Passwordless authentication for your AI stack. Use Descope's magic links, passkeys, and social logins with local LLMs through Attach Gateway.
Descope makes passwordless auth easy. Attach makes it work with LLMs. Together:
Attach validates Descope JWTs automatically. Passwordless, MFA, and social logins all work.
Exchange Descope tokens for downstream service tokens. Perfect for multi-service architectures.
Magic links, passkeys, and biometrics. Modern auth for your AI applications.
From your Descope console, grab your project ID and create an API key.
# Descope Console > Project Settings Project ID: P2abc123... # Create a management key for token exchange (optional)
export AUTH_BACKEND=descope export OIDC_ISSUER=https://api.descope.com/P2abc123 export OIDC_AUD=your-api-identifier # Optional: Enable token exchange export ENABLE_DESCOPE_EXCHANGE=true export DESCOPE_PROJECT_ID=P2abc123 export DESCOPE_CLIENT_ID=your-client-id export DESCOPE_CLIENT_SECRET=your-secret attach-gateway --port 8080
// In your frontend (React example)
import { useDescope } from '@descope/react-sdk';
const { user, getSessionToken } = useDescope();
const token = await getSessionToken();
// Use token with your LLM requests
fetch('http://localhost:8080/api/chat', {
headers: { 'Authorization': `Bearer ${token}` },
// ...
});# Without valid Descope token: 401 Unauthorized # With valid token: Request forwarded to LLM # User identity available in X-Attach-User header
Need to exchange Descope tokens for different scopes or audiences? Attach supports Descope's token exchange flow for complex multi-service architectures.
Enable with ENABLE_DESCOPE_EXCHANGE=true
Passwordless removes friction for developers accessing AI tools. Magic links and passkeys are faster than remembering passwords, and they're more secure—no credentials to phish or leak. For internal AI tools, this means higher adoption with better security.
Token exchange is useful when your LLM service needs to call other APIs on behalf of the user. For example, if your AI assistant needs to access a user's calendar or email, you can exchange the Descope token for a scoped token for those services.
Yes, but typically through a browser flow. Your CLI initiates auth, opens a browser for passkey verification, then receives the token via callback. Descope handles this flow elegantly, and Attach accepts the resulting JWT like any other OIDC token.
Absolutely. Descope offers migration tools for importing users. Since Attach is IdP-agnostic, you just update your OIDC_ISSUER environment variable—your LLM applications don't need any code changes, only new tokens from the new provider.
Connect Descope to your AI stack in under 5 minutes.