Hello team! Is it possible to make the SSO step up flow open SSO's IDP auth page in a popup / iframe instead of redirecting to a new browser tab? Is there a recommended way how to set this up with React SDK?

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. A member of the support team will take over and follow up shortly. Configuring SSO in Popup Mode You can configure SSO to open in a popup instead of redirecting to a new tab when using Descope Flows with the React SDK. This behavior can be controlled through the SSO action configuration in your flow. Steps to Configure Your Flow 1. Configure your Flow: In the Descope console, set up your SSO action within a step-up flow that uses popup display mode instead of redirect. 2. Use the React SDK: Initialize your flow component with the appropriate configuration.

import { Descope } from '@descope/react-sdk'
<Descope
  projectId="__ProjectID__"
  flowId="your-stepup-flow-id"
  // Additional configuration for popup behavior
/>

Additional Configuration The exact popup configuration depends on your specific flow setup. You'll need to configure this in your Descope Flow editor where you can specify how the SSO action should behave during step-up authentication. Further Resources For detailed implementation, refer to the SSO with Flows documentation and the React SDK documentation for specific configuration options.

Hi @Filip Kajetaniak Native popup/iframe support for the SSO IdP page during a step-up flow isn't available out of the box — and there's an important reason why. Most IdPs (Okta, Azure AD, Ping, etc.) block iframe embedding via

X-Frame-Options

and

Content-Security-Policy

headers as a security measure. This is an IdP-level restriction, not a Descope limitation, so there's no reliable way to force the IdP login page into an iframe.

Ok thank you! So we are pretty much forced to redirect to a new tab for SSO auth?

And the the closest workaround that I would suggest for a popup-like experience with step-up would be: 1. Render the

<Descope>

flow component inside a modal/dialog in your React app 2. When the SSO action triggers, it will redirect within that context (same tab or new tab depending on your setup) 3. Alternatively, use

window.open()

to launch the step-up flow URL in a controlled popup window and listen for a

postMessage

callback when auth completes. Just let me know if this workaround suites for your current setup.

I'll try that, thank you Akash!!!

Just let me know if this works!