Custom Applications
A Custom Federated App is for cases where you still want Descope to own sign-in for an application — dedicated flow hosting, branding, and which users can access it — but the app does not speak OIDC, SAML, or WS-Federation to Descope as an Identity Provider.
Typical uses include an app that embeds Descope Flows or SDKs directly, a portal that only needs a hosted login URL, or any surface where you care about application assignment and ssoAppID in flows without configuring a federation protocol.
Note
Configuring additional federated applications (beyond the default) is a Pro+ feature.
How Custom differs from OIDC, SAML, and WS-Fed
| OIDC / SAML / WS-Fed | Custom | |
|---|---|---|
| Protocol | Descope is the IdP; the app (SP / RP) redirects using that protocol | No OIDC / SAML / WS-Fed exchange with Descope |
| What you configure | Protocol endpoints, ACS / reply URL, claims, etc. | Mostly the Flow Hosting URL (and app details) |
| When to use | The app expects a standard federation protocol | You host or embed Descope login yourself, but still want a Federated App record |
Custom apps still participate in user and tenant application assignment, and the Application ID is available in flows as ssoAppID for app-specific logic.
Creating a Custom Application
Navigate to Federated Apps and click + Application. Choose a template from the Application Library or create a Generic Custom Application. Provide an Application Name, and optionally an Application ID and Description.
Configuring a Custom Application
Application details
| Setting | Details |
|---|---|
| Application Name | Display name for the application (can be updated). |
| Application ID | Unique identifier (cannot be changed). Available in flows as the ssoAppID variable. |
| Application Description | Optional description of the application's purpose. |
Flow hosting
The main setting on a Custom app is the Flow Hosting URL — where users go to authenticate for this application. Use Descope Auth Hosting (pick a flow, style, theme, and optional tenant) or point at a self-hosted page that embeds a Descope flow.
Because there is no federation handshake afterward, your application is responsible for whatever happens after the flow completes (for example reading the session from the Descope SDK, or redirecting within your own product).
Next steps
- Associate users or tenants with the app under Federated Apps.
- Customize the hosted login experience in Auth Hosting.
- If the app does support a federation protocol, use OIDC, SAML, or WS-Federation instead.