Trusted Devices in Flows

A trusted device lets a user skip additional checks, such as MFA, on a device the user already verified. Trusted devices reduce friction for returning users while keeping MFA in place for new or unrecognized devices.

In a flow, you mark a device as trusted after the user authenticates, then check riskInfo.trustedDevice on later sign-ins to decide whether to ask for MFA.

Requirements

Descope remembers a trusted device with a trusted device token. Where Descope keeps that token depends on how your project manages session tokens:

• Cookies: Descope sets the trusted device token in an HttpOnly DTD cookie on your project's cookie domain. If you manage tokens in cookies, trusted devices require a custom domain, which is available on the Pro tier and higher.
• Local storage: Descope returns the trusted device token as trustedDeviceJwt in the authentication response. The Descope web SDK stores the token in local storage and sends the token back in the x-descope-trusted-device-token header on later requests.

Trusted devices do not require the Fingerprint Assess action.

Mark a Device as Trusted

After the user authenticates, you can mark the device as trusted in one of two ways:

• Let the user choose: Add a Trust This Device checkbox to a screen, so the user decides whether to trust the device.

  

• Mark the device automatically: Add the Mark Device As Trusted action to your flow.

  

Check for a Trusted Device

On later sign-ins, add a condition on riskInfo.trustedDevice with the Is True operator:

• If riskInfo.trustedDevice is true, skip MFA and continue the flow.
• Otherwise, send the user to the MFA steps.

Example Flow

The following flow checks whether the device is trusted. A trusted device skips MFA, and a new device goes through MFA. After MFA succeeds, the flow asks the user whether to trust the device. When the user agrees, the flow runs the Mark Device As Trusted action.

For a step-by-step adaptive MFA guide that uses trusted devices, see Adaptive MFA.

How Long a Device Stays Trusted

A device stays trusted until one of the following happens:

• The Trusted Device Token Timeout in your project settings expires. See Trusted Device Token Timeout.
• The user signs out of the device in the Trusted Devices component of the User Profile Widget. Signing out removes the trust for that device, so the next sign-in from the device goes through MFA again.

In the User Profile Widget, users can see and sign out of their own trusted devices. To show trusted devices without letting users sign out of them, set the Trusted Devices component to Read only in the widget editor. Admins currently cannot see a user's trusted devices.

Trusted Devices and Known Devices

The Mark Device As Known action sets a separate, weaker signal. Descope keeps the known device token in a DKD cookie. When you manage tokens in local storage, the Descope web SDK stores the token and sends the token back in the x-descope-known-device-token header.

Every trusted device also counts as known, so knownDevice is true on a trusted device even if the flow never ran Mark Device As Known. The reverse is not true. A known device does not skip MFA.