow level, it will override the project level setting.
After you create a connector, enable it in either of these places:
- If you want the same external token for every flow, enable it at the project level under Session Management → External Token.
- If you only want it for certain flows, or different flows should use different connectors, set External Token Connector on each flow's End action instead.
See External Token for the full feature setup.
The token is returned in the authentication response's externalToken field.
Available External Token Connectors
Descope supports various platforms and custom token formats. Each connector is configured through the Connectors page in the Descope Console.