Are refresh tokens issued via the Management API (

mgmt.jwt.signIn

+

selectTenant

) compatible with the OAuth2 token endpoint (

/oauth2/v1/token

with

grant_type=refresh_token

)? Or must they be refreshed through the Auth API (

/v1/auth/refresh

) instead?

Hi, I'm Descope's AI assistant. Token Compatibility Refresh tokens issued via the Management API (

mgmt.jwt.signIn

+

selectTenant

) must be refreshed through the Auth API (

/v1/auth/refresh

) . They are not compatible with the OAuth2 token endpoint (

/oauth2/v1/token

with

grant_type=refresh_token

). Refresh Endpoint Usage The Auth API refresh endpoint requires the refresh token in the Authorization Bearer header format:

Authorization: Bearer <Project ID:Refresh JWT>

. This endpoint provides a new valid session token for an existing signed-in user by validating the provided refresh token . Tenant Selection When using

selectTenant

, the endpoint returns new session and refresh tokens with the

dct

claim showing the active selected tenant . These tokens follow the same refresh pattern through the Auth API. Token Validation Key (V2) | API Reference | Descope Documentation My Details | API Reference | Descope Documentation Get Session History | API Reference | Descope Documentation

human answer

I'm connecting you with a member of the Descope support team now or you can also reach support directly at support.descope.com.

@Rahul Rijhwani can you help here

Shelly, usually yes we advise to use the jwt from the management API with the refresh API if you are having issues with it, there is a workaround - but be advised this changes the JWT structure for all operations including flows. The workaround: you can change your project's JWT template to use the Default OIDC compliant User JWT in the JWT template section and make sure to select it in the session management one more thing - you need to add the scope claim for this to work, i've added "openid" which is standard

@Reuven Zabirov I ment to ask if the correct way to refresh the SignIn using the refresh token is the`/v1/auth/refresh` right? it is not compatible with the oauth2 endpoint

/oauth2/v1/token

?

yes, that's the correct way

thanks