Hi All, Does Descope support authorization in offline mode?

Offline Authorization Support Yes, Descope supports authorization in offline mode through JWT validation . You can validate JWTs locally without making network calls to Descope's servers. How It Works 1. Use Descope's backend SDKs to validate JWTs offline 2. The SDK validates token integrity and authenticity locally 3. Authorization decisions can be made based on JWT claims without network connectivity Implementation Options • Backend SDK validation for server-side applications • JWT authorizers for cloud services like AWS API Gateway • Custom JWT claims for access control decisions This approach works well for serverless applications, microservices, and API gateways where you need to validate tokens without external dependencies . Validating JWTs Offline | Descope Documentation JWT Authorizers Overview | Descope Documentation Descope vs Okta CIS | CIAM platform comparison

Use Descope's backend SDKs to validate JWTs offline, means we would have to communicate with our back-end. That's not offline.

True Offline Authorization Limitations You're correct. Descope's "offline JWT validation" still requires backend infrastructure - it's offline from Descope's servers, not truly client-side offline . What Descope Offers The offline validation means your backend can validate JWTs without calling Descope's API by using a public key . This works in environments without internet access, but still requires server-side processing. Client-Side Authorization For truly offline client-side authorization, you'd need to: 1. Store JWT claims in browser storage (localStorage/sessionStorage) 2. Parse JWT payload client-side to read roles/permissions 3. Make authorization decisions based on those claims However, this approach has security limitations since client-side code can be manipulated. Any sensitive authorization should ultimately be validated server-side. Validating JWTs Offline | Descope Documentation The Developer's Guide to JWT Storage

we need this for the mobile app

Mobile App Offline Authorization For mobile apps, you have better options for offline authorization than web browsers. Client-Side JWT Parsing 1. Store the JWT securely in the mobile app (Keychain/Keystore) 2. Parse JWT claims locally to read user roles and permissions 3. Make UI/feature decisions based on those claims

// iOS example - parse JWT payload
let payload = try JWT.decode(token, verify: false)
let userRoles = payload["roles"] as? [String] ?? []

Security Considerations • Client-side authorization is for UX only - never trust it for security • Always validate permissions server-side for sensitive operations • JWT expiration should still be checked client-side • Consider refresh token flow for longer sessions Hybrid Approach Use client-side claims for immediate UI decisions (show/hide features) while validating critical actions server-side when connectivity returns. This gives users a responsive experience while maintaining security. The mobile SDKs store tokens securely and provide methods to access claims without network calls.

Got it. How do I limit capabilities by tenant. I want to essentially gate certain capabilities based on the tenant

Tenant-Based Feature Gating Use custom tenant attributes and JWT claims to gate capabilities by tenant . Setup Custom Tenant Attributes 1. Create custom attributes for your tenants (e.g., "plan_tier", "enabled_features") 2. Set attribute types as "text", "boolean", "multi select" for feature arrays

// Example tenant attributes
{
  "plan_tier": "premium",
  "enabled_features": ["analytics", "api_access", "custom_branding"]
}

Include in JWT Claims Configure JWT templates to include tenant attributes as custom claims :

// JWT payload example
{
  "sub": "user123",
  "tenant": {
    "id": "tenant_abc",
    "plan_tier": "premium",
    "enabled_features": ["analytics", "api_access"]
  }
}

Mobile Implementation Parse JWT claims client-side to control feature visibility:

// iOS example
let planTier = jwt["tenant"]["plan_tier"] as? String
let enabledFeatures = jwt["tenant"]["enabled_features"] as? [String] ?? []
if enabledFeatures.contains("analytics") {
    // Show analytics features
}

This approach provides tenant-aware authorization where the same user can have different capabilities across tenants . Tenants | Descope Documentation JWT Templates | Descope Documentation Descope vs Auth0 for B2B Auth and SSO Top 7 RBAC Providers for B2B SaaS Apps