Hey folks - I am trying to build OAuth silent auth. The ideal flow looks like this: 1. User goes to our descope-hosted custom domain URL auth.example.com, signs in. It redirects to app.example.com (lets say our application is hosted here) 2. app.example.com uses a silent iframe way of authenticating the user using the

prompt=none

flow a. The iframe will redirect to a callback page that will have the OAuth code 3. We issue our own JWTs for session management (we arent using Descope for session management) Blockers: 1. iframe errors out because of the presence of a header

x-frame-options: SAMEORIGIN

a. Created a ticket for this already

TKT-1102

. They mentioned they removed this header, but haven't. b. I am testing my flows by using the "Ignore X-Frame-Options Header" extension on Firefox Questions: 1. Do we use Federated apps or Inbound Apps for this? a. There is a "OIDC default application" in Federated apps section, but cant configure authorized redirect urls here 2. I tried creating an Inbound App and configured it: a. It asks for a flow URL, how do I use the auth.example.com URL instead of descope? Is it just replacing the domain? i. Right now it is

<https://api.euc1.descope.com/login/>...

b. Iframe silent auth with OAuth Authorize URL config:

<custom auth domain>/oauth2/v1/apps/authorize?client_id=<CLIENT_ID>&redirect_uri=<http://localhost:3000/silent-auth-callback&response_type=code&state=><random>&nonce=<random>&prompt=none

i. I get a

303

to

<https://api.euc1.descope.com>

ii. It never gets redirected back regardless of logged in status. Our expected flow: 1. If not logged in, redirect to redirect URL with an error 2. If logged in, redirect to redirect URL with the code

Hey @Siddharth Venu Let me take a look into this and I will update you as soon as possible.