From 8565639b748a0ce9e9c844c74143879a2c9eb66a Mon Sep 17 00:00:00 2001
From: Asaf Shen <asaf@descope.com>
Date: Sun, 30 Aug 2026 13:27:57 +0300
Subject: [PATCH] feat: send_session_token query param to enable
 sendSessionToken on the flow (#1924)

Maps the new query param (or DESCOPE_SEND_SESSION_TOKEN env) to the Descope
component's sendSessionToken prop, exposing the session's validated claims
to the flow via the sessionJwtClaims context key

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/App.test.tsx | 22 ++++++++++++++++++++++
 src/App.tsx      |  9 +++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/App.test.tsx b/src/App.test.tsx
index c66164fe6..432a2c71f 100644
--- a/src/App.test.tsx
+++ b/src/App.test.tsx
@@ -173,6 +173,28 @@ describe('App component', () => {
 		);
 	});
 
+	test('that send_session_token search param enables sendSessionToken', async () => {
+		window.location.pathname = `/${packageJson.homepage}/${validProjectId}`;
+		window.location.search = `?flow=${flowId}&send_session_token=true`;
+		render(<App />);
+		await waitFor(() =>
+			expect(mockDescope).toHaveBeenCalledWith(
+				expect.objectContaining({ flowId, sendSessionToken: true })
+			)
+		);
+	});
+
+	test('that sendSessionToken is off by default', async () => {
+		window.location.pathname = `/${packageJson.homepage}/${validProjectId}`;
+		window.location.search = `?flow=${flowId}`;
+		render(<App />);
+		await waitFor(() =>
+			expect(mockDescope).toHaveBeenCalledWith(
+				expect.objectContaining({ flowId, sendSessionToken: undefined })
+			)
+		);
+	});
+
 	test('sets the document title from the title search param', async () => {
 		window.location.pathname = `/${packageJson.homepage}/${validProjectId}`;
 		window.location.search = `?title=My%20Custom%20Title`;
diff --git a/src/App.tsx b/src/App.tsx
index b22fcaa3d..c00f4f890 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -219,6 +219,14 @@ const App = () => {
 			? false
 			: undefined;
 
+	// opt-in: send the current session JWT on flow start/next requests, exposing
+	// its validated claims to the flow via the sessionJwtClaims context key
+	const sendSessionToken =
+		urlParams.get('send_session_token') === 'true' ||
+		env.DESCOPE_SEND_SESSION_TOKEN === 'true'
+			? true
+			: undefined;
+
 	const theme = (urlParams.get('theme') ||
 		env.DESCOPE_FLOW_THEME) as React.ComponentProps<typeof Descope>['theme'];
 
@@ -289,6 +297,7 @@ const App = () => {
 	const flowProps = {
 		flowId,
 		debug,
+		sendSessionToken,
 		locale,
 		tenant: tenantId,
 		theme,