Hi. Feels like a bug. I configured a "Generic OAuth Provider" on a Microsoft Teams Bot to authenticate via Descope. I encountered two different bugs: 1. When using the default Federated App - The flow redirects me to an old domain of ours "auth.demo.valkyrie.io" instead of "auth.dev.app.valkyrie.io". On the

.well-known

the domain that appears is the "auth.dev" and not the demo one. 2. I tried to create a different, new Federated App. On this federated app the domain was fine, "auth.dev.." and the flow completed successfully. Having said that, the issuer is the federated app ID instead of the project ID. When my BE validates the token with Descope it errors on

Invalid descope issuer, token issuer (project ID) should match the descope project ID

with issuer:

SA3AEAxizR13ZOFjMmWRlJWcrtn6e

instead of

SA3AEAxizR13ZOFjMmWRlJWcrtn6e

Project ID:

SA3AEAxizR13ZOFjMmWRlJWcrtn6e

Please assist. Thanks.

Issue Analysis You've identified two distinct problems with your federated app configuration. Problem 1: Domain Redirect Issue 1. Check your Approved Domains in Project Settings - Navigate to Project Settings - Ensure "auth.dev.app.valkyrie.io" is listed in Approved Domains - Remove "auth.demo.valkyrie.io" if it's still listed there 2. Verify your federated app redirect URIs - Go to your federated app settings - Confirm redirect URIs use the correct domain The redirect domain comes from your Approved Domains configuration , not just the

.well-known

endpoint. Problem 2: Issuer Mismatch The JWT issuer claim in your new federated app is using the app ID instead of project ID. This happens when using non-OIDC-compliant JWT templates. 1. Navigate to JWT Templates 2. Create or switch to an OIDC-compliant template 3. Ensure the issuer format is:

<https://api.descope.com/SA3AEAxizR13ZOFjMmWRlJWcrtn6e>

The standard issuer in OIDC-compliant templates should be

<https://api.descope.com/v1/apps/__ProjectID__>

, which matches your project ID for validation. • Pre-existing projects may have shorter issuer formats until you switch to OIDC-compliant templates • Your backend validation expects the project ID as issuer Project Settings | Descope Documentation AWS AppSync | Descope Documentation Authenticating APIs With JWT Authorizers and OIDC

Hey @Or Vaknin For item 1 - double check the old domain isn't referenced on the default federated app - we had a bug when cloning or importing a project where it didn't take the new domain, and retained the old, so the callback or domain of the hosted flow URL on the default app might be wrong.

The AI actually helped lol

I was actually just looking over the second item and was going to also go down the default OIDC jwt structure. Glad AI helped here birthday party parrot