is there an easy way to set custom cookie for the user during a flow?

Custom Cookie Configuration Yes, you can set custom cookies during a flow using two approaches: End Action Cookie Names Configure custom cookie names for session and refresh tokens in your flow's End action . This is required when managing tokens as httpOnly cookies from the Descope Console . Client SDK Cookie Configuration Set custom cookie properties in your client SDK configuration:

<AuthProvider
  projectId="your-project-id"
  sessionTokenViaCookie={{ 
    sameSite: 'None', 
    secure: true, 
    cookieName: 'sessionToken' 
  }}
  baseUrl="https://auth.app.example.com"
>
  <App />
</AuthProvider>

Available Cookie Options • `cookieName`: Custom session token cookie name (default:

DS

) • `sameSite`: Cookie same-site policy (

Strict

,

Lax

,

None

) • `secure`: HTTPS-only cookie flag For additional custom cookie logic beyond authentication tokens, you can use Scriptlets within your flow for custom JavaScript data manipulation . Descope Component Guide | Client SDK | Descope Documentation Flows Overview | Descope Documentation

not the session cookie, I want to add custom-cookie with custom-value

Setting Custom Cookies in Flows Descope flows don't have direct cookie-setting capabilities, but you have two approaches: HTTP Connector Approach Use an HTTP connector to call your backend API that sets the cookie: 1. Add an HTTP connector to your flow 2. Configure it to call your backend endpoint 3. Your backend returns a

Set-Cookie

header 4. Enable "Include response headers in Context" to access headers in flow context

// Your backend endpoint response
{
  "Set-Cookie": "customCookie=customValue; Path=/; HttpOnly"
}

Client-Side Approach Handle cookie setting in your application after flow completion:

// In your flow success handler
onSuccess: (result) => {
  document.cookie = "customCookie=customValue; path=/";
  // Continue with your app logic
}

Scriptlet Limitations While Scriptlets allow custom JavaScript within flows , they run server-side and cannot directly set browser cookies. They're useful for data manipulation but not cookie operations . The HTTP connector approach is recommended if you need server-controlled cookie setting during the authentication flow. Connectors in Flows | Descope Documentation Generic HTTP Connector | Descope Documentation Flows Overview | Descope Documentation Flows Overview | Descope Documentation

how to enable "Include response headers in Context"

Enable Response Headers in HTTP Connector Configure this setting in your HTTP connector configuration: In Connector Settings 1. Go to your HTTP connector configuration page 2. Find the "Include response headers in Context" option 3. Enable this checkbox Access Headers in Flow Once enabled, response headers are available in your flow context as `context.headers`:

{
  "customHeader": "My header value",
  "Set-Cookie": "customCookie=value; Path=/",
  ...
}

Use Cases • Extract custom headers from API responses • Use header values in Custom Claims actions • Add header data to JWT tokens This setting must be configured at the connector level, not in the individual flow step. The headers will then be accessible in subsequent flow actions and conditions. Generic HTTP Connector | Descope Documentation

i have enabled "include response headers in context" and my http connector is setting the cookie Response: {"body":{"legacyLogin":"yes"},"headers":{"access-control-allow-credentials":"true","access-control-allow-headers":"Content-Type","access-control-allow-methods":"GET, POST, PUT, DELETE, OPTIONS","access-control-allow-origin":"http://localhost:5173","content-length":"21","content-type":"application/json; charset=utf-8","date":"Thu, 19 Mar 2026 164244 GMT","etag":"W/\"15-UUpvqga0v3/RwH3VNFfmuY+/Hok\"","ngrok-agent-ips":"151.251.163.219","set-cookie":"disableLegacyLogin=true; Path=/","x-powered-by":"Express"}} still the user browser doesn't have the cookie

HTTP Connector Headers Don't Set Browser Cookies The headers you're seeing in the flow context are from the server-to-server HTTP request between Descope and your backend. These headers don't automatically become browser cookies. Why This Happens • HTTP connectors run server-side during the flow • The

Set-Cookie

header in the connector response only affects the Descope-to-backend request • Browser cookies require a direct browser-to-server response Solutions Option 1: Return Cookie Data to Client Use the End action to return cookie data, then set it client-side:

// In End action outputs
{
  "cookieName": "disableLegacyLogin",
  "cookieValue": "true"
}
// In your client success handler
onSuccess: (result) => {
  if (result.cookieName && result.cookieValue) {
    document.cookie = `${result.cookieName}=${result.cookieValue}; path=/`;
  }
}

Option 2: Backend Redirect Approach Have your backend return a redirect URL that sets the cookie: 1. Backend responds with redirect URL containing cookie-setting endpoint 2. Use the redirect URL in your flow's End action 3. Browser follows redirect and receives the

Set-Cookie

header The key point: only direct browser-to-server responses can set browser cookies, not server-to-server connector responses.

how to add client success handler

Add Client Success Handler Configure the success handler in your Descope component: React/Next.js

<Descope
  projectId="your-project-id"
  flowId="your-flow-id"
  onSuccess={(e) => {
    console.log('Flow completed:', e.detail);
    // Set cookie from flow response
    if (e.detail.cookieName && e.detail.cookieValue) {
      document.cookie = `${e.detail.cookieName}=${e.detail.cookieValue}; path=/`;
    }
  }}
  onError={(e) => console.error('Flow error:', e.detail)}
/>

Vue.js

<descope-wc
  project-id="your-project-id"
  flow-id="your-flow-id"
  @success="handleSuccess"
  @error="handleError"
/>
<script>
export default {
  methods: {
    handleSuccess(e) {
      console.log('Flow completed:', e.detail);
      if (e.detail.cookieName && e.detail.cookieValue) {
        document.cookie = `${e.detail.cookieName}=${e.detail.cookieValue}; path=/`;
      }
    }
  }
}
</script>

Web Components/HTML

const descopeWc = document.querySelector('descope-wc');
descopeWc.addEventListener('success', (e) => {
  console.log('Flow completed:', e.detail);
  if (e.detail.cookieName && e.detail.cookieValue) {
    document.cookie = `${e.detail.cookieName}=${e.detail.cookieValue}; path=/`;
  }
});

The

e.detail

object contains the flow response data, including any outputs you configured in your End action.

can I use the scriplet to add set-cookie header

Scriptlets Cannot Set Response Headers No, scriptlets cannot add

Set-Cookie

headers to the flow response. Scriptlets run server-side JavaScript for data manipulation but don't control HTTP response headers . Why This Limitation Exists • Scriptlets process data within the flow context • They return JavaScript objects, not HTTP responses • Response headers are controlled by Descope's flow engine, not custom code Alternative Approaches Option 1: Use End Action Outputs Return cookie data from your scriptlet, then handle it client-side:

// In scriptlet
return {
  cookieName: "disableLegacyLogin",
  cookieValue: "true",
  cookiePath: "/"
};

Option 2: HTTP Connector + Client Handler Your current approach is correct - use the HTTP connector response data in the client success handler to set the cookie via JavaScript. Option 3: Backend Redirect Have your backend API return a redirect URL that includes cookie-setting logic, then use that URL in your End action. The key limitation: only direct browser-to-server responses can set browser cookies, not server-side scriptlet execution. Scriptlets | Descope Documentation