Hi team, We're building a custom login page using the Descope SDK (@descope/nextjs-sdk) instead of the pre-built SignInFlow widget. We ran into two issues: 1. GitHub OAuth returns wrong client_id When calling sdk.oauth.start('github', redirectUrl) or sdk.oauth.start.github(redirectUrl), the response URL contains Google's OAuth client_id instead of GitHub's. This causes a 404 on GitHub's authorization page. Response URL example: https://github.com/login/oauth/authorize?client_id=372511697756-ce9i4rsqitd4egknqf5mvf4v84bvedle.apps.googleusercontent.com&... The client_id above is Google's, not GitHub's. GitHub OAuth works fine through the SignInFlow widget, so the provider is configured correctly in the project. The issue is only with the SDK's direct OAuth methods. 2. JWT missing user claims after manual OAuth flow After completing sdk.oauth.exchange(code) followed by sdk.selectTenant() and sdk.refresh(), the resulting JWT token is missing name, email, and loginIds claims. The sdk.me() endpoint returns the full user profile, but the token itself only contains sub, dct, and tenant_name. The SignInFlow widget produces tokens with all user claims populated. Is there an additional step needed when using the SDK directly to get enriched tokens?

GitHub OAuth Wrong Client ID Issue The issue you're experiencing with

sdk.oauth.start('github', redirectUrl)

returning Google's client_id instead of GitHub's suggests a provider configuration problem in your Descope project. Troubleshooting Steps 1. Verify your GitHub OAuth provider configuration in the Descope console: - Go to Social Login (OAuth / OIDC) - Select GitHub → "Use my own account" - Confirm the Client ID and Client Secret are correctly set for GitHub 2. Check if you have multiple OAuth providers configured and ensure GitHub is properly enabled for API/SDK access 3. Try using the specific provider method:

await sdk.oauth.start.github(redirectUrl, loginOptions);

JWT Missing Claims After Manual OAuth The missing user claims (name, email, loginIds) in your JWT after

sdk.oauth.exchange()

is likely due to scope configuration. When using the SDK directly, you need to ensure proper scopes are requested. Solution Steps 1. Include the required scopes in your OAuth start call:

const loginOptions = {
  customClaims: {
    // Add any custom claims needed
  }
};
await sdk.oauth.start('github', redirectUrl, loginOptions);

2. For enriched JWT tokens with user profile data, you may need to configure custom claims in your Descope flows. The

descope.custom_claims

scope gives access to custom claims that can be set via flow actions 3. Consider using a Custom Claims action in your authentication flow to populate the JWT with user profile information like name and email The SignInFlow widget likely works because it automatically handles scope configuration and custom claims population through the configured flow, while the direct SDK approach requires explicit configuration. Custom GitHub Apps | Descope Documentation Custom OAuth Providers Overview | Descope Documentation OIDC Federated Applications Overview | Descope Documentation Add User Information to JWT Response Using Descope Flows