September 2025 Summaries

The first-ever Descope Global MCP Hackathon brought together developers worldwide to create secure, identity-aware AI agents and MCP servers, offering $25,000 in cash prizes and $100,000 in developer credits. Participants showcased innovative projects that integrated AI with strong identity foundations to solve real-world problems. The top project, FutureCommit by Team CodeLatte, tackled developer collaboration issues by automating onboarding, documentation, and communication processes. Other notable projects included Travel AI Planner and Guardian of Mental Wellbeing, which streamlined travel planning and supported student mental health, respectively. In another challenge, Sheeter by Team sarthak647_7427 simplified the use of Google Sheets in AI workflows by transforming spreadsheets into secure APIs. Additionally, the hackathon featured advanced projects that demonstrated secure inter-agent communication, such as AI Fitness Agent by Team Confickers, which provided tailored fitness advice. The event highlighted the potential of AI agents and MCP servers in enhancing productivity and security across various domains, supported by sponsors like Anthropic, GitHub, and Cequence Security.

The Model Context Protocol (MCP) is an open standard designed to enable AI systems to interact with external tools and data in a standardized manner, utilizing OAuth 2.1 for secure authorization as it evolves to support remote server deployments. Initially, MCP allowed direct, local interactions between clients and servers, but the increasing need for network-based interactions necessitated a robust authorization model to protect sensitive data and operations. By leveraging OAuth 2.1, MCP introduces a framework that separates the roles of resource servers and authorization servers, aligning with enterprise security needs and allowing MCP servers to validate tokens issued by external authentication providers. Despite significant improvements in the June 2025 revision, challenges remain, such as SDK integration and token management, prompting ongoing community discussions and proposals for further enhancements. Descope simplifies the implementation of MCP authorization by providing SDKs that streamline OAuth integration, token management, and security hardening, thus enabling organizations to focus on developing AI applications without being bogged down by complex authorization processes.

Descope has successfully extended and closed its seed funding round, securing a total of $88 million in funding. The company offers a range of authentication and identity management solutions, with a focus on enhancing user authentication experiences for developers across various platforms such as Streamlit, Unreal Engine, and Svelte 5. Descope's offerings include features like Single Sign-On (SSO), Multi-Factor Authentication (MFA), passwordless login, and identity orchestration, aiming to address enterprise challenges in customer onboarding and secure API calling. The company actively engages with its community through tutorials, blogs, and a developers' hub, emphasizing innovation and security compliance in its operations.

Non-human identities (NHIs) such as services, agents, and API clients are increasingly prevalent in large organizations, with a current ratio of 20:1 compared to human identities. These NHIs handle production data, initiate transactions, and make decisions, but lack visibility compared to human sessions, making them a black box. Descope's Agentic Identity Control Plane provides essential visibility and auditing across the NHI lifecycle, comprising stages like registration, consent, connectivity, and termination. Descope logs granular audit events that help developers track when new apps are registered, when consents evolve, and when external connections are made, ensuring each identity operates with the least privilege necessary. This audit framework is crucial for maintaining security and operational integrity as NHIs dynamically register, request scopes, and connect to external systems. Descope also offers tools for extending visibility through custom audit events and integrating audit logs into existing observability stacks, thus facilitating a comprehensive understanding and management of NHIs.

Authenticator apps have emerged as a crucial tool in modern authentication strategies, offering a balance between enhanced security and user experience as cyber threats become more sophisticated. They generate time-based one-time passwords (TOTP) to provide a second verification layer, making unauthorized access challenging even if user credentials are compromised. Built on open standards like RFC 6238, these apps work across multiple platforms, offering a low-cost, high-impact security measure that integrates easily with identity and access management systems. While they improve security and offline functionality, challenges such as device dependency and potential friction in login processes remain. Authenticator apps are particularly beneficial in industries handling sensitive data, high-risk transactions, and regulatory compliance, where they offer additional protection against account takeovers and fraud. Solutions like Descope facilitate the integration of authenticator apps into systems, simplifying the implementation process and allowing organizations to focus on core operations while ensuring robust security.

Single sign-on (SSO) has evolved from a desirable feature to a fundamental expectation for enterprise systems, significantly benefiting both developers and businesses by reducing risk, cutting costs, and enhancing user engagement. The SSO market is projected to grow substantially, reflecting its importance in unifying authentication across apps and services. Key advantages of SSO include enhanced security through reduced password risks and centralized authentication, streamlined customer access management, easier compliance with regulatory frameworks, and tangible cost savings by minimizing password resets and optimizing resource usage. SSO also improves user experience by reducing the need for multiple logins and enhances productivity for developers and IT staff by simplifying authentication processes. Furthermore, SSO enables secure identity federation across organizational boundaries, facilitating seamless interactions with external partners and customers. Organizations are encouraged to implement best practices such as using modern protocols, pairing SSO with adaptive multi-factor authentication (MFA), and continuously monitoring and auditing login activities to maximize the impact of SSO on security, compliance, and user experience. Descope offers a simplified, no-code approach to SSO implementation, allowing businesses to integrate SAML or OIDC SSO quickly, ensuring flexibility and ease of use.

The tutorial by Thinus Swart offers a comprehensive guide on integrating authentication and multifactor authentication (MFA) into an Unreal Engine (UE) game using Descope, a flexible identity platform. It addresses the importance of secure authentication in game development, particularly for features like multiplayer and cross-device syncing. The tutorial walks through setting up Descope, creating a custom login widget in UE, and implementing OpenID Connect (OIDC) support for seamless login flows. It discusses different approaches to game authentication, including using storefront identity systems, purchasing plugins, or building custom solutions, highlighting Descope's advantages in bridging these options. The guide includes detailed steps for setting up a UE project, creating a user interface, and managing authentication workflows, concluding with a working login system that integrates social logins and fetches user profiles. Overall, the tutorial emphasizes the balance between user experience and security in game authentication systems.

Dynamic Client Registration (DCR) is crucial for scaling Model Context Protocol (MCP) deployments by allowing clients to register at runtime, but it also introduces significant security vulnerabilities due to its open nature. Remote MCP servers require robust protection as they are exposed to global threats, unlike local servers which naturally limit access to clients on the same network. The primary challenge is ensuring security while maintaining the scalability benefits of DCR, which is necessary for MCP's potential to connect limitless AI agents with servers. Emerging standards like SEP-991 propose using Client ID Metadata Documents to improve trust, although they are not yet officially part of the MCP specification. Practical solutions for hardening DCR implementations include implementing layered verification processes, using IP reputation services, and deploying risk-based controls. Descope offers a comprehensive identity infrastructure to address these vulnerabilities, integrating verification workflows and granular access control to ensure that DCR’s scalability does not compromise security.

User authentication is essential for modern applications, serving as the entry point to secure access and protect sensitive data, while also enhancing user experience and aiding compliance. It is crucial for both consumer apps and enterprise SaaS platforms. The blog focuses on external user authentication, highlighting various solutions like Descope, Microsoft Entra External ID, Okta Customer Identity Cloud, OneLogin, Amazon Cognito, Firebase Authentication, Keycloak, and Supabase Auth, each with unique capabilities and ideal applications. Descope stands out for its customizable, no-code authentication flows and multi-tenant support, making it suitable for both startups and scaling organizations. Meanwhile, other providers like Keycloak offer self-hosting flexibility, and Microsoft Entra External ID excels in enterprise governance, showcasing the diverse options available depending on an organization's specific needs, stack, and growth objectives.

The OAuth 2.0 Device Authorization Flow, often called Device Flow, is designed to facilitate secure authentication for devices with limited input capabilities, such as smart TVs, gaming consoles, and IoT devices, which present challenges for entering traditional credentials. This flow separates the authentication process from the device requesting access, allowing users to authenticate on a secondary device, like a smartphone, using a user-friendly interface. The process involves displaying a user code and URL on the device, which users can enter on another device to complete authentication. This method balances convenience with security by eliminating cumbersome password entry on constrained interfaces while maintaining OAuth's token-based security model. Device Flow proves beneficial in various real-world scenarios, including smart home devices, game consoles, and printer setups, by enhancing usability and security. It employs key OAuth components, such as access tokens and scopes, and utilizes endpoints for device authorization and token exchange. Security considerations include using high-entropy device codes and implementing measures against phishing attacks. Solutions like Descope offer APIs and workflows to simplify the deployment of Device Authorization Flows, ensuring a seamless user experience and adherence to OAuth security standards.

Descope has successfully extended and closed its seed funding round, securing a total of $88 million in funding. The company offers a range of identity and authentication solutions, including passwordless login, identity federation, and multi-factor authentication (MFA), and competes with other identity management platforms like Auth0, Ping Identity, and Okta. Descope provides a variety of resources for developers, including tutorials and open-source tools, and emphasizes its focus on security and compliance. The company maintains an active blog and social media presence, sharing insights on topics such as single sign-on (SSO), OAuth client registration, and the differences between passkeys and passwords. Descope also highlights customer success stories, such as transitioning from Ory Kratos to their platform, to illustrate the practical benefits of its offerings.

BalkanID, a company focused on AI-driven identity security and access governance, initially utilized the open-source authentication tool Ory Kratos due to its headless, customizable nature. However, they faced challenges with ongoing maintenance, versioning issues, and the need for custom multi-tenancy solutions, which diverted resources from their core product development. This led them to explore and eventually adopt Descope, a CIAM provider, which provided enterprise-grade features like multi-tenancy, SSO, and a visual flow builder that allowed for quick implementation without extensive engineering resources. Descope's solution enabled BalkanID to regain focus on product innovation and scale efficiently, highlighting the importance of choosing a robust external authentication solution when serving enterprise customers. The experience underscored the significance of prioritizing unique product features over reinventing authentication systems, especially for startups aiming for rapid market entry and growth.

In a notable development, Google announced the rollout of passkeys on World Password Day in 2023, marking a potential shift away from traditional passwords, which, although familiar, are fraught with security and usability issues. Passkeys, which utilize device-based cryptography and biometrics, aim to overcome these weaknesses by eliminating phishing risks, reducing user friction, and enhancing privacy. The transition to passkeys is gaining momentum, with major tech companies like Apple, Google, and Microsoft adopting them as a new standard for authentication. Passkeys offer a more secure, faster, and user-friendly alternative to passwords, leading to higher success rates in user logins, as evidenced by various studies and trials. While the complete replacement of passwords is not immediate due to existing systems and user habits, a hybrid approach where both methods coexist is currently being employed. Developers and organizations are encouraged to prepare for this change, with platforms like Descope offering tools to facilitate the integration of passkeys into existing systems.

Large language models (LLMs) like ChatGPT and Claude have revolutionized interaction with information, yet they face isolation challenges from real-world systems. The Model Context Protocol (MCP), developed by Anthropic, offers a solution by standardizing the integration of LLMs with external data sources and tools, thereby overcoming the "NxM problem" where numerous LLMs and tools require individual integration efforts. MCP simplifies development by providing a universal protocol for AI applications to interact with external systems, building on function calling to streamline tool specification and usage without custom integration. The architecture of MCP includes host applications, clients, servers, and a transport layer, utilizing JSON-RPC 2.0 for communication. With rapid adoption since its introduction, MCP supports various clients and servers, although security issues such as lack of authentication and over-permissioning remain challenges. The protocol is evolving with proposed enhancements like secure elicitation and progressive scoping, aiming to further standardize and secure LLM interactions with external systems, thereby reducing development overhead and fostering innovation across the AI ecosystem.

Access control is essential for securing applications and data, and there are three main models to consider: role-based access control (RBAC), attribute-based access control (ABAC), and policy-based access control (PBAC). RBAC assigns permissions based on predefined roles, making it simple and easy to audit, but potentially inflexible in dynamic environments. ABAC uses a combination of user, resource, and environmental attributes for fine-grained access decisions, offering flexibility but requiring strong governance. PBAC focuses on centralized policies that integrate roles, attributes, and context, providing unified control and scalability, especially in multi-cloud environments. Each model has its strengths, and the choice depends on an organization's structure, compliance needs, technical resources, and scalability goals. Often, a hybrid approach combining these models offers a balance of simplicity and flexibility, particularly for organizations with diverse and evolving access requirements. Platforms like Descope enable the implementation of these models or their combinations without complex coding, supporting scalable and secure access control solutions.

Implementing Descope for a CrewAI application involves setting up and managing identity and access control for a multi-agent system to enhance task specialization and scalability. The CrewAI platform distributes responsibilities across individual agents, with each agent assigned a specific role and scope, such as managing calendar events or retrieving contact information, to improve outcomes and avoid overload. The Descope Agentic Identity Hub facilitates secure authentication and permissions management, ensuring each agent has the minimal necessary access and that user consent is properly documented. The process includes configuring Google OAuth credentials and Descope outbound and inbound apps, allowing for secure token exchanges and session validation. This setup enables a coordinated, secure workflow where each agent operates with least-privilege access, ultimately producing a unified output and allowing for seamless integration with other APIs and systems.

Policy-based access control (PBAC) is an advanced identity and access management approach designed to offer dynamic and finely-tuned authorization by referencing centrally governed policies and considering contextual inputs like user identity and location. Unlike static models like role-based access control (RBAC) or attribute-based access control (ABAC), PBAC adapts to hybrid workforces and multi-cloud systems, ensuring secure, scalable, and compliant access management. It provides fine-grained control and centralized consistency, making it easier to manage permissions across complex environments and improve operational efficiency. However, PBAC presents challenges such as complexity in policy creation, potential performance strain, and the risk of policy sprawl, which require robust governance and testing strategies to mitigate. Common use cases include healthcare, finance, government, and multi-tenant SaaS platforms, where PBAC can enforce compliance and streamline access management. An effective PBAC implementation involves centralized policy management, simulation and testing prior to deployment, integration with existing identity systems, and regular policy updates to maintain security and adaptability as organizational needs evolve.

Integrating Single Sign-On (SSO) into a custom-built authentication system is a challenging task due to the complexity of protocols like SAML, OIDC, and OAuth, and the need to manage the entire SSO lifecycle, including metadata handling, domain routing, and integrating with Identity Providers (IdPs) like Microsoft Entra ID. These tasks become cumbersome as enterprise customers demand secure integration and full administrative control over authentication and access policies. Descope offers a solution by providing an out-of-the-box platform to extend existing authentication systems with enterprise-ready SSO support. This allows companies to maintain their existing login systems while leveraging Descope to handle the complex aspects of SSO, such as protocol intricacies and tenant routing. By using Descope, businesses can provide seamless login experiences, meet enterprise security expectations, and reduce the operational burden of maintaining custom integrations.

Developers face the challenge of balancing security, user experience, and ease of implementation when managing access control in applications, and two widely used methods to address this are role-based access control (RBAC) and attribute-based access control (ABAC). RBAC is simpler and relies on predefined user roles to grant access, making it suitable for organizations with clear, stable roles but less adaptable to complex scenarios, which can lead to issues like "role explosion." In contrast, ABAC offers more flexibility and precision by using dynamic rules based on user, asset, and environmental attributes, making it ideal for complex, regulated environments but at the cost of higher implementation and maintenance complexity. A hybrid approach, combining the simplicity of RBAC for standard access with ABAC's contextual awareness for sensitive scenarios, can offer a balanced solution. Tools like Descope's no-code CIAM platform help streamline the integration of these access control methods, reducing operational overhead for developers.