Private Cloud Deployments
Note
Your Descope CS or SE contact will typically provision these environments for your company.
They will then share the hostnames, IPs, and onboarding steps that apply to your account, so you can complete the onboarding.
A private cloud deployment is a separate Descope environment provisioned for your company. It is not the shared public SaaS hosts (api.descope.com, api.euc1.descope.com, and so on).
Private cloud is commonly used when you need an isolated environment, stricter network controls, or a compliance program such as FedRAMP.
How Private Cloud Differs from Public SaaS
| Public regional SaaS | Private cloud | |
|---|---|---|
| Provisioning | Create projects on descope.com | Provisioned with Descope CS / CSE |
| API host | Fixed per region (see Multi-Region Support) | Environment-specific (for example https://api.<env>.descope.app) |
SDK baseUrl | Usually inferred from Project ID | Must be set explicitly |
| Static IPs | Published per region | Provided by your CSE |
| Custom domain CNAME | Regional targets in Custom Domain | Provided by your CSE |
| Some features | Available on standard plans | May require Support to enable (see below) |
Base URLs and SDK Configuration
Private cloud environments use environment-specific hostnames. Dedicated environments are often named star1, star4, and similar.
The SDK cannot infer the correct API host from the Project ID alone. Set baseUrl (and baseStaticUrl where your stack supports it) to the hostname Customer Success provides, or derive the scheme and host from the OpenID Connect discovery URL on the default Federated application in the Console.
Example for an environment named star4:
<AuthProvider
projectId="__ProjectID__"
baseUrl="https://api.star4.descope.app"
baseStaticUrl="https://api.star4.descope.app/pages"
>
<App />
</AuthProvider>The same host applies to Management API calls, OAuth discovery, Flow traffic, and issuer URLs on inbound apps. For background on when baseUrl is required, see Multi-Region Support → Descope Base URLs and Base URL Configuration.
Networking
Custom domains
You can still use a custom domain on private cloud. The CNAME target is not the public regional value — your CSE provides the correct target for your environment.
Static IPs and Firewalls
Public regional static IP lists do not apply to private cloud. Request your environment's project and connector static IPs from your assigned CSE when configuring firewalls, IdP allowlists, or Zscaler rules.
For connector actions against resources inside your network, you may also deploy the Descope Engine (outbound-only gRPC). That pattern is common in locked-down and FedRAMP deployments.
Feature Availability
Some capabilities are tied to a specific public endpoint or require explicit enablement on dedicated environments. When a feature doc mentions private cloud, it usually means contact Support or your CSE before you rely on it in production.
| Feature | Private cloud notes |
|---|---|
| Descope MCP Server | Not on public mcp.descope.com / mcp.euc1.descope.com URLs. Contact Support to enable and receive your MCP endpoint. |
| Early-access product features | Often enabled per environment on request. |
| Connectors | Available; static connector IPs and Engine setup are environment-specific. |
Check the feature's own doc for a private-cloud callout, and use this page as the default when you need environment-specific hostnames or enablement.
FedRAMP and Other Compliance Programs
FedRAMP High is a dedicated deployment model with its own onboarding, security guide, and connector patterns (including Descope Engine for private-network integrations). Most FedRAMP customers work through Customer Success rather than the standard SaaS checklist.
If you are evaluating FedRAMP specifically, start with Working with Descope on FedRAMP.
For general dedicated environments that are not FedRAMP, the sections above still apply.