Nacho
Stytch IAM Provider
Zero feature-gating CIAM platform. All features available from the free tier up to 10K MAU. Purpose-built B2B and B2C products with built-in fraud and risk protection.
Features
- JavaScriptTypeScriptReactReact NativeNext.jsNode.jsPythonRubyGoJava.NETSwiftKotlin
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for OpenID Connect protocol-level compatibility across providers? Check out the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Stytch support Username and Password authentication method?
Stytch supports Username and Password authentication method. Email-and-password authentication via Stytch Passwords API. Uses zxcvbn (strength score 0–4) for password quality checking with configurable minimum strength. Supports both synchronous strength validation and async HaveIBeenPwned breach checking at signup. Password reset via email magic link or OTP. bcrypt hashing internally. Minimum 8 characters required by default. Read more
Does Stytch support Social Sign-in authentication method?
Stytch supports Social Sign-in authentication method. OAuth 2.0 social login with 15+ built-in providers: Google, Apple, Facebook, GitHub, Microsoft, Discord, Slack, GitLab, LinkedIn, Spotify, TikTok, Twitter/X, Amazon, Coinbase, and Salesforce. Custom OAuth providers can be added via the Generic OAuth flow. Social accounts are automatically linked to an existing user profile if the email matches. All social providers are included on all plans. Read more
Does Stytch support Passkey authentication method?
Stytch supports Passkey authentication method. FIDO2/WebAuthn passkeys supported as a primary authentication factor. Supports both platform authenticators (Touch ID, Face ID, Windows Hello) and roaming authenticators (YubiKey). Multiple passkeys per user supported. Requires a custom domain configured for the relying party ID. Passkeys are available on all plans. Read more
Does Stytch support Email Passwordless authentication method?
Stytch supports Email Passwordless authentication method. 6-digit OTP codes delivered to the user's email address. Configurable expiration (default 10 minutes). Code is single-use. Works alongside magic links as a complementary passwordless method. Supports whitelabel email sending via custom SMTP or email providers. Available on all plans. Read more
Does Stytch support Phone Passwordless authentication method?
Stytch supports Phone Passwordless authentication method. 6-digit OTP codes delivered via SMS. WhatsApp OTP also supported as an alternative delivery channel. Uses Stytch's built-in SMS sending (Twilio-backed) by default. Custom SMS provider configuration available. International phone numbers supported. Rate limiting applied per phone number to prevent abuse. Available on all plans. Read more
Does Stytch support Magic Link authentication method?
Stytch supports Magic Link authentication method. One-click email magic links — Stytch's signature feature. Token embedded in a URL with configurable redirect URI. Expiration configurable (default 1 hour). Supports login, signup, invite, and password reset flows. Cross-device usage requires browser continuity. Login and token retrieval happen server-side via the /authenticate endpoint. Available on all plans. Read more
Does Stytch support Anonymous / Guest authentication method?
Stytch does not support Anonymous / Guest authentication method. Stytch does not support anonymous or guest authentication as a first-class flow. All users must authenticate with a real credential. Developers can implement a guest-like experience by issuing short-lived sessions gated on full authentication, but there is no API for creating an anonymous user identity.
Does Stytch support Time-based One-Time Password (TOTP) MFA?
Stytch supports Time-based One-Time Password (TOTP) MFA. TOTP (RFC 6238) MFA using authenticator apps (Google Authenticator, Authy, 1Password, Microsoft Authenticator). QR code + manual secret provided at enrollment. 30-second time window with 1-window clock drift tolerance. Upon enrollment, 10 single-use backup codes are automatically generated. TOTP seed is 160-bit (SHA-1 HMAC per standard). Available on all plans. Read more
Does Stytch support HMAC-based One-Time Password (HOTP) MFA?
Stytch does not support HMAC-based One-Time Password (HOTP) MFA. HOTP (counter-based OTP per RFC 4226) is not natively supported as an MFA factor. Stytch implements only TOTP (time-based). Custom HOTP logic can be implemented server-side outside of Stytch but cannot be surfaced as a first-class Stytch MFA factor.
Does Stytch support Universal 2nd Factor (U2F) MFA?
Stytch supports Universal 2nd Factor (U2F) MFA. U2F hardware security keys (YubiKey, Titan Key) are supported through Stytch's WebAuthn implementation (FIDO2 supersedes the original U2F spec but maintains backward compatibility with U2F-enrolled devices). Biometric authenticators and hardware tokens are both supported as MFA factors. Available on all plans. Read more
Does Stytch support WebAuthn MFA?
Stytch supports WebAuthn MFA. WebAuthn / FIDO2 supported as both a primary authentication factor and as an MFA second factor. Supports platform authenticators (Touch ID, Face ID, Windows Hello) and roaming authenticators (hardware security keys). Multiple authenticators can be registered per user. Passkeys and WebAuthn are implemented via the same unified API. Available on all plans. Read more
Does Stytch support Email Code MFA?
Stytch supports Email Code MFA. Email OTP as a second factor. 6-digit code sent to the user's verified email address. Configurable expiration (default 10 minutes). Cannot simultaneously use email OTP as primary factor and as MFA factor in the same session flow without careful session management. Available on all plans. Read more
Does Stytch support Phone Code MFA?
Stytch supports Phone Code MFA. SMS OTP as a second factor. 6-digit code sent to the user's verified phone number. WhatsApp delivery also available. Configurable expiration. Rate limiting applied per phone number. Using the same phone number for both primary passwordless auth and MFA is technically possible but requires session flow design to avoid confusion. Available on all plans. Read more
Does Stytch support Recovery Code MFA?
Stytch supports Recovery Code MFA. 10 single-use backup codes automatically generated when a user enrolls in TOTP MFA. Each code is a 12-character alphanumeric string. Codes are shown once and must be saved by the user. Individual codes can be used to recover access. New codes can be regenerated (invalidating all previous ones) via the /backup_codes/rotate endpoint. Read more
Does Stytch support Push Notification MFA?
Stytch partially supports Push Notification MFA. Stytch has no native push notification MFA app or SDK. Push-based MFA can be achieved by configuring Cisco Duo or another push MFA provider as an upstream SAML or OIDC identity provider within Stytch's B2B SSO flow, allowing Duo to handle the push challenge before issuing a SAML assertion to Stytch. This is an integration pattern, not a built-in Stytch MFA factor. Read more
Does Stytch support Adaptive / Risk-Based MFA MFA?
Stytch supports Adaptive / Risk-Based MFA MFA. Adaptive MFA is powered by Stytch Device Intelligence. Risk signals include device fingerprint (new vs. known device), IP reputation, impossible travel detection, and bot probability score. Developers trigger step-up MFA requirements in application logic when the Device Intelligence risk score exceeds a configured threshold. The Device Intelligence API returns a structured verdict and risk factors. 10,000 Device Intelligence lookups included free; $0.005 per lookup thereafter. Read more
Does Stytch support Cisco Duo MFA?
Stytch partially supports Cisco Duo MFA. Cisco Duo can be integrated with Stytch via SAML or OIDC federation in the B2B product, where Duo acts as the upstream identity provider and handles MFA challenges (including Duo Push) before returning a signed SAML assertion to Stytch. This is a federation integration pattern, not a native Duo API integration. Stytch does not call the Duo API directly; the user is redirected to Duo's hosted authentication page. Read more
Does Stytch support Step-Up Authentication MFA?
Stytch supports Step-Up Authentication MFA. Step-up authentication is natively supported via session factor inspection. After initial login, developers call the /sessions/authenticate endpoint and inspect the returned authentication_factors array. If a required factor is missing or the last MFA event is too old, the application redirects the user to complete the required factor. Token-based session management means step-up re-authentication updates the existing session rather than creating a new one. Read more
Does Stytch support OpenID Connect (OIDC) integration protocol?
Stytch supports OpenID Connect (OIDC) integration protocol. Stytch acts as an OAuth 2.0 authorization server and OpenID Connect identity provider. Supports Authorization Code flow (with PKCE), Client Credentials (M2M), and token refresh. Issues signed JWTs for access tokens and ID tokens. OIDC Discovery document available at the tenant's /.well-known/openid-configuration endpoint. Supports custom claims enrichment. Available on all plans. Read more
Does Stytch support SAML 2.0 integration protocol?
Stytch supports SAML 2.0 integration protocol. SAML 2.0 supported as both Service Provider (SP) and Identity Provider (IdP). In B2B, each organization can have its own SAML SSO connection. Free plan includes 5 SAML connections (across B2B orgs). Custom attribute mappings supported. SP-initiated and IdP-initiated flows both supported. Metadata auto-configuration from IdP metadata URL. Read more
Does Stytch support WS-Federation integration protocol?
Stytch does not support WS-Federation integration protocol. WS-Federation protocol is not supported by Stytch. Stytch's federation and SSO capabilities are built exclusively on SAML 2.0 and OIDC. Organizations requiring WS-Federation integration (e.g., legacy Microsoft environments using ADFS) must use SAML 2.0 as the integration protocol instead.
Does Stytch support Machine-to-Machine (M2M) Authentication integration protocol?
Stytch supports Machine-to-Machine (M2M) Authentication integration protocol. M2M tokens via OAuth 2.0 Client Credentials grant. M2M clients are issued a client ID and secret and can request access tokens with specific scopes. Stytch's M2M API supports custom scopes, configurable token TTL, and multiple clients per project. Tokens are signed JWTs verifiable locally or via the /m2m/authenticate endpoint. Available on all plans. Read more
Does Stytch support OpenID Connect (OIDC) Federation identity federation?
Stytch supports OpenID Connect (OIDC) Federation identity federation. Per-organization OIDC SSO connections in the B2B product. Each B2B org can configure its own OIDC identity provider (Google Workspace, Microsoft Entra ID, Okta, etc.). Attribute mapping from the upstream ID token to Stytch user profile fields is configurable. OIDC Discovery auto-configuration from provider's well-known endpoint is supported. JIT provisioning creates a Stytch user on first SSO login. Free plan includes 5 SSO connections total (shared with SAML). Read more
Does Stytch support SAML 2.0 Federation identity federation?
Stytch supports SAML 2.0 Federation identity federation. Per-organization SAML 2.0 SSO connections in the B2B product. Supports SP-initiated login and optionally IdP-initiated login. Custom attribute statements from the upstream IdP are mapped to Stytch user profile fields and RBAC roles. Certificate rotation and metadata refresh handled by Stytch. Free plan includes 5 SSO connections total (shared with OIDC). Read more
Does Stytch support Active Directory / LDAP identity federation?
Stytch does not support Active Directory / LDAP identity federation. Stytch does not support direct on-premises Active Directory or LDAP directory integration. There is no connector agent for AD/LDAP synchronization. Organizations using on-premises AD can integrate via SAML 2.0 (using ADFS, Azure AD Connect, or similar as the SAML IdP) or migrate users via bulk import.
Does Stytch support Azure Active Directory (Entra ID) identity federation?
Stytch supports Azure Active Directory (Entra ID) identity federation. Microsoft Entra ID (Azure AD) is supported as an upstream SSO provider via both OIDC and SAML 2.0 connections. In the B2B product, each org can link its Entra ID tenant as the SSO connection. Attribute mapping from Entra ID claims to Stytch profile fields is configurable. SCIM provisioning from Entra ID is also supported for automatic user lifecycle management. Read more
Does Stytch support Bulk User Import user management?
Stytch supports Bulk User Import user management. Users can be imported via the Management API (/users/import or migration endpoints). Import accepts email, phone, name, metadata fields, and optionally an existing password hash. Each user is created individually via API — there is no file-upload batch job interface. For large-scale migrations, the lazy migration (migrate endpoint) approach is recommended as the primary path, with bulk import for non-password-based users. Read more
Does Stytch support Password Hash Import (Multiple Formats) user management?
Stytch supports Password Hash Import (Multiple Formats) user management. Existing password hashes can be imported via the /passwords/migrate endpoint. Supported hash formats: bcrypt ($2a$, $2b$, $2y$), scrypt, argon2i, argon2id, MD5, SHA-1, SHA-256, SHA-512, and the PHC string format. Password hash parameters (salt, iterations, memory) must be provided alongside the hash. On next login, Stytch verifies the imported hash and transparently re-hashes to its internal format. Read more
Does Stytch support Bulk User Export user management?
Stytch supports Bulk User Export user management. User data can be exported via the Search Users API (/users/search) which supports paginated retrieval of all users with filtering by email, phone, name, creation date, and metadata fields. No dedicated single-click export UI or file generation — developers must paginate through results using the cursor returned in the response. JSON format only. Read more
Does Stytch support Bulk User Update / Delete user management?
Stytch partially supports Bulk User Update / Delete user management. Individual user update and delete operations are fully supported via the Management API (PUT /users/{user_id} and DELETE /users/{user_id}). There is no native batch or bulk update/delete endpoint — each operation must be called per user. High-volume operations must be scripted against individual API calls subject to rate limiting. User metadata can be partially updated (PATCH semantics for metadata fields). Read more
Does Stytch support Upsert on Import user management?
Stytch supports Upsert on Import user management. The /passwords/migrate and user creation endpoints support upsert semantics: if a user with the given email already exists in Stytch, the request links the new authentication factor (or updates the password hash) to the existing user rather than creating a duplicate. Metadata provided during upsert is merged with existing metadata by default. Read more
Does Stytch support Legacy Username Import (Non-Allowed Characters) user management?
Stytch partially supports Legacy Username Import (Non-Allowed Characters) user management. Stytch's primary user identifier is email address; username-as-identifier is not a first-class concept. Username authentication exists via the Passwords API where an email is always required. Users with legacy usernames that are not valid email addresses must be mapped to an email-format identifier or use an alternative authentication method. Special characters are generally not an issue since the identifier is typically an email. Read more
Does Stytch support MFA Enrollment Import user management?
Stytch partially supports MFA Enrollment Import user management. TOTP seeds can be imported alongside user accounts during migration using the /totps/migrate endpoint, which allows supplying the existing TOTP secret so users do not need to re-enroll their authenticator app. Phone numbers (for SMS MFA) are imported as part of user profile import. Importing pre-existing WebAuthn authenticator registrations is not supported — users must re-enroll WebAuthn after migration. Read more
Does Stytch support Inbound SCIM Provisioning user management?
Stytch supports Inbound SCIM Provisioning user management. SCIM 2.0 inbound provisioning from enterprise IdPs (Okta, Microsoft Entra ID, Google Workspace, etc.) into Stytch B2B Organizations. Supports user create, update, deactivate (suspend), and delete lifecycle events. SCIM tokens are generated per organization. Free plan includes 5 SCIM connections. SCIM provisioning maps to Stytch Organization member roles via group-to-role mapping. Read more
Does Stytch support Outbound SCIM Provisioning user management?
Stytch does not support Outbound SCIM Provisioning user management. Stytch does not support outbound SCIM 2.0 provisioning from Stytch to third-party applications. Stytch is a SCIM consumer (inbound), not a SCIM provider (outbound). Propagating user changes from Stytch to downstream systems requires custom webhook-based automation.
Does Stytch support SCIM Groups Provisioning user management?
Stytch supports SCIM Groups Provisioning user management. SCIM Groups are supported in the B2B product. Groups synced from the enterprise IdP via SCIM are mapped to Stytch Organization member roles using configurable group-to-role mapping rules. Adding a user to or removing them from a group in the upstream IdP automatically updates their role assignment in the Stytch Organization. Read more
Does Stytch support Just-In-Time (JIT) User Provisioning user management?
Stytch supports Just-In-Time (JIT) User Provisioning user management. Just-in-time provisioning is supported for both SAML and OIDC SSO connections in the B2B product. On the first SSO login, if no Stytch member exists matching the SSO email, a new member is automatically created in the Organization with the role configured for the connection (default: member). JIT provisioning is enabled by default and can be disabled per SSO connection if pre-provisioning is preferred. Read more
Does Stytch support Lazy / Trickle Migration from Legacy Database user management?
Stytch supports Lazy / Trickle Migration from Legacy Database user management. Stytch's /passwords/migrate endpoint enables lazy (trickle) migration from a legacy identity store. On login, the developer's backend calls the migrate endpoint with the user's email and plaintext password; Stytch calls a developer-configured webhook to verify the credentials against the legacy system. If successful, Stytch creates the user (or links the password to an existing account) and returns a session. The legacy system must remain online and reachable until migration completes. Subsequent logins use Stytch natively without touching the legacy system. Read more
Does Stytch support Self-Service Profile Management Portal user management?
Stytch partially supports Self-Service Profile Management Portal user management. The B2B product includes a prebuilt embeddable Admin Portal where organization administrators can manage members, configure SSO, and update organization settings without developer effort. There is no equivalent end-user self-service profile portal for B2C — developers must build their own profile management UI using the Stytch Management API (update user, manage MFA factors, etc.). Read more
Does Stytch support User Account Linking user management?
Stytch supports User Account Linking user management. Multiple authentication factors and identity sources (social OAuth, email, phone, passkeys) are automatically linked to a single Stytch user when the email address matches. Explicit account linking via API also supported: existing authentication methods from one user can be merged into another. By default, OAuth sign-in with a matching email links to the existing user rather than creating a duplicate. Read more
Does Stytch support User Blocking / Banning user management?
Stytch supports User Blocking / Banning user management. Users can be blocked (revoked) via the Management API. A revoked user cannot authenticate and all active sessions for that user are invalidated. The user record and associated data remain intact for audit purposes. Revocation takes effect immediately and is reflected in all session validation calls. Users can be re-activated via API. Read more
Does Stytch support User Metadata user management?
Stytch supports User Metadata user management. Stytch distinguishes two metadata types: untrusted_metadata (user-editable, suitable for non-sensitive preferences) and trusted_metadata (admin-only, never writeable via client SDKs). Both are stored as arbitrary JSON objects on the user profile. Metadata is returned in session and user GET responses. Metadata fields can be targeted in user search queries. Read more
Does Stytch support Application Metadata user management?
Stytch supports Application Metadata user management. Stytch's trusted_metadata field is the equivalent of application metadata — it is admin-only and cannot be written by client-side SDK calls or by the user. It is set exclusively via the backend Management API (requires a secret API key). Use cases include internal user flags, subscription tier, feature flags, and compliance attributes. Read more
Does Stytch support Metadata Size Limits user management?
Stytch partially supports Metadata Size Limits user management. Stytch stores both trusted_metadata and untrusted_metadata as JSON objects. Both fields accept arbitrary JSON. Specific per-field or total size limits are not prominently documented in the public docs as of mid-2025. Overly large metadata objects may cause issues with JWT claim sizes if metadata is embedded in tokens. Developers should keep metadata lean for session-performance reasons. Read more
Does Stytch support User Search user management?
Stytch supports User Search user management. The /users/search endpoint supports paginated full-text and field-specific search. Operators include exact match, contains, and range filters on fields: email, phone number, name, creation date, and arbitrary metadata keys. Results are cursor-paginated (100 users/page by default). Suitable for admin tooling and user management dashboards; not intended for use in authentication hot paths. Read more
Does Stytch support Role-Based Access Control (RBAC) user management?
Stytch supports Role-Based Access Control (RBAC) user management. Full RBAC available in the B2B product via the Stytch RBAC API. Custom roles with arbitrary permission sets can be created per project. Members are assigned one or more roles within an Organization. SCIM group-to-role mapping is supported for SSO-based provisioning. Permissions are embedded in session JWTs and can be enforced server-side via the /sessions/authenticate endpoint which returns the effective permissions list. B2C RBAC via custom RBAC API also available. Read more
Does Stytch support Organizations (Multi-Tenancy B2B) user management?
Stytch supports Organizations (Multi-Tenancy B2B) user management. Stytch B2B is built on an organization-first data model. Each Organization is an isolated tenant with its own members, SSO connections, SCIM connections, MFA policies, and branding. Organizations have configurable auth methods (which login methods are allowed per org), JIT provisioning settings, session token duration, and role defaults. The number of Organizations per project scales to meet enterprise needs. Organizations API supports full CRUD. Read more
Does Stytch support Password Strength Policies user management?
Stytch supports Password Strength Policies user management. Password strength is enforced using the zxcvbn library (scores 0–4). The minimum required strength score is configurable at the project level (score 3 or 4 recommended for security-critical apps). Additionally, passwords are checked against the HaveIBeenPwned breach database at signup and login; this check can be configured to block or warn. Minimum password length is configurable (default 8 characters). Read more
Does Stytch support Username Restrictions user management?
Stytch partially supports Username Restrictions user management. Stytch's primary identifier is email address, not a traditional username. The Passwords API requires a valid email address format as the user identifier. There is no separate username field in the core user schema. Developers can store a display username in user_metadata, but authentication always uses email. This means organizations requiring non-email usernames (e.g., alphanumeric handles) must implement identifier-to-email mapping at the application layer. Read more
Does Stytch support Progressive Profiling / Forms user management?
Stytch partially supports Progressive Profiling / Forms user management. Stytch does not have a built-in no-code progressive profiling form builder. Developers implement progressive data collection by updating the user's untrusted_metadata or trusted_metadata via the Management API after each login or at dedicated profile-completion steps in the app. The API-first design means any form logic and conditional collection must be implemented in the application frontend and backend. Read more
Does Stytch support Attribute-Based Access Control (ABAC) access control?
Stytch does not support Attribute-Based Access Control (ABAC) access control. Stytch does not offer a native attribute-based access control (ABAC) policy engine. Access control decisions based on user, resource, and environment attributes must be implemented in the application layer using Stytch's RBAC permissions as a starting point, combined with custom logic in the developer's backend.
Does Stytch support Fine-Grained Authorization (FGA / ReBAC) access control?
Stytch does not support Fine-Grained Authorization (FGA / ReBAC) access control. Fine-grained authorization (ReBAC/Zanzibar-style object-level permissions) is not offered by Stytch. Developers requiring FGA must integrate a dedicated authorization service (e.g., Permit.io, OpenFGA, SpiceDB) alongside Stytch for identity.
Does Stytch support API Authorization (Scopes / Permissions) access control?
Stytch supports API Authorization (Scopes / Permissions) access control. OAuth 2.0 scopes and permissions are supported for API authorization. M2M clients can request specific scopes. B2B RBAC permissions are embedded in session tokens and exposed via the /sessions/authenticate endpoint's authorization_check parameter, which evaluates whether the authenticated user has the required resource-action permission. Custom scopes can be defined per project. Read more
Does Stytch support Audit Log Retention security feature?
Stytch supports Audit Log Retention security feature. Authentication event logs (login, signup, MFA, session creation/revocation, etc.) are retained and accessible via the Stytch dashboard and API. The specific retention window varies by plan. Enterprise customers can configure extended retention or stream logs to external SIEM platforms. Log events include IP address, user agent, geographic location, and authentication method. Read more
Does Stytch support Audit Log Streaming security feature?
Stytch supports Audit Log Streaming security feature. Audit log streaming to external platforms (Datadog, Splunk, custom SIEM via webhooks) is supported on Enterprise plans. Events are delivered in real time or near-real time. Streaming is configured via the Stytch dashboard or API. Available on Enterprise plan. Read more
Does Stytch support Security Center (Threat Monitoring Dashboard) security feature?
Stytch partially supports Security Center (Threat Monitoring Dashboard) security feature. Stytch provides a Device Intelligence dashboard showing fraud signals, bot activity, device fingerprint trends, and risky login events. There is no dedicated 'Security Center' threat monitoring product comparable to Auth0's or Okta's security event feed. Authentication analytics and Device Intelligence metrics are viewable in the Stytch dashboard. Full-featured security monitoring requires streaming logs to an external SIEM. Read more
Does Stytch support Encryption at Rest security feature?
Stytch supports Encryption at Rest security feature. All user data, credentials, and session data stored by Stytch are encrypted at rest using AES-256. Stytch's infrastructure is hosted on AWS with native AWS KMS-managed encryption for storage volumes and RDS instances. Read more
Does Stytch support Encryption in Transit security feature?
Stytch supports Encryption in Transit security feature. All API communications with Stytch require HTTPS with TLS 1.2 or higher. TLS 1.3 is supported and preferred. Stytch-issued JWTs for sessions and access tokens use RS256 (RSA-SHA256) signing. Public JWKS endpoints allow local token verification without calling back to Stytch on every request. Read more
Does Stytch support Customer Managed Keys (BYOK) security feature?
Stytch does not support Customer Managed Keys (BYOK) security feature. Stytch does not offer bring-your-own-key (BYOK) or customer-managed encryption key support. All encryption keys are managed by Stytch using AWS KMS. Organizations requiring control over their encryption keys should discuss custom enterprise arrangements with Stytch.
Does Stytch support Bot Detection security feature?
Stytch supports Bot Detection security feature. Stytch Device Intelligence includes invisible ML-based bot detection that does not require CAPTCHA challenges. The bot probability score (0.0–1.0) is returned alongside device fingerprint data in the Device Intelligence API response. Developers can gate authentication actions on this score. Bot detection analyzes behavioral signals, browser characteristics, and network patterns. First 10,000 Device Intelligence lookups are free; $0.005 per lookup thereafter. Read more
Does Stytch support Brute Force Protection security feature?
Stytch supports Brute Force Protection security feature. Brute force protection is built into all Stytch authentication endpoints. Repeated failed authentication attempts from the same IP or for the same email address trigger rate limiting and lockouts. For passwords specifically, Stytch applies progressive delays and temporary lockouts after repeated failures. Email and SMS OTP codes expire (default 10 minutes) and are single-use, inherently limiting brute force surface. Available on all plans. Read more
Does Stytch support Suspicious IP Throttling security feature?
Stytch supports Suspicious IP Throttling security feature. Stytch applies suspicious IP throttling to authentication endpoints. IPs generating abnormally high request volumes (login attempts, OTP sends, etc.) are rate limited. The Device Intelligence layer also flags IPs associated with proxies, VPNs, and known malicious infrastructure in the risk score. Developers can use the Device Intelligence IP risk signal to apply additional verification for suspicious IPs. Read more
Does Stytch support Breached Password Detection security feature?
Stytch supports Breached Password Detection security feature. Password breach detection is integrated via HaveIBeenPwned (HIBP) at password creation and reset. Uses k-anonymity hash prefix lookup (the full password is never sent to HIBP). Configurable behavior: block signup/reset if the password appears in breaches, or warn the user. Also included in the /passwords/strength_check endpoint so developers can surface breach status in real time during password entry. Read more
Does Stytch support Credential Guard (Dark Web Monitoring) security feature?
Stytch does not support Credential Guard (Dark Web Monitoring) security feature. Stytch does not offer proactive dark web monitoring or continuous credential guard for compromised user credentials beyond the HIBP breach check at password creation/reset. Real-time breach monitoring across all users is not an offered product feature.
Does Stytch support Tenant Access Control List (IP ACL) security feature?
Stytch partially supports Tenant Access Control List (IP ACL) security feature. IP-based access restriction is available at the Organization level in the B2B product: organizations can be configured to restrict which allowed domains and email patterns members may use. Project-level IP allowlisting for API access is available for Enterprise plans. Stytch does not currently offer geographic blocking or TLS fingerprint-based ACLs as a standard product feature. Read more
Does Stytch support Device Fingerprinting security feature?
Stytch supports Device Fingerprinting security feature. Device fingerprinting is a core Stytch product sold as Device Intelligence (formerly Stytch Device Fingerprinting). Each device lookup generates a persistent device_id and a structured verdict including: browser fingerprint signals, bot probability, IP risk level, new/known device status, and impossible travel detection. Fingerprints persist across browser sessions. First 10,000 lookups per month are free; $0.005 per lookup thereafter, billed separately from MAU. Read more
Does Stytch support Per-Organization Branding multi-tenancy?
Stytch supports Per-Organization Branding multi-tenancy. Each B2B Organization can be configured with its own display name, logo URL, and slug. When using Stytch's prebuilt UI (StytchB2BUI components or the Admin Portal), branding is applied per org automatically. Custom domain per org is not natively supported — all orgs share the project's custom domain with org-specific routing by slug. Read more
Does Stytch support Per-Organization MFA Policy multi-tenancy?
Stytch supports Per-Organization MFA Policy multi-tenancy. MFA enforcement policy is configurable per Organization in the B2B product. Options include: OPTIONAL (users may opt in), REQUIRED_FOR_ALL (all members must complete MFA on every session), and REQUIRED_FOR_ADMINS (admin roles must complete MFA). MFA method allowlist (which factors are permitted) is also configurable per org. Policy enforcement happens at session creation and authentication. Read more
Does Stytch support Hosted / Universal Login Page branding feature?
Stytch supports Hosted / Universal Login Page branding feature. Stytch provides a hosted login UI via StytchUI (Stytch's hosted page option). The hosted page can be configured with logo, colors, and enabled authentication methods. Custom domain is supported. The hosted UI is available as an alternative to the headless SDK approach for teams that prefer a managed UI without writing frontend authentication components. Read more
Does Stytch support Embedded / Native Login Components branding feature?
Stytch supports Embedded / Native Login Components branding feature. Stytch's core model is headless API-first, enabling fully embedded authentication without any redirects. Prebuilt UI components (React, React Native) can be embedded directly into the app. The B2B product includes an embeddable Admin Portal for organization management. The headless approach gives full control over the authentication UX while Stytch handles the backend logic. Read more
Does Stytch support White-Label / Full Brand Removal branding feature?
Stytch partially supports White-Label / Full Brand Removal branding feature. Stytch's headless API approach means the authentication UX is fully controlled by the developer without Stytch branding by default when using the API directly. The prebuilt StytchUI components may include 'Powered by Stytch' branding in their default configuration; removing this branding is available as a paid add-on. Developers who build fully custom UI using the Stytch API achieve true white-label without extra cost. Read more
Does Stytch support Localization / i18n branding feature?
Stytch supports Localization / i18n branding feature. Stytch's frontend SDKs (JavaScript/React, React Native, iOS, Android) support internationalization (i18n) with configurable string overrides for all authentication UI text. Developers can supply locale-specific string maps. Multiple languages are supported in the prebuilt UI components. Server-side email templates also support localization via customizable template content. Read more
Does Stytch support Prebuilt UI Components (SDK) branding feature?
Stytch supports Prebuilt UI Components (SDK) branding feature. StytchUI provides prebuilt React and React Native components for login/signup flows (magic link, OTP, OAuth, passwords, passkeys). The B2B product adds a prebuilt embeddable Admin Portal (iFrame-based) for organization admins to manage SSO, SCIM, members, and MFA policies without developer effort. iOS (Swift) and Android (Kotlin) SDKs provide native UI components. All components are customizable via theme configuration. Read more
Does Stytch support Login / Auth Analytics Dashboard analytics?
Stytch supports Login / Auth Analytics Dashboard analytics. Stytch's dashboard includes authentication analytics: daily/weekly/monthly active user counts, authentication success and failure rates by method, new signup trends, and MFA enrollment rates. The Logs API (/logs) supports querying authentication events programmatically for custom analytics pipelines. Device Intelligence adds fraud and risk signal trends to the analytics view. Read more
Does Stytch support SOC 2 Type II Certification compliance?
Stytch supports SOC 2 Type II Certification compliance. Stytch maintains SOC 2 Type II certification covering the Security trust service criterion. Annual independent audit. SOC 2 report is available under NDA to customers on Growth and Enterprise plans. Read more
Does Stytch support ISO 27001 / 27017 / 27018 Certification compliance?
Stytch partially supports ISO 27001 / 27017 / 27018 Certification compliance. ISO 27001 certification status could not be confirmed from publicly available Stytch documentation as of mid-2025. Stytch's security page highlights SOC 2 Type II and HIPAA as primary compliance frameworks. Customers with ISO 27001 requirements should contact Stytch directly to request current certification status. Read more
Does Stytch support HIPAA Business Associate Agreement (BAA) compliance?
Stytch supports HIPAA Business Associate Agreement (BAA) compliance. Stytch offers a HIPAA Business Associate Agreement (BAA) for customers handling protected health information. The BAA is available on Growth and Enterprise plans. Stytch's infrastructure is designed to support HIPAA-compliant deployments. Customers must request the BAA through the Stytch team. Read more
Does Stytch support PCI DSS Compliance compliance?
Stytch does not support PCI DSS Compliance compliance. Stytch does not specifically advertise PCI DSS compliance or offer a PCI-scoped deployment option. As a CIAM platform, Stytch does not process payment card data and is not in scope for PCI DSS in typical deployments. Organizations requiring PCI DSS-compliant authentication infrastructure should consult with Stytch to assess applicability.
Does Stytch support CSA STAR Certification compliance?
Stytch does not support CSA STAR Certification compliance. CSA STAR certification is not listed among Stytch's published compliance certifications. Stytch's publicly documented compliance posture focuses on SOC 2 Type II and HIPAA. Read more
Does Stytch support FedRAMP Authorization compliance?
Stytch does not support FedRAMP Authorization compliance. Stytch does not hold FedRAMP authorization (Moderate or High). Stytch is a commercial SaaS platform not targeting US federal government workloads. US federal agencies requiring FedRAMP-authorized identity solutions should evaluate purpose-built government offerings.
Does Stytch support GDPR: Data Export (Portability) compliance?
Stytch supports GDPR: Data Export (Portability) compliance. User data export to fulfill GDPR Article 20 (right to data portability) is supported via the Management API. The /users/{user_id} GET endpoint returns the full user profile including all metadata, linked authentication factors, and creation/update timestamps in JSON format. Developers are responsible for aggregating data from external systems if user data is stored across multiple locations. Read more
Does Stytch support GDPR: Right to be Forgotten (User Deletion) compliance?
Stytch supports GDPR: Right to be Forgotten (User Deletion) compliance. User deletion (right to erasure, GDPR Article 17) is supported via the DELETE /users/{user_id} endpoint. Deletion permanently removes the user profile, all linked authentication factors, and active sessions from Stytch's system. Audit log entries referencing the user's identifier may be retained for a period per Stytch's data retention policy. Developers are responsible for deleting user data in downstream systems. Read more
Does Stytch support Consent Management compliance?
Stytch does not support Consent Management compliance. Stytch does not offer built-in consent management for marketing opt-ins, terms of service acceptance, or granular data processing consent. OAuth scope consent screens are available for standard OAuth flows, but custom consent collection and management must be implemented in the application layer. User consent preferences can be stored in trusted_metadata as a workaround.
Does Stytch support Region Deployment compliance?
Stytch does not support Region Deployment compliance. Stytch's multi-tenant SaaS infrastructure is hosted in the United States (AWS us-east-1 primary). There is no self-service option to select an EU, APAC, or other regional deployment for data residency requirements. Enterprise customers with strict data residency requirements should discuss private deployment options with Stytch. Read more
Does Stytch support Private Cloud Deployment compliance?
Stytch does not support Private Cloud Deployment compliance. Stytch is a SaaS-only platform with no single-tenant private cloud deployment offering available as a standard product. Enterprise customers with isolation requirements should inquire with Stytch's enterprise team about custom deployment options.
Does Stytch support SDK Coverage developer integration?
Stytch supports SDK Coverage developer integration. Official Stytch SDKs available for: JavaScript (vanilla, React, React Native, Next.js), iOS (Swift), Android (Kotlin), Node.js, Python, Ruby, Go, Java, and .NET (C#). Separate frontend SDKs for browser/mobile and backend SDKs for server-side management. The frontend JavaScript SDK handles session token management, local JWT verification, and token refresh automatically. Stytch also provides a B2B-specific variant of each SDK. Read more
Does Stytch support Management API developer integration?
Stytch supports Management API developer integration. Stytch provides a comprehensive REST Management API covering all identity resources: users, sessions, authentication factors, organizations, RBAC, SSO connections, SCIM connections, and M2M clients. API uses secret/public key pair authentication. Rate limits apply per project. All endpoints return structured JSON responses with consistent error codes. Read more
Does Stytch support Authentication API Rate Limits developer integration?
Stytch supports Authentication API Rate Limits developer integration. Stytch enforces rate limits on all API endpoints. Authentication endpoints (OTP send, magic link send, authenticate) are rate-limited per user and per IP to prevent abuse. Exact rate limit thresholds vary by endpoint type and plan tier. Enterprise plans have elevated rate limits. Rate limit responses return HTTP 429 with a Retry-After header. Specific per-endpoint limits are documented in the API reference. Read more
Does Stytch support Actions / Extensibility Pipeline developer integration?
Stytch partially supports Actions / Extensibility Pipeline developer integration. Stytch is API-first and does not have a hosted extensibility runtime (no Auth0-style 'Actions' where Stytch executes your code). Extensibility is achieved via: (1) webhooks for event-driven post-authentication workflows, (2) composing Stytch API calls with custom backend logic before/after authentication, and (3) using Stytch as an OIDC/SAML provider that a downstream orchestration layer can hook into. There is no visual flow builder or sandboxed code execution environment. Read more
Does Stytch support TypeScript Support in Extensibility developer integration?
Stytch does not support TypeScript Support in Extensibility developer integration. Stytch does not have a hosted extensibility runtime where developer code is executed (no Actions system). TypeScript is fully supported for all client and server-side Stytch SDK code that developers write and host themselves — the SDKs ship with native TypeScript types. However, the concept of 'TypeScript in Actions' (hosted extensibility scripts) is not applicable as Stytch has no such hosted execution environment. Read more
Does Stytch support Custom Domain developer integration?
Stytch supports Custom Domain developer integration. Custom domains are supported for all API endpoints and hosted login pages. Setting a custom domain is required for WebAuthn/passkey relying party ID configuration (which must match the origin domain). Custom domain TLS certificates are managed by Stytch via automated certificate provisioning. Available on all plans. Read more
Does Stytch support Deploy CLI (Infrastructure as Code) developer integration?
Stytch does not support Deploy CLI (Infrastructure as Code) developer integration. Stytch does not offer an official deploy CLI for exporting and importing project configuration as code. Project settings (SSO connections, SCIM connections, RBAC policies) are managed via the dashboard UI or the Management API. CI/CD teams must script configuration changes using the REST API directly.
Does Stytch support Terraform Provider developer integration?
Stytch does not support Terraform Provider developer integration. There is no official Stytch Terraform provider. Infrastructure-as-code management of Stytch project configuration must be done via the REST Management API, scripted with tools like Terraform's http provider or custom solutions.
Does Stytch support Custom Database Connections developer integration?
Stytch does not support Custom Database Connections developer integration. Stytch does not support custom database connections (Auth0-style scripts that proxy authentication to a legacy database). The equivalent capability is Stytch's lazy migration flow via the /passwords/migrate endpoint, which calls a developer-managed webhook to verify credentials against the legacy system on first login. This achieves the same migration outcome but Stytch does not run scripts inside the platform. Read more
Does Stytch support Native Webhook Support developer integration?
Stytch supports Native Webhook Support developer integration. Stytch natively supports webhooks for key authentication and lifecycle events: login, signup, MFA completion, session creation, user deletion, SSO connection events, SCIM provisioning events, and more. Webhook endpoints are registered via the Stytch dashboard. Payloads are signed with an HMAC-SHA256 signature for verification. Retry logic with exponential backoff is applied on non-2xx responses. Read more
Does Stytch support Universal Login / Hosted Login Page Customization developer integration?
Stytch supports Universal Login / Hosted Login Page Customization developer integration. Stytch's hosted login UI and prebuilt StytchUI components support customization via a theme configuration object (logo URL, primary color, button styles, font family). The headless SDK approach allows 100% custom HTML/CSS for teams that prefer building from scratch. Email templates are separately customizable with HTML and template variables. Read more
Does Stytch support Custom Email Provider (SMTP) developer integration?
Stytch supports Custom Email Provider (SMTP) developer integration. Custom SMTP and third-party email provider configuration is supported. Stytch can route transactional authentication emails (magic links, OTP codes, invite emails) through a configured SendGrid, Postmark, Mailgun, or custom SMTP server. Bringing a custom sender domain allows fully branded emails from a custom from-address. Available on Growth and Enterprise plans. Read more
Does Stytch support Email Templates developer integration?
Stytch supports Email Templates developer integration. Stytch provides customizable HTML email templates for all authentication emails: magic links, email OTP codes, password reset, and invitations. Templates support variable substitution for user name, OTP code, and expiration time. Custom templates are configured via the Stytch dashboard. Multiple template variants per email type allow A/B testing or locale-specific content. Read more
Does Stytch support Custom OIDC Claims / Token Enrichment developer integration?
Stytch supports Custom OIDC Claims / Token Enrichment developer integration. Custom claims can be added to Stytch session JWTs and OIDC tokens via the trusted_metadata and untrusted_metadata fields. Metadata fields present in the user profile are accessible in the token payload. Additionally, the Stytch OIDC configuration supports custom claim mapping. Stytch session JWTs include authentication factors, session timestamps, and user metadata by default. Read more
Does Stytch support No-Code Auth Flow Builder / Orchestration feature?
Stytch does not support No-Code Auth Flow Builder / Orchestration feature. Stytch does not offer a no-code or low-code visual flow builder for authentication journeys. Stytch is intentionally code-first and API-first. Authentication flows are composed by developers using the Stytch SDK and REST API calls in their own application code. Teams requiring a visual flow orchestration tool would need to build on top of Stytch's APIs.
Does Stytch support Identity Verification / Document Proofing feature?
Stytch does not support Identity Verification / Document Proofing feature. Stytch does not offer built-in government ID verification, biometric liveness checking, or identity document proofing. Developers needing identity verification can integrate a third-party service (Persona, Onfido, Jumio, etc.) alongside Stytch, then store the verification result in trusted_metadata.
Does Stytch support Decentralized / Verifiable Credentials feature?
Stytch does not support Decentralized / Verifiable Credentials feature. Stytch does not support W3C Verifiable Credentials, Decentralized Identifiers (DIDs), or wallet-based authentication. Stytch's identity model is centralized around email-as-identifier.
Does Stytch support Built-in Billing / Subscription Management feature?
Stytch does not support Built-in Billing / Subscription Management feature. Stytch does not offer native billing or subscription management integration. Monetizing application features via the identity platform requires a separate billing solution (Stripe, Chargebee, etc.). Subscription state can be stored in Stytch trusted_metadata as a workaround for surfacing subscription tier in session tokens.
Does Stytch support Agentic AI / MCP Server Authentication feature?
Stytch does not support Agentic AI / MCP Server Authentication feature. Stytch has not released dedicated authentication support for AI agents or MCP (Model Context Protocol) servers as of mid-2025. M2M tokens (Client Credentials) are available for service-to-service auth and can be used in agentic contexts, but there is no MCP-specific auth product, token exchange for delegated agent permissions, or agent identity primitive. Read more
Does Stytch support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Stytch does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No public evidence found that Stytch supports ML-DSA, SLH-DSA, or FN-DSA for JWT/OIDC/SAML signing.
Does Stytch support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Stytch does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does Stytch support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Stytch does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does Stytch support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Stytch does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.