← Back to projects
Descope + 8x8: Securing an Internal AI Agent for Third-Party Access
This is the same Content AI Agent demo, gated behind real authentication with Descope.
Sign in to continue
Checking your session…
A CIAM-gated agent: real authentication, matched to who's signing in
This project reuses the Content AI Agent. What's new is everything in front of it: a single Descope flow that branches between two passwordless methods depending on how someone identifies themselves, each gated behind its own pre-approved allowlist, and a Cloudflare Worker that holds credentials so the n8n workflow itself never has to.
The design mirrors a real access problem: employees should sign in with SSO, contract and agency staff need something lighter but still auditable and tied to a known identity — not a shared login with no trail back to who actually used it.
Sign in (email or phone, branching)
Descope validates & issues session
Cloudflare Worker (verifies session JWT)
n8n agent webhook
Result stored
Status polled to browser
Key design decisions
- One flow, two identity paths: the sign-in screen detects whether someone entered an email or a phone number and branches accordingly — each path checked against its own pre-provisioned allowlist before anything is sent. Employees get an SSO option; contract staff and external agencies get a lightweight, passwordless method matched to whatever identifier IT already has on file for them.
- The Cloudflare Worker is the real security boundary: it's the only thing that holds credentials and verifies the session JWT against Descope's public signing key, so the n8n workflow behind it never has to know anything about auth at all — it stays a plain, auth-agnostic webhook.
- Passwordless by design, deliberately: temp and contract staff never see a shared password. Every login is Descope-native (magic link or OTP), tied to a specific, pre-approved identifier — not something a contractor self-registers on the spot.
Tech stack
- Descope — CIAM: branching passwordless sign-in
- Cloudflare Workers — Auth boundary: verifies JWT, calls the agent
- n8n — AI agent orchestration (auth-agnostic)
- Next.js + Cloudflare Pages — This site