September 2026 Summaries

Descope has introduced Family Accounts, a relational identity feature designed for consumer applications that need to manage relationships among guardians, dependents, and households without relying on shared credentials or custom middleware. The platform supports credential-free dependent profiles, multiple independent guardians with separately auditable actions, and family-scoped roles and attributes that allow individuals to hold different permissions across multiple families. Available through the Descope console and Management APIs, the feature is intended for uses such as guardian access in healthcare, custodial fintech accounts, and household media plans, where users may require different levels of access or belong to multiple households. Family Accounts is the first part of Descope’s broader relational identity roadmap, which plans to add dual approval workflows, profile context switching, and age-based permission transitions.

Healthtech identity needs typically expand from basic patient logins to multi-tenant systems serving patients, clinicians, caregivers, administrators, enterprise customers, EHR integrations, and AI agents, raising security and compliance concerns around protected health information. The material recommends planning a shared, multi-persona identity architecture; offering self-service SAML or OIDC SSO, SCIM provisioning, delegated administration, and audit logs; replacing passwords and routine SMS codes with passkeys, magic links, and adaptive MFA; and combining role-, attribute-, and relationship-based controls to enforce least-privilege PHI access. It also advises making SMART on FHIR flows configurable on OAuth 2.0 and OIDC foundations, assigning AI agents distinct scoped and auditable identities, and modeling guardians and dependents as separate accounts with relationship-specific permissions. Descope is presented as a platform intended to provide these capabilities, with examples describing Collabrios Health’s consolidation of legacy identity systems and b.well Connected Health’s phased migration from Amazon Cognito.

The comparison presents Descope and Frontegg as B2B identity platforms that support authentication, multi-tenancy, enterprise SSO, SCIM provisioning, authorization, and related security features, while emphasizing different implementation models. Frontegg is characterized as an SDK- and API-driven platform with prebuilt components that can speed initial development but may require additional custom engineering for complex tenant structures, evolving user journeys, granular authorization, and integrations. Descope is presented as a tenant-first, no/low-code alternative that combines visual workflow configuration with self-service SSO and SCIM setup, standards-based SAML/OIDC support, adaptive MFA connectors, passkey fallback options, and unified RBAC, ABAC, and ReBAC authorization. The piece also contrasts their approaches to AI agent and MCP authorization, describing Descope as offering OAuth 2.1-based per-server resources and credential management, while portraying Frontegg’s offerings as more focused on policy enforcement. A Token Security customer example claims that Descope enabled unified access controls for human users and AI agents, accelerated self-service enterprise provisioning, and reduced the need for application code changes.

Descope has expanded its data residency options to seven regions across four continents by adding Singapore, Brazil, and the United Kingdom to existing locations in the United States, European Union, Canada, and Australia. The company argues that identity systems receive particular residency scrutiny because they centralize sensitive personal information, authentication factors, session records, and audit logs, meaning an application’s in-region database may not fully address compliance concerns if its identity provider processes data elsewhere. Each Descope project is assigned to a single region at creation, where its user data, tenant records, configurations, flows, and authentication settings remain without cross-region replication or later migration. Applications serving multiple jurisdictions must therefore create separate regional projects, typically using regional authentication domains and selecting the appropriate configuration based on user location, preferences, or tenant rules. The approach is positioned as relevant to both global organizations managing varied regulatory obligations and smaller companies responding to enterprise customers’ security and compliance requirements, with multi-region residency included in Descope’s Growth and Enterprise plans.

The tutorial explains how to build a Next.js App Router hackathon application using Auth.js v5, formerly NextAuth, for session management and Descope as the identity provider for passwordless, social, and other login methods. It covers configuring the official Descope provider through an auth.ts file, App Router route handlers, and environment variables; creating a custom sign-in button that redirects users to Descope’s hosted login flow; and protecting a server-rendered dashboard by validating sessions with the auth() function. The example application retrieves attendee application and acceptance information from Airtable through a protected API route, although the route shown uses a separate secret-token check. It also describes Auth.js’s default JWT session model, in which signed tokens are stored in HTTP-only cookies and can scale without a shared session database, while noting that database sessions may be preferable when immediate revocation is required. Finally, it compares Auth.js as a self-managed session layer with Descope as a managed customer identity platform, explaining that they can be used together or that Descope SDKs can provide native authentication for Next.js, React, and Node.js applications with less custom configuration.

SAML decoders convert Base64-encoded SAML responses and requests, including DEFLATE-compressed HTTP-Redirect messages, into readable XML that can be inspected when single sign-on failures occur, though decoding alone does not validate signatures or assertions. The process involves capturing the SAMLResponse or SAMLRequest from browser developer tools and using a browser-based tool such as Descope’s SAML Guru to decode it locally. Troubleshooting should focus on fields commonly responsible for failures, including the response status, ACS Destination and Recipient URLs, IdP Issuer, signing certificate and signature requirements, NameID format and stability, InResponseTo request correlation, assertion validity windows and clock synchronization, Audience entity ID, and user attribute mappings for profiles, groups, and roles. Typical remedies include correcting IdP and service-provider configuration, refreshing metadata and certificates, preserving request state across infrastructure, synchronizing clocks with NTP, and aligning attribute names and formats between systems.

REST APIs and the Model Context Protocol (MCP) serve complementary roles rather than competing as alternatives: APIs provide deterministic, developer-defined connections between systems, while MCP enables AI models to discover and invoke available tools dynamically at runtime. REST calls require developers to know endpoints, parameters, authentication, and expected responses in advance, making them well suited to predictable, high-volume, latency-sensitive workflows such as payments, logins, and scheduled automation. MCP uses mechanisms such as tool discovery and structured tool calls so AI agents can translate natural-language goals into actions, with authorization generally managed through an initial OAuth-based connection and safeguards such as scoped permissions and approval for sensitive operations. A Descope example shows both methods retrieving the same user data through the same Management API: a direct REST request uses a predefined endpoint and credentials, while an AI assistant uses the Descope MCP Server to identify the project, inspect operation schemas, correct an invalid parameter, and return a natural-language result. The comparison emphasizes that MCP commonly acts as a runtime consumption layer over existing APIs, allowing organizations to use direct APIs for fixed, testable operations and MCP for agent-driven tasks whose required actions are not known until runtime.

MCP Apps enable AI assistants such as Claude and ChatGPT to render interactive interfaces for tool calls, including maps, forms, and booking widgets, but securing these applications requires OAuth implementation. Skybridge, a TypeScript framework for building MCP Apps, integrates with Descope through its descopeProvider to supply OAuth metadata, token verification, scope enforcement, consent flows, and Dynamic Client Registration without requiring developers to build authentication infrastructure themselves. Developers can use Skybridge’s auth-descope reference project, configure an MCP Server resource and issuer URL in Descope, and launch an OAuth 2.1-protected app within minutes. The integration is positioned as particularly useful for organizations already using Descope because it connects MCP Apps to a unified identity system with shared users, audit trails, policies, inbound client authentication, and outbound token management for third-party APIs.

Cross-App Access (XAA) is an identity pattern in which an enterprise identity provider brokers one application’s access to another application’s API or MCP server on a user’s behalf, replacing separate API keys or individual consent flows while leaving final authorization decisions to the resource application. ID-JAG, or Identity Assertion JWT Authorization Grant, is the IETF standards-track draft that defines the associated token exchange: a requesting application trades a user identity token for a short-lived, signed assertion targeted to a specific resource authorization server, which validates it and issues its own access token. Enterprise-Managed Authorization (EMA) is a stable, opt-in Model Context Protocol extension that applies XAA and ID-JAG to let administrators preauthorize MCP clients to connect to MCP servers for their users. Although the terms are often used together, XAA describes the broad access pattern, ID-JAG describes the technical grant and assertion, and EMA describes the MCP-specific administrative capability. EMA governs whether a connection is permitted and at which scopes when the token is issued, while ongoing controls over an agent’s actions remain the responsibility of the resource server through its access-token policies and per-tool or per-scope enforcement.

Descope has made Cross-App Access (XAA) generally available through its Agentic Identity Hub, enabling enterprises to manage AI agent access to APIs and Model Context Protocol (MCP) servers through their existing identity providers. Built on the ID-JAG token-exchange standard and adopted as an Enterprise-Managed Authorization extension to MCP, XAA replaces long-lived shared API keys and repetitive OAuth consent flows with short-lived, scoped assertions issued according to company policy. Descope supports both validating ID-JAG tokens for organizations exposing MCP servers and issuing them for organizations operating internal agents, allowing access policies, tenant-specific trust, scopes, and audit logging to be centrally managed. The platform also provides self-service setup for tenant administrators and works with standards-compliant providers such as Okta and Ping. Examples include customer-facing analytics MCP servers whose clients can control agent access from their own identity systems, and internal enterprise agents that require governed access across third-party services. For systems not yet supporting ID-JAG, Descope offers connections that manage OAuth tokens or API keys while retaining policy enforcement.