Hey, we are getting the following error prompted for some users who use SSO via okta:

{
  "errorCode": "E011007",
  "errorDescription": "Request is missing a valid bearer token"
}

We are trying to understand if this is a configuration issue on their end or is it a problem with our descope setup. Other users of the same tenant are not having trouble, it seems to go on and off and fixed after a couple of minutes. CC: @Jackey Dalva

Error Analysis The E011007 error indicates a missing or invalid bearer token in API requests. This typically occurs when: 1. The Authorization header is missing entirely 2. The bearer token format is incorrect 3. The token has expired or is invalid Common Causes for Intermittent SSO Issues Since this affects some users intermittently and resolves after a few minutes, likely causes include: • Token refresh timing issues during SSO flow • Session state inconsistencies between your app and Descope • Network connectivity issues during token exchange • Caching problems with authentication state Troubleshooting Steps 1. Check your SSO implementation for proper token handling:

// Ensure proper bearer token format
const token = `${projectId}:${refreshJWT}`;
headers: {
  'Authorization': `Bearer ${token}`
}

2. Verify Okta SSO configuration matches Descope settings: - Authorization endpoint - Token endpoint - Userinfo endpoint - JWKs URI 3. Review your token refresh logic to handle expiration gracefully 4. Check browser network logs during failed authentication attempts The bearer token requires both the ProjectId and refresh JWT in the format

<Project ID>:<JWT>

. Since other users aren't affected, this suggests the issue is likely in your application's token handling rather than the Descope SSO configuration itself . Sign-In / Verify | API Reference | Descope Documentation Configure Okta SSO as IDP | Descope Documentation

Also can you verify this check doesn't need to be turned on in order to work for SSO in the flow?

I can't see the specific file you uploaded, but I can help clarify SSO flow configuration requirements. SSO Flow Configuration For SSO to work properly in flows, you don't need to enable any specific "check" - however, there are key conditions to consider: Required Flow Logic 1. Use

ssoEnabled

condition to check if SSO is available for the user's domain 2. Use

tenant.enforceSSO

condition to check if SSO is mandatory Recommended Flow Structure

1. If tenant.enforceSSO = True → Route to SSO action
2. Else if ssoEnabled = True → Route to SSO action  
3. Else → Route to non-SSO authentication

What's NOT Required • No special "SSO check" toggle needs to be enabled • The SSO action works automatically when properly configured • Domain verification is only required if you've enabled "Force Domain Verification" in SSO Settings If you can share what specific setting or check you're referring to, I can provide more targeted guidance. The E011007 error you mentioned earlier is likely related to token handling rather than flow configuration. SSO Enforcement in Flows | Descope Documentation SSO Settings Guide | Descope Documentation

So no need for the "enable in API / SDK" toggle to be enabled?

No Toggle Required The "Enable in API/SDK" toggle is not required for SSO to work in flows. That setting only affects direct API/SDK usage, not flow-based authentication. Flow vs API/SDK • Flows: SSO works automatically when you have proper tenant configuration and flow logic • API/SDK: The toggle controls whether SSO endpoints are accessible via direct API calls Since you're using SSO through flows (which is the standard approach), the toggle setting won't impact your authentication. Your E011007 bearer token error is unrelated to this configuration. The intermittent SSO issues you're experiencing are likely due to token refresh timing or session handling in your application code, not missing configuration toggles.

@Akash Jivane can you follow up here ?

@Bhagwanta Yeole Looping you here

@Guy Oliel can you also share cf-ray header from failed request ?

Ill try to get one from the customer, I couldn't find any audit logs / trouble shoot logs from the customer on the descope app

plz don't share on public channel open ticket on this

@Meir Wahnon Thanks. We wish to move forward with this on a call with the customer.

Just mention you ask for a call over ticket We first need to basic info, to have analysis of issue

opened and mentioned

also, plz look at your audit events

Guy mentioned earlier that we couldn't find any audit logs unfortunately

Adding @Doron Sharon

no, this one is dsiabled. but i must say we have other customers that can still login via sso just find. the issue is customer-specific.

when you say SSO, do you mean OAuth or SAML based protocol ?

As wrote at the ticket it impacts only IdP Initiated logins.

can you please add shimonl@blockaid.co ?

Add to that slack workspace? We cannot add, they need to join from this link: https://www.descope.com/community

got it thanks. on it

@Doron Sharon מה קורה חבר!

Hi!

בטח אתה עוד לא זוכר ומקשר

בטח זוכר

ניהלתי את הצוות support. ב Frontegg הכרנו בגן של ניוטון

כיף לשמוע כן אין בעיה אבל בוא נעלה קודם אנחנו בשביל לוודא לפני

אולי אפשר לנסות אפילו עכשיו

שולח זום

אז תן לנו רגע לבדוק את הזמינות של הלקוח (Krakan!) לקוח חשוב

אני עולה כבר עכשיו בנתיים בודקים עם הלקוח