Descope Node SDK — AIH token validation + programmatic management question Hi Descope team 👋 I'm integrating Descope's Agentic Identity Hub for MCP OAuth 2.1 and ran into an issue with the Node SDK (v1.9.1). When validating AIH-issued JWTs via validateSession(), it fails because the SDK extracts the project ID from the token's iss claim using token.iss.split('/').pop(). For AIH tokens, the issuer looks like https://api.descope.com/v1/apps/agentic/{projectId}/{resourceId} — so .pop() returns the resource ID, not the project ID. This causes the JWKS URL to be constructed incorrectly and validation fails. My workaround is using jose directly — fetching the JWKS from {issuer}/.well-known/jwks and validating with jwtVerify(). Works fine, but it'd be great if the SDK handled AIH issuers natively. Separate question — are there plans to add programmatic management of AIH features via the SDK or Management API? Things like creating/configuring MCP servers, managing registered clients, updating scopes and policies, etc. Right now this seems to be console-only, and for platforms that host many MCP servers (one per tenant/app), API-driven management would be really valuable for automating onboarding and configuration. Thanks!

Hey @Aaron Koivunen, let me check if we can raise a gh issue for this.