https://descope.com logo
Join Slack
Powered by
I used the `ask-ai` which seemed reasonably helpfu...
# ask-a-descoper
k
I used the 
ask-ai
which seemed reasonably helpful, it then suggest I contact support via email. The email recipient auto-replied and closed my ticket (not useful). Here is the ai chat context. As mentioned in this linked context, I am trying to use the 
Single active session
kind of functionality per device type, but I want my sign in/up to be entirely flow based. I already set the device type 
dtt
in a custom claim. I don’t mind doing additional API calls, but I can’t get a straight answer. Is this a hole in the SDK? Is there already a capability? And why does the AI agent suggest sending an email to support when the support email recipient auto-responds with nothing helpful? I’d simply like to validate a session where 
dtt: desktop
and revoke others of the same type (while keeping 
dtt: mobile
untouched).
✅ 1
r
Hi @Kevin Ross Let me check
I sincerely apologize for the frustrating back-and-forth experience Here's what I found: Your diagnosis is correct. The Ruby SDK (v1.1.0) does not currently expose 
loginOptions
fields including 
revokeOtherSessions
and 
revokeOtherSessionsTypes
. This is a confirmed gap — these are supported in Go, Java, Node.js, and mobile SDKs, but not yet in Ruby. What you're trying to do is fully supported by Descope — the 
dtt
claim + 
RevokeOtherSessionsTypes
combination is the right approach. Here's how it works in Go for reference:
Copy code
loginOptions := &descope.LoginOptions{
    RevokeOtherSessions: true,
    CustomClaims: map[string]any{"dtt": "desktop"},
    RevokeOtherSessionsTypes: []string{"desktop"},
}
In the meantime, your options are: 1. Use the Management API to revoke sessions by type server-side after sign-in as a workaround 2. Use the Node.js or Go backend SDK if feasible for your stack I've flagged this as a feature gap to our SDK engineering team for the Ruby SDK. I'll follow up here as soon as there's an update.
k
@Rahul Rijhwani I can use this with nodejs, that is no problem, but how do I use it with a Flow? I’m using nextjs/react, is this a follow up call e.g. validate session?
Is it an argument to the Flow rendering component?
r
Here's the Next.js/React + Flows setup: Neither. The 
<Descope flowId="..." />
component has no 
loginOptions
prop, and `revokeOtherSessions`/`revokeOtherSessionsTypes` aren't arguments to the Flow renderer. I confirmed this in the core-js-sdk source — the Flow component's 
Options
type doesn't include these. The correct pattern with Flows + Next.js is a post-login backend call: 1. Your Flow sets the 
dtt
custom claim (e.g. 
"desktop"
) via the Custom Claims action — keep doing this 2. The 
<Descope>
component's 
onSuccess
fires with the new session token 3. In 
onSuccess
, call a Next.js API route (e.g. 
/api/post-login
) passing the refresh token 4. That route uses your Node.js backend SDK to revoke the other sessions by type:
Copy code
// pages/api/post-login.js (or app/api/post-login/route.js)
import DescopeClient from '@descope/node-sdk';

const descopeClient = DescopeClient({ projectId: process.env.DESCOPE_PROJECT_ID });

export default async function handler(req, res) {
  const { refreshToken } = req.body;

  // Validate the session to get the userId
  const authInfo = await descopeClient.validateSession(req.headers.authorization);
  const userId = authInfo.token.sub;

  // Revoke all OTHER desktop sessions for this user, leaving mobile untouched
  await descopeClient.management.user.revokeUserSessions(userId, {
    sessionTypes: ['desktop']  // only revoke desktop-type sessions
  });

  res.status(200).json({ ok: true });
}
Copy code
// Your login page
<Descope
  flowId="sign-up-or-in"
  onSuccess={async (e) => {
    // Flow already set dtt: "desktop" via Custom Claims action
    await fetch('/api/post-login', {
      method: 'POST',
      headers: { Authorization: `Bearer ${e.detail.sessionJwt}` }
    });
    router.push('/dashboard');
  }}
/>
The key insight: 
loginOptions
at sign-in time is only available when you're calling sign-in methods directly (Node SDK, mobile SDKs). With Flows, the equivalent is this post-login revocation via the Management API. The 
dtt
claim your Flow already sets makes this work perfectly — just filter by 
sessionTypes: ['desktop']
to leave mobile sessions alone. Note: double-check the exact method signature for 
revokeUserSessions
in your version of the Node SDK, as session-type filtering support may vary. Let me know if you hit any issues!
👍 1
k
@Rahul Rijhwani 
revokeUserSessions
does not appear to exist in the node sdk: https://github.com/descope/node-sdk/blob/main/lib/index.ts
maybe I’m looking in the wrong place, checking the core-js link
r
Hey Kevin, I've done a deep dive into the SDKs and REST API. Here's the correct ways: What exists in the Node SDK: Only 
management.user.logoutUser(loginId)
and 
management.user.logoutUserByUserId(userId)
— both do a full logout of ALL sessions. The SDK doesn't pass a 
sessionTypes
param. Source: https://github.com/descope/node-sdk/blob/main/lib/management/user.ts Flow component (
<Descope>
) in React/Next.js: The 
<Descope>
component has no 
loginOptions
prop. The 
client
prop is the only generic data passthrough, but it's for flow context — not for 
loginOptions
or 
revokeOtherSessionsTypes
. Source: https://github.com/descope/descope-js/blob/main/packages/sdks/react-sdk/src/types.ts core-js-sdk 
LoginOptions
type: Also only has 
revokeOtherSessions: boolean
— no 
revokeOtherSessionsTypes
field. So even at the SDK level, type-selective revocation isn't exposed yet in JS/Node. Source: https://github.com/descope/descope-js/blob/main/packages/sdks/core-js-sdk/src/sdk/types.ts REST API workaround: The Descope Management REST API does support type-selective logout. Use your Flow normally, then in your 
onSuccess
callback, call a Next.js API route that hits:
Copy code
POST <https://api.descope.com/v1/mgmt/user/logout>
Authorization: Bearer <ProjectID>:<ManagementKey>
Content-Type: application/json

{
  "userId": "<user-id-from-session>",
  "sessionTypes": ["desktop"]
}
Docs: https://docs.descope.com/api/management/users/logout-all-user-devices This lets you selectively revoke only specific session types (e.g., just 
"desktop"
) while leaving others intact.
👍 1
Open in Slack
PreviousNext
Powered by