Hi. We are migrating from a Descope project to another, and would need to transfer the user accounts between them (including their passwords). What's the procedure for a secure data transfer?

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. Step 1: Export Users from the Source Project • Use the Search Users API or the SDK's

searchAll()

method to programmatically export user data from your source project. • This is the recommended approach for project-to-project migrations. • You can also use the Descope Console's CSV export for large batches. Step 2: Prepare the User Data • Map and format the exported data into the structure expected by Descope's import APIs, including fields like

loginIds

,

email

,

name

,

roleNames

,

userTenants

, and any

customAttributes

. Step 3: Import Users into the Destination Project • Use the Batch Create Users API with a Management Key from the destination project to bulk-import users. • Optionally set a custom attribute like

freshlyMigrated: true

to identify migrated users in your flows. Step 4: Handle Passwords • Passwords require special handling — Descope does not expose raw or hashed password data via the Backend APIs. • If passwords can be exported (e.g., from a custom data store or Keycloak DB), import them via the

hashedPassword

field in the Create/Batch Create User API. • If passwords cannot be exported, consider implementing a password reset flow for users upon their first login.

I'm specifically asking if people from Descope could transfer those accounts so users don't have to reset their passwords.

Hi @Noel Looking into it please allow me sometime.

Sure, no emergency here, was just pinging you to indicate that the chatbot wasn't enough 🙂

Hey Noel - we generally do not migrate users between projects. What's the use case here? Moving between regions or? Our suggestion would be to use the API/SDK to load and recreate your users on the other project, then force them to set a new password on their initial login.

We used the same Descope project for two different applications / domains. We now need to set the Webauthn top level domain for one of them, so we needed to create a new project. But we would really prefer to avoid our users having to redefine their passwords.

You could just in time migrate their passwords. You could set up an HTTP connector on the new project to the old project and hit the API's password sign in endpoint to validate it before storing it (signing up) on the new project.