Rishti Suman Dey
03/16/2026, 12:04 PMChris Carper
03/16/2026, 2:13 PMRishti Suman Dey
03/17/2026, 9:32 AMChris Carper
03/17/2026, 6:10 PM<script>
const sdk = Descope({ projectId: "__ProjectID__", persistTokens: true });
const sessionToken = sdk.getSessionToken();
const currentPath = window.location.pathname;
// List the paths of the 8 pages that require SSO/auth
const protectedPaths = [
'/protected-page-1',
'/protected-page-2',
// ...add all 8 paths here
];
const isProtected = protectedPaths.some(path => currentPath.startsWith(path));
if (isProtected) {
if (!sessionToken || sdk.isJwtExpired(sessionToken)) {
if (currentPath !== '/login') {
window.location.replace('/login');
}
}
}
</script>
This goes in Site Settings → Custom Code → Footer Code, replacing the default snippet from the docs.
Summary of steps:
1. Add the Descope web-js-sdk to the site-wide Head Code in Webflow Settings → Custom Code. descope
2. Create a /login page with the Descope web component embedded via an HTML Embed element. descope
3. In the Footer Code, use the path-based script above instead of the default global redirect — listing only the 8 protected page paths.
4. The 4 pages in the other folder are simply not in the protectedPaths array, so they load freely without auth.
This approach requires no changes per-page — it's all managed from one central script. If Webflow folders have consistent URL prefixes (e.g., /members/... vs /public/...), the check can be simplified to a single startsWith('/members') instead of listing each path individually.
@Mrunank Pawar should we update the doc?Rishti Suman Dey
03/31/2026, 6:28 AM