Auth

Authentication foundation is preserved.

Curva now renders the hosted Descope flow directly, so any methods enabled in the configured flow can be used here without rebuilding the web auth surface again.

Hosted flow: sign-up-or-in

Status: Resolving session

Google

Ready

Google is already the working social login path and remains available through the hosted flow.

Checks

  • Curva still renders the same Descope flow for login.
  • Google is marked enabled in Curva auth configuration.
  • Google provider claims already map cleanly into Curva identities.

Next steps

  • Keep Google connected in the Descope flow.
  • Re-run a full login from /login after any flow changes.

Email code verification

Ready

Curva now supports email-code sign-in directly through the Descope browser SDK, even when the hosted flow only exposes social, passkey, and phone OTP paths.

Checks

  • Curva renders a native email OTP form on /login.
  • The Descope browser SDK supports sign-up-or-in and verification for email OTP.
  • The hosted flow can still omit email OTP without breaking Curva email-code login.

Next steps

  • Send a code to a real email address from /login.
  • Verify the code and confirm Curva routes to onboarding or profile.
  • Optionally add email OTP to the hosted flow later for a single Descope-only surface.

Passkey

Needs Descope setup

Curva is ready to expose passkeys and the live hosted flow already includes the passkey/WebAuthn path.

Checks

  • Curva renders the hosted flow directly on /login.
  • Custom Descope domain configured: https://auth.curva.com.
  • Passkey/WebAuthn is already present in the live hosted flow.

Next steps

  • Keep the passkey/WebAuthn path published in the hosted flow.
  • Verify passkey registration and repeat sign-in on /login.

Apple

Needs env setup

Apple is blocked on missing env: APPLE_SERVICE_ID, APPLE_APP_ID, APPLE_TEAM_ID, APPLE_KEY_ID.

Checks

  • Missing or placeholder Apple env keys: APPLE_SERVICE_ID, APPLE_APP_ID, APPLE_TEAM_ID, APPLE_KEY_ID.
  • Custom Descope domain configured: https://auth.curva.com.
  • Apple still needs provider setup in Descope and the Apple button/path added to the flow.

Next steps

  • Replace placeholder Apple env vars in Curva with real values.
  • Restart the API and web app after updating env.
  • Configure the Apple provider in Descope using your Apple app credentials.
  • Add Apple to the referenced Descope flow and publish it.
  • Test the Apple login path from /login.

Email Code

Ready in Curva

Email-code sign-in now runs directly in Curva.

Use this when the hosted Descope flow does not expose email OTP. Social login, passkeys, and phone OTP still run through the hosted flow below.

CallbackOnboardingProfilePlatform

The hosted Descope flow currently covers Google, Apple, passkeys, and phone OTP. Curva now handles email OTP directly with the browser SDK, so only Apple still depends on external credentials beyond the hosted flow.