OIDC Federated Applications

Configure a Federated Application to use Descope as an OpenID Connect (OIDC) Identity Provider. Your application redirects users to Descope for authentication, Descope runs your configured flow, and returns a validated identity token. Standard OIDC protocol throughout — no custom auth logic required.

Creating an OIDC Application

Navigate to Applications and click + Application. Choose a template from the Application Library or create a Generic OIDC Application.

Provide an Application Name and optionally an Application ID and Description.

Configuring the Application

Once created, configure your application in the Descope Console:

Application details

Identity provider settings

Configuring your OIDC client

Configure your OIDC client (Service Provider) with the following:

Required parameters

• Client ID: Your Descope Project ID (find it here)
• Client Secret: A Descope Access Key (create one here)
• Issuer or Discovery URL: Use one of these from your application configuration:
  • Issuer URL (recommended): https://api.descope.com/<Project ID>
  • Discovery URL: https://api.descope.com/<Project ID>/.well-known/openid-configuration

You can also configure endpoints individually:

Scopes

Force Authentication

By default, users already signed in to Descope are redirected back without re-authenticating (standard SSO behavior). To force re-authentication, either include prompt=login in your /authorize request or enable Force Authentication in the application settings.

Well-Known OIDC configuration

The Discovery URL returns a JSON document with all OIDC configuration details, allowing clients to configure themselves automatically:

{
  "issuer": "https://api.descope.com/__ProjectID__",
  "jwks_uri": "https://api.descope.com/__ProjectID__/.well-known/jwks.json",
  "authorization_endpoint": "https://api.descope.com/oauth2/v1/authorize",
  "token_endpoint": "https://api.descope.com/oauth2/v1/token",
  "userinfo_endpoint": "https://api.descope.com/oauth2/v1/userinfo",
  "end_session_endpoint": "https://api.descope.com/oauth2/v1/logout",
  "revocation_endpoint": "https://api.descope.com/oauth2/v1/revoke",
  "response_types_supported": ["code"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "scopes_supported": ["openid", "profile", "email", "phone"],
  "claims_supported": [
    "iss", "aud", "iat", "exp", "sub",
    "name", "email", "email_verified",
    "phone_number", "phone_number_verified", "picture"
  ],
  "token_endpoint_auth_methods_supported": []
}

Advanced configuration

Custom claims

Custom claims let you include application-specific user information in the ID token.

1. Add the descope.custom_claims scope to your OIDC client configuration.
2. Define the claims using one of these methods:
   • A Custom Claims action in your flow
   • JWT Templates
   • The Management SDK or API

Tenant, roles, and permissions

Add the descope.claims scope to include authorization information in the ID token. This returns the user's tenants, roles, and permissions in a tenants claim:

{
  "sub": "U2XDs389PTVB8xtfRlixPb4luUD7",
  "email": "user@example.com",
  "tenants": {
    "<tenant_id>": {
      "permissions": ["SSO Admin", "User Admin"],
      "roles": ["Tenant Admin"]
    }
  }
}

See Role-based access control for configuring roles and permissions.

Adding Claims to the Well-Known Configuration

Some OIDC clients (like Docebo) require specific claims to be listed in claims_supported. Add them in the Supported Claims setting of your application. The defaults are:

["iss", "aud", "iat", "exp", "sub", "name", "email", "email_verified",
 "phone_number", "phone_number_verified", "picture", "family_name", "given_name"]

Flow Hosting

Configure the authentication page users see during the OIDC redirect using the gear icon next to Flow Hosting URL in your application settings.

See Auth Hosting for all available options — custom domains, styling, background images, and self-hosted flows.