I want API(my backend API) that create a user in Descope from my Spring Java backend, including custom attributes, with minimal latency, and return the generated session JWTs (DS/DSR) as secure cookies in the API response? without sending OTP or kind of info to user Client → My API(with special token) → Descope API ↓ Create User + Session ↓ Return JWT (DS + DSR cookies) ↓ Client receives authenticated session

Backend User Creation with Session Generation You need to combine user creation with impersonation to generate session tokens without OTP verification.

@RestController
public class UserController {
    
    private final DescopeClient descopeClient;
    
    public UserController() {
        this.descopeClient = new DescopeClient(Config.builder()
            .projectId("YOUR_PROJECT_ID")
            .managementKey("YOUR_MANAGEMENT_KEY")
            .build());
    }
    
    @PostMapping("/create-user-with-session")
    public ResponseEntity<String> createUserWithSession(@RequestBody CreateUserRequest request) {
        try {
            // Create user with custom attributes
            var createUserRequest = CreateUserRequest.builder()
                .loginId(request.getEmail())
                .email(request.getEmail())
                .displayName(request.getDisplayName())
                .customAttributes(request.getCustomAttributes())
                .emailVerified(true) // Skip email verification
                .build();
            
            var userResponse = descopeClient.getManagementServices()
                .getUserService()
                .create(createUserRequest);
            
            // Impersonate user to generate session tokens
            var impersonationResponse = descopeClient.getManagementServices()
                .getUserService()
                .impersonate(request.getEmail(), null);
            
            // Set secure cookies with DS and DSR tokens
            var response = ResponseEntity.ok("User created successfully");
            response.getHeaders().add("Set-Cookie", 
                createSecureCookie("DS", impersonationResponse.getSessionToken()));
            response.getHeaders().add("Set-Cookie", 
                createSecureCookie("DSR", impersonationResponse.getRefreshToken()));
            
            return response;
            
        } catch (Exception e) {
            return ResponseEntity.status(500).body("Error: " + e.getMessage());
        }
    }
    
    private String createSecureCookie(String name, String value) {
        return String.format("%s=%s; HttpOnly; Secure; SameSite=Strict; Path=/", name, value);
    }
}

Key Implementation Notes • Use Management API to create users with

emailVerified: true

to skip OTP verification • Immediately impersonate the created user to generate session tokens • Return DS (session) and DSR (refresh) tokens as secure HttpOnly cookies • Custom attributes are supported in the user creation payload Authentication Requirements Your backend API needs a management key with user creation and impersonation permissions . The impersonation feature generates valid session tokens without requiring user interaction or OTP verification . Get User's Login History | API Reference | Descope Documentation Batch Delete Users | API Reference | Descope Documentation Secure Session Token Storage | Descope Documentation Get Available Custom Attributes | API Reference | Descope Documentation User Management API | Descope Documentation User Impersonation in Backend | Descope Documentation