---
source_url: "https://docs.descope.com/auth-methods/passwords/with-sdks/backend"
title: "Passwords Guide | Backend SDK | Descope Documentation"
mirrored_at: 2026-08-13T01:05:40.962Z
host: docs.descope.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/docs.descope.com/auth-methods/passwords/with-sdks/backend"
---

> **Original source:** https://docs.descope.com/auth-methods/passwords/with-sdks/backend

This guide is meant for developers that are NOT using Descope on the frontend to design login screens and authentication methods.

If you'd like to use Descope Flows, [Quick Start](https://docs.descope.com/getting-started) should be your starting point. If you'd like to use our Client SDKs, refer to our [Client SDK docs](https://docs.descope.com/auth-methods/passwords/with-sdks/client).

The Password-based authentication method lets you authenticate end users using a secret string of characters known only to the user.

Descope recommends using an email address as the user identifier; this allows you to utilize passwordless methods like Magic Link in addition to passwords. These methods could be used for authentication when users forget their password or need to reset it easily.

1.  **New user signup**: [User Sign-Up](https://docs.descope.com/auth-methods/passwords/with-sdks/backend#user-sign-up) returns a jwt for the user.
2.  **Existing user signin**: [User Sign-In](https://docs.descope.com/auth-methods/passwords/with-sdks/backend#user-sign-in) returns a jwt for the user.

### [Install SDK](#install-sdk)

### [Import and initialize SDK](#import-and-initialize-sdk)

For registering a new user, your application client should accept user information, including an email or phone number used for verification. The application client should then send this information to your application server. Signing up via password returns the user's JWT.

For authenticating a user, your application client should accept the user's identity (typically an email address or phone number) and password. The application client should send this information to your application server. Signing in via password returns the user's JWT.

Update a password for an existing logged in user using their refresh token.

Replace a password with a new one. The old password is used to authenticate the user before replacing the password. If the user cannot be authenticated, this operation will fail.

Sends a password reset prompt to the user with the given login id according to the password settings defined in the Descope console.

Note

The user's email must be verified in order for the password reset method to complete.

Get the configured password policy for the project.

The final step of completing the authentication with Descope is to validate the user session. Descope provides rich [session management](https://docs.descope.com/sessions/validation) capabilities, including configurable session timeouts and logout functions. You can find the details and sample code for backend session validation [here](https://docs.descope.com/sessions/validation/backend).

## Checkpoint

Your application is now integrated with Descope. Please test with sign-up or sign-in use case.