I use the flows client to execute the authentication flow. I get the "session token" per the above example. When I pass that jwt to the server and it attempts to make the /v1/auth/me call I get the error {"errorCode":"E064002","errorDescription":"Empty or Non Existent Refresh Token JWT was provided","errorMessage":"Failed to find JWT refresh token","message":"Failed to find JWT refresh token"}. Assuming the refresh token is separate, how do I obtain that when the flow returns to the login pate?

you are trying to call /me from your backend or frontend ?

back end. The flows sdk

ok, which frontend sdk are you using ?

http. I just re-read the sample and think I have an idea I need to get both the session and refresh tokens separately. Looking into sdk object for that next.

some context: the "/me" api you used https://docs.descope.com/api/openapi/session/operation/Me/ will need the refresh JWT (not access token) that one is stored on the client (local storage/cookies) and not sent to your backend by default (not needed , usually it's needed for descope only, to create new tokens)

I do not trust any code running in the browser. Server is doing verification of token and getting user info

if you need the data in your backend, 2 options to do so: 1. use mgmt sdk to load user details https://docs.descope.com/manage/users/#load-existing-user-details 2. have the user info you need to reside on the JWT custom claims , you can add them via the flow with action "custom claims"

We are using descope for authentication, but not trusing the browser for anything more than the jwt to verify the identity. Then server will save jwt in session and refresh as needed to preserve session details.

one of the 2 approaches above are not what you are looking for ?

We are not trying to load existing users, so not sure how 1 helps us. We just need authenticated email, which is in the "me" results if I can get it to take the token. I did get .detail.refreshJwt from the client sdk and it is different from the session JWT, but using that in the Authentication header per the API docs is still not working.

in that case, simply adding the email to the access token JWt will be simpler

It appears to be working now with the refresh token. Proceeding for now. Thank you.