Descope
Vendor: Descope
In short: Descope presents itself as an identity provider for AI agents, issuing short-lived scoped tokens. It supports SPIFFE SVIDs, mTLS, DPoP and per-tool authorization with Deny policies. Its Free Forever tier includes the hub, and it added Cross App Access support on 1 September 2026.
When does Descope fit?
- You build MCP servers or apps and need MCP authorization, CIMD and PKCE handled.
- You want a free tier to start.
- You need Cross App Access with ID-JAG.
When is it less suited?
- You need the governance suite on a free plan; it is Enterprise only.
Descope's Agentic Identity Hub covers agent authentication and authorization across standards. A governance suite adds approval, documented purpose and an accountable owner, on the Enterprise plan.
What does Descope document?
- Issues short-lived scoped tokens for agents. Descope Agentic Identity Hub, read 2026-11-03
- Supports SPIFFE SVIDs, private_key_jwt, mTLS and DPoP. Descope Agentic Identity Hub 3, read 2026-11-03
- Per-tool authorization at any enforcement point, with Deny policies. Descope Agentic Identity Hub 3, read 2026-11-03
- Governance suite with approval, documented purpose and accountable owner. Descope Agentic Identity Hub 3, read 2026-11-03
- Names OAuth 2.1, PKCE, MCP authorization, CIMD, XAA/ID-JAG and SPIFFE. Descope Agentic Identity Hub; Descope Agentic Identity Hub 3, read 2026-11-03
- Added Cross App Access support on 1 September 2026. Descope adds Cross App Access, read 2026-11-03
What does it cost?
Free Forever tier includes the hub. Governance suite is Enterprise only. Descope Agentic Identity Hub 3, read 2026-11-03