End Action
The End action terminates the flow and returns Descope tokens, successfully authenticating the user.
End without Session
When enabled, the flow ends without issuing or returning a session — no JWT, user, cookies, login event, or trusted-device JWT. The user keeps any session they already had.
Use this for flows that should complete without logging the user in (e.g. the user-profile widget, or a deliberate no-login outcome).
Custom Cookie Names
When you manage tokens in cookies, Descope uses DSR for the refresh token and DS for the session token by default. If you need different names — for example, because multiple Descope projects share the same root domain — you can override them here on the End action.
Refresh Cookie Name
By default, Descope refresh tokens managed with cookies are returned in a cookie named DSR.
The Refresh Cookie Name field lets you set a custom name (for example refreshToken) instead.
Session Cookie Name
By default, most Descopers don't manage session tokens as backend cookies and instead rely on the tokens returned in the response body.
However, our client SDKs automatically set the session token as a non-HttpOnly cookie, and you can enable the same behavior by turning on the sessionTokenViaCookie parameter in your AuthProvider.
By default, Descope session tokens managed with cookies are returned in a cookie named DS.
The Session Cookie Name field lets you set a custom name (for example sessionToken) instead.
External Token Connector
When a flow completes, Descope can return a provider token (externalToken) from a Firebase, Supabase, or custom connector. By default, flows use the connector you selected under External Token in Session Management.
If you want to use a different External Token connector than what's configured in Session Management for all flows within your project, you can set a flow-specific External Token Connector here.
Configure connectors first under External Token connectors. See External Token for full setup.
Return Token after Flow
By default, a JWT is only issued when a flow involves user authentication.
The Return token after flow (without user authentication) option allows a JWT to be returned on flow completion even if no user login occurs.
This is useful for triggering connector logic, running risk or fraud assessments, or supporting flows that require a signed token for secure communication with downstream services without authenticating a user.
Using Messaging Templates
This article will show you how to customize email, voice, and sms templates for OTP, enchanted link, and magic link within Descope flows.
External Authentication
Use the External Authentication flow action to redirect users to your existing login page and complete authentication.