Descope Agent Auth — Development skill for Claude Code

Descope Agent Auth SDK

A client-side SDK (Python and TypeScript) that does two things for a custom agent:

1. Signs your agent in to Descope and gets a Descope token.
2. Gets the tokens it needs — Connection or Resource tokens from the Descope vault — when the agent needs to access an API or MCP server.

It's the identity layer under your agent's tool calls, not a tool catalog. Tool code, API wrappers, and connector catalogs are out of scope.

What it looks like

from descope_agent_auth import AgentAuthClient, AccessTokenProvider
from descope_agent_auth.errors import ConnectionAuthorizationRequired

client = AgentAuthClient(project_id="P2...", credential=AccessTokenProvider(access_token=user_jwt))

try:
    github = client.connections.get_token(connection="github", identifier="user@example.com")
    use(github.access_token)              # a fresh, scoped GitHub token
except ConnectionAuthorizationRequired as e:
    redirect_user_to(e.connect_url)       # the user hasn't linked GitHub yet

Runnable [examples](examples/) (Python + TypeScript) and a full [quickstart](docs/quickstart.md).

Who this is for

• ✅ Custom agents you write yourself, in any framework (LangChain, LangGraph, Google ADK, OpenAI, Vercel AI, Mastra, LlamaIndex, Cloudflare Agents, CrewAI, the Anthropic SDK, …). It fetches the tokens the tools you implement need — most often for the SaaS APIs those tools call — from Descope, which stores and refreshes them securely so your code doesn't have to. Descope can also manage the agent's connections to remote MCP servers via the MCP auth adapter, storing the server's access and refresh tokens for you — but only when you wire the agent yourself, not when you connect through a managed MCP client service (AWS Bedrock AgentCore, Azure AI Foundry).
• ❌ Not for building MCP servers. Protecting a server (DCR, token validation, `tool