ProductNow builds a context engine for enterprise AI, turning the disparate details scattered across a company's different channels into one governed source of truth. As ProductNow moved upmarket, its identity provider ballooned from a simple renewal into a blocker. Here's how Descope helped ProductNow migrate, secure its MCP server, and enter production within three days.
About ProductNow
ProductNow's platform continuously pulls context from the systems a company runs, resolves conflicts, and serves the results to agents so they can take governed actions.
That focus on agentic context places ProductNow firmly in one of the most contested layers of the AI marketplace. Context engines have become a discrete category in this space, with time-to-market quickly becoming a major differentiator. For small teams like ProductNow, outperforming large competitors means both being the better option and getting there faster.
Teams can use ProductNow from Slack and Microsoft Teams, or from AI clients like ChatGPT, Cursor, and Claude Code through its MCP (Model Context Protocol) server. The company sells to enterprises with SOC 2 Type II compliance, tenant isolation, and a strict no-train policy already in place. All of these are table stakes for the kind of customers ProductNow works with, and enterprise-grade auth is no exception.
The challenge of keeping upmarket momentum
ProductNow's MCP server is open to any AI client that supports remote servers and OAuth. That made identity a core part of how far they could reach. If they couldn't meet enterprise identity demands, they couldn't land enterprise customers. They identified two of these enterprise-grade requirements as they began evaluating new auth solutions:
MCP auth that keeps up with the spec: Every client that connects to ProductNow's MCP server has to register with an authorization server and get scoped tokens before it can call a tool. The MCP authorization spec has been moving quickly, most recently toward Client ID Metadata Documents (CIMD) for client registration, and ProductNow needed an auth provider whose MCP support would keep pace with it.
Enterprise SSO ready before a deal stalled: Enterprise customers expect single sign-on (SSO), and ProductNow wanted its SSO implementation ready for its first connections without building and maintaining integrations ad hoc for every identity provider a customer might want.
ProductNow's contract with its previous provider came up for renewal, which led the team to look for alternatives. At the same time, a provider-side issue blocked an integration with one of ProductNow's clients, which turned a "see what's out there" evaluation into a drive for migration. ProductNow set two parameters for making the switch to a new auth vendor: keep the budget startup-friendly, and make the move simple.
Kadhir Manickam, CTO at ProductNow, said:
"When your identity provider gets in the way of a client integration, that's a risk to your momentum. We needed to move fast, and we needed MCP auth to work from day one. That's when migration stopped being a curiosity and turned into a priority."
The Descope experience
ProductNow joined Descope's Startup Plan, which includes a free year of the Pro tier, and started on the migration path as soon as it was approved. Descope shared its migration resources up front, including Descope Skills, installable instruction packs that give AI coding agents provider-specific migration knowledge, from mapping an existing setup to Descope equivalents through planning a cutover. ProductNow was live in its development environment the next night and in production three days after writing its first line of migration code.
ProductNow's MCP server is how AI clients work inside the context engine. Its tools let an agent search for evidence, file new decisions or notes where they belong, and manage documents. Every call runs as the signed-in ProductNow user, under the same workspace and document permissions that person has in the app. A user can only read documents they can view in ProductNow, and company brain search only returns evidence from documents the user can access. Unauthenticated MCP requests receive a 401 Unauthorized response with a WWW-Authenticate header pointing to the MCP server's protected resource metadata at a well-known URL.
Descope acts as the authorization server for that MCP server through the Agentic Identity Hub. Descope authenticates the user, handles consent, and issues access tokens tied to that user, so ProductNow's server only has to validate the token and apply the permissions it already enforces. Because Descope supports CIMD, DCR, and pre-registration at the same time, ProductNow can onboard each new client with whichever method it supports, without writing custom OAuth code for each one. For example, ChatGPT connects using CIMD, where the client's ID is an HTTPS URL pointing to metadata the client publishes itself. Clients that don't support CIMD yet can use DCR, and ProductNow can register clients manually in advance if needed.
Kadhir Manickam, CTO at ProductNow, said:
"The whole process from the first line of code to production happened in three days, with 1.5 people working on it. Migration was simple enough that we never had to stop building the product to get it done."
Enterprise-grade identity at startup speed
ProductNow's Descope implementation covers both fronts that drove the switch:
Production in three days: ProductNow went from its first line of migration code to a full production rollout in three days, with one and a half engineers on the project.
User-scoped MCP auth: Every call to ProductNow's MCP server carries a Descope-issued token tied to the signed-in user, however the client registered.
Enterprise SSO ahead of demand: When enterprise customers ask for SSO, the SSO Setup Suite lets their IT admins configure connections themselves, without ProductNow building an integration for each identity provider.
Kadhir Manickam, CTO at ProductNow, said:
"When an agent searches or edits our customers' context from ChatGPT or Cursor, it has to act on behalf of one specific person, with exactly that person's access. Descope gave us that from day one, without slowing down the team building the product."
As ProductNow brings on enterprise customers and more AI clients connect to its MCP server, Descope handles the enterprise-ready and agentic identity layer underneath, so a small team can keep its focus on the context engine.
Descope is a flexible drag & drop customer and agentic identity platform that helps organizations easily add authentication, authorization, and identity management to their apps, AI agents, and MCP servers. Customers use us for initiatives such as passwordless authentication, SSO, identity federation, strong MFA, fraud prevention, and agentic identity.
To get started with Descope, sign up for a Free Forever account. If you have questions about our platform, book time with our auth experts.
