*between 4 and 5 sorry 🙂

Can you confirm your frontend tech stack so I can give you working solution based on your frontend

i plan to write this logic in go if that matters.

Your approach will work with Descope's Auth Hosting Application. Here's how to implement it: Flow Setup: 1. User accesses your API 2. Check for valid JWT in DS cookie 3. If not authenticated, redirect to

<https://auth.descope.io/><YOUR_PROJECT_ID>?flow=<flow_id>

Doc 4. User completes the flow 5. Descope sets the DS cookie and redirects back to your app Key Configuration: If your project settings are configured to manage session tokens in cookies, Descope services will automatically set the session token in the DS cookie as a Secure and HttpOnly cookie Doc. This means the session token will be stored in the browser and will be accessible for authentication checks. You'll need to configure your redirect URI in the Descope console. The redirect URI must be pre-registered and match exactly (including scheme, subdomain, domain, path, and port) Doc. Available Query Parameters: When redirecting to the Auth Hosting App, you can use: • `flow`: Specifies which authentication flow to run (e.g.,

?flow=login

) • `tenant`: For multi-tenancy scenarios (e.g.,

?tenant=example_tenant

) • `bg`: Changes background color or image • `debug`: Shows detailed flow errors in console • `style`: Runs a specific style for your application • `theme`: Enforces a specific theme After authentication, Descope will redirect back to your configured callback URL with the DS cookie set, allowing your API to verify the JWT on subsequent requests.