# Stytch Docs: API & SDK reference Consumer API Consumer API ## Consumer API - [Consumer Authentication API Reference](https://stytch.com/docs/api-reference/consumer/api/overview.md): Use the Stytch Consumer API to build single-tenant authentication for your application. - [Backend SDKs](https://stytch.com/docs/api-reference/consumer/api/sdks.md): Explore Stytch's official backend SDKs for Python, Go, Node, Ruby, and Java/Kotlin. ### Endpoints #### Users - [User Object](https://stytch.com/docs/api-reference/consumer/api/users/user-object.md): The User Object represents an individual end user's account. - [Create User](https://stytch.com/docs/api-reference/consumer/api/users/create-user.md): Add a User to Stytch. - [Search Users](https://stytch.com/docs/api-reference/consumer/api/users/search-users.md): Search for Users within your Stytch Project. - [Get User](https://stytch.com/docs/api-reference/consumer/api/users/get-user.md): Get information about a specific User. - [Update User](https://stytch.com/docs/api-reference/consumer/api/users/update-user.md): Update a User's attributes. - [Exchange Primary Factor](https://stytch.com/docs/api-reference/consumer/api/users/exchange-primary-factor.md): Exchange a user's email address or phone number for another. ##### Delete - [Delete User](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user.md): Delete a User from Stytch. - [Delete User Email](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-email.md): Delete an email from a User. - [Delete User Phone Number](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-phone-number.md): Delete a phone number from a User. - [Delete User WebAuthn Registration](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-webauthn-registration.md): Delete a WebAuthn registration from a User. - [Delete User Biometric Registration](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-biometric-registration.md): Delete a biometric registration from a User. - [Delete User TOTP](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-totp.md): Delete a TOTP from a User. - [Delete User Crypto Wallet](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-crypto-wallet.md): Delete a crypto wallet from a User. - [Delete User Password](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-password.md): Delete a password from a User. - [Delete User OAuth Registration](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-oauth-registration.md): Delete an OAuth registration from a User. - [Delete User External ID](https://stytch.com/docs/api-reference/consumer/api/users/delete/delete-user-external-id.md): Delete an external ID from a User. #### Magic Links - [Authenticate](https://stytch.com/docs/api-reference/consumer/api/magic-links/authenticate.md): Authenticate a User given a Magic Link. ##### Via Email - [Send Magic Link](https://stytch.com/docs/api-reference/consumer/api/magic-links/via-email/send-magic-link.md): Send a magic link to an existing Stytch user using their email address. - [Log In Or Create User](https://stytch.com/docs/api-reference/consumer/api/magic-links/via-email/log-in-or-create-user.md): Use an email magic link to log in or create a new user. - [Invite](https://stytch.com/docs/api-reference/consumer/api/magic-links/via-email/invite.md): Create a User and send an invite Magic Link to the provided email. - [Revoke Pending Invite](https://stytch.com/docs/api-reference/consumer/api/magic-links/via-email/revoke-pending-invite.md): Revoke a pending invite by email address. ##### Embeddable - [Create](https://stytch.com/docs/api-reference/consumer/api/magic-links/embeddable/create.md): Create an Embeddable Magic Link token for a User. #### OAuth - [Attach](https://stytch.com/docs/api-reference/consumer/api/oauth/attach.md): Generate an OAuth Attach Token. - [Authenticate](https://stytch.com/docs/api-reference/consumer/api/oauth/authenticate.md): Authenticate an OAuth token. ##### Start - [Google](https://stytch.com/docs/api-reference/consumer/api/oauth/start/google.md): Start the Google OAuth flow - [Amazon](https://stytch.com/docs/api-reference/consumer/api/oauth/start/amazon.md): Start the Amazon OAuth flow - [Apple](https://stytch.com/docs/api-reference/consumer/api/oauth/start/apple.md): Start the Apple OAuth flow - [Bitbucket](https://stytch.com/docs/api-reference/consumer/api/oauth/start/bitbucket.md): Start the Bitbucket OAuth flow - [Coinbase](https://stytch.com/docs/api-reference/consumer/api/oauth/start/coinbase.md): Start the Coinbase OAuth flow - [Discord](https://stytch.com/docs/api-reference/consumer/api/oauth/start/discord.md): Start the Discord OAuth flow - [Facebook](https://stytch.com/docs/api-reference/consumer/api/oauth/start/facebook.md): Start the Facebook OAuth flow - [Figma](https://stytch.com/docs/api-reference/consumer/api/oauth/start/figma.md): Start the Figma OAuth flow - [GitHub](https://stytch.com/docs/api-reference/consumer/api/oauth/start/github.md): Start the Github Oauth flow - [GitLab](https://stytch.com/docs/api-reference/consumer/api/oauth/start/gitlab.md): Start the GitLab OAuth flow - [LinkedIn](https://stytch.com/docs/api-reference/consumer/api/oauth/start/linkedin.md): Start the LinkedIn OAuth flow - [Microsoft](https://stytch.com/docs/api-reference/consumer/api/oauth/start/microsoft.md): Start the Microsoft OAuth flow - [Salesforce](https://stytch.com/docs/api-reference/consumer/api/oauth/start/salesforce.md): Start the Salesforce OAuth flow - [Slack](https://stytch.com/docs/api-reference/consumer/api/oauth/start/slack.md): Start the Slack OAuth flow - [Snapchat](https://stytch.com/docs/api-reference/consumer/api/oauth/start/snapchat.md): Start the Snapchat OAuth flow - [TikTok](https://stytch.com/docs/api-reference/consumer/api/oauth/start/tiktok.md): Start the TikTok OAuth flow - [Twitch](https://stytch.com/docs/api-reference/consumer/api/oauth/start/twitch.md): Start the Twitch OAuth flow - [Twitter](https://stytch.com/docs/api-reference/consumer/api/oauth/start/twitter.md): Start the Twitter OAuth flow - [Yahoo](https://stytch.com/docs/api-reference/consumer/api/oauth/start/yahoo.md): Start the Yahoo OAuth flow #### Passwords - [Create](https://stytch.com/docs/api-reference/consumer/api/passwords/create.md): Create a new user with a password. - [Authenticate](https://stytch.com/docs/api-reference/consumer/api/passwords/authenticate.md): Authenticate a user with their email address and password. - [Strength Check](https://stytch.com/docs/api-reference/consumer/api/passwords/strength-check.md): Test a password's strength - [Migrate](https://stytch.com/docs/api-reference/consumer/api/passwords/migrate.md): Adds an existing password to a User's email that doesn't have a password yet. ##### Reset Options - [Password Reset By Email Start](https://stytch.com/docs/api-reference/consumer/api/passwords/reset-options/password-reset-by-email-start.md): Initiate a password reset by email. - [Password Reset By Email](https://stytch.com/docs/api-reference/consumer/api/passwords/reset-options/password-reset-by-email.md): Complete a password reset initiated by email. - [Password Reset By Existing Password](https://stytch.com/docs/api-reference/consumer/api/passwords/reset-options/password-reset-by-existing-password.md): Reset a user's password using their existing password. - [Password Reset By Session](https://stytch.com/docs/api-reference/consumer/api/passwords/reset-options/password-reset-by-session.md): Reset a user's password using their existing session. #### One-Time Passcodes (OTP) - [Authenticate One-Time Passcode (OTP)](https://stytch.com/docs/api-reference/consumer/api/otp/authenticate.md): Authenticate a User with an OTP code. ##### Via SMS - [Send](https://stytch.com/docs/api-reference/consumer/api/otp/via-sms/send.md): Send a One-Time Passcode (OTP) to a User via SMS. - [Login Or Create User](https://stytch.com/docs/api-reference/consumer/api/otp/via-sms/login-or-create-user.md): Send a One-Time Passcode (OTP) to a User via SMS. ##### Via WhatsApp - [Send](https://stytch.com/docs/api-reference/consumer/api/otp/via-whatsapp/send.md): Send a One-Time Passcode (OTP) to a User via WhatsApp. - [Login Or Create User](https://stytch.com/docs/api-reference/consumer/api/otp/via-whatsapp/login-or-create-user.md): Send a One-Time Passcode (OTP) to a User via WhatsApp. ##### Via Email - [Send](https://stytch.com/docs/api-reference/consumer/api/otp/via-email/send.md): Send a One-Time Passcode (OTP) to a User via email. - [Login Or Create User](https://stytch.com/docs/api-reference/consumer/api/otp/via-email/login-or-create-user.md): Send a one-time passcode (OTP) to a user via email. #### Session Management - [Session Object](https://stytch.com/docs/api-reference/consumer/api/sessions/session-object.md): The Session object represents an authenticated session for a specific User. - [Get JWKS](https://stytch.com/docs/api-reference/consumer/api/sessions/get-jwks.md): Get the JSON Web Key Set (JWKS) for a project. - [Get Sessions](https://stytch.com/docs/api-reference/consumer/api/sessions/get-sessions.md): List all active sessions for a given user. - [Authenticate Session](https://stytch.com/docs/api-reference/consumer/api/sessions/authenticate-session.md): Authenticate a session token or session JWT and retrieve associated session data. - [Authenticate JWT](https://stytch.com/docs/api-reference/consumer/api/sessions/authenticate-jwt.md): Authenticate a session using a JSON Web Token (JWT) - [Revoke Session](https://stytch.com/docs/api-reference/consumer/api/sessions/revoke-session.md): Revoke a Session. - [Migrate Session](https://stytch.com/docs/api-reference/consumer/api/sessions/migrate-session.md): Migrate a session from an external OIDC compliant endpoint. - [Attest Session](https://stytch.com/docs/api-reference/consumer/api/sessions/attest-session.md): Exchange an auth token issued by a trusted identity provider for a Stytch session. - [Exchange Access Token](https://stytch.com/docs/api-reference/consumer/api/sessions/exchange-access-token.md): Exchange a Connected Apps Access Token for a Stytch Session. #### Passkeys & WebAuthn - [Update](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/update.md): Updates a Passkey or WebAuthn registration. - [List WebAuthn Credentials](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/list-webauthn-credentials.md): List the credentials of the WebAuthn Registrations or Passkeys ##### Register - [Start WebAuthn Registration](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/register/start.md): Initiate the process of creating a new Passkey or WebAuthn registration. - [Register WebAuthn](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/register/register.md): Complete the creation of a WebAuthn registration by passing the response from the navigator. ##### Authenticate - [Start WebAuthn Authentication](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/authenticate/start.md): Initiate the authentication of a Passkey or WebAuthn registration. - [Authenticate WebAuthn](https://stytch.com/docs/api-reference/consumer/api/passkeys-webauthn/authenticate/authenticate.md): Complete the authentication of a Passkey or WebAuthn registration #### Time-Based One-Time Passcodes (TOTPs) - [Create TOTP](https://stytch.com/docs/api-reference/consumer/api/totp/create.md): Create a new TOTP instance for a user. - [Authenticate TOTP](https://stytch.com/docs/api-reference/consumer/api/totp/authenticate.md): Authenticate a TOTP code entered by a user. - [Get TOTP Recovery Codes](https://stytch.com/docs/api-reference/consumer/api/totp/get-recovery-codes.md): Retrieve the recovery codes for a TOTP instance tied to a User. - [Recover TOTP](https://stytch.com/docs/api-reference/consumer/api/totp/recover.md): Authenticate a recovery code for a TOTP instance. #### Crypto Wallets - [Start Crypto Wallet Authentication](https://stytch.com/docs/api-reference/consumer/api/crypto-wallets/authenticate-start.md): Initiate the authentication of a crypto wallet. - [Authenticate Crypto Wallet](https://stytch.com/docs/api-reference/consumer/api/crypto-wallets/authenticate.md): Complete the authentication of a crypto wallet by passing the signature. #### M2M Authentication - [M2M Client Object](https://stytch.com/docs/api-reference/consumer/api/m2m/m2m-client-object.md) ##### Token - [Get Access Token](https://stytch.com/docs/api-reference/consumer/api/m2m/token/get-access-token.md): Retrieve an access token for a given M2M Client using the Stytch API - [Authenticate M2M Access Token](https://stytch.com/docs/api-reference/consumer/api/m2m/token/authenticate-access-token.md): Authenticate a Machine-to-Machine (M2M) access token issued by Stytch ##### M2M Client - [Create M2M Client](https://stytch.com/docs/api-reference/consumer/api/m2m/client/create-m2m-client.md): Create a new M2M Client using the Stytch API - [Get M2M Client](https://stytch.com/docs/api-reference/consumer/api/m2m/client/get-m2m-client.md): Retrieve an existing M2M Client using the Stytch API - [Search M2M Clients](https://stytch.com/docs/api-reference/consumer/api/m2m/client/search-m2m-clients.md): Search for M2M Clients using the Stytch API - [Update M2M Client](https://stytch.com/docs/api-reference/consumer/api/m2m/client/update-m2m-client.md): Update an existing M2M Client using the Stytch API - [Delete M2M Client](https://stytch.com/docs/api-reference/consumer/api/m2m/client/delete-m2m-client.md): Delete an M2M Client using the Stytch API ##### Rotate Secret - [Start Secret Rotation](https://stytch.com/docs/api-reference/consumer/api/m2m/rotate-secret/start-secret-rotation.md): Initiate the rotation of an M2M client secret using the Stytch API - [Rotate Secret](https://stytch.com/docs/api-reference/consumer/api/m2m/rotate-secret/rotate-secret.md): Complete the rotation of an M2M client secret. - [Cancel Secret Rotation](https://stytch.com/docs/api-reference/consumer/api/m2m/rotate-secret/cancel-secret-rotation.md): Cancel the rotation of an M2M client secret. #### Connected Apps - [Exchange Authorization Code](https://stytch.com/docs/api-reference/consumer/api/connected-apps/exchange-authorization-code.md): Exchange an authorization code for an access token for a Connected App client. - [Exchange Refresh Token](https://stytch.com/docs/api-reference/consumer/api/connected-apps/exchange-refresh-token.md): Exchange a refresh token for an access token for a Connected App client. ##### Tokens - [Connected App ID Token Object](https://stytch.com/docs/api-reference/consumer/api/connected-apps/tokens/connected-app-id-token-object.md) - [Connected App Access Token Object](https://stytch.com/docs/api-reference/consumer/api/connected-apps/tokens/connected-app-access-token-object.md) ##### Configuration - [Get JWKS](https://stytch.com/docs/api-reference/consumer/api/connected-apps/configuration/get-jwks.md): Get the JSON Web Key Set (JWKS) for your Stytch project. - [Get OpenID Configuration](https://stytch.com/docs/api-reference/consumer/api/connected-apps/configuration/get-openid-configuration.md): Get the OpenID configuration for a project. ##### Methods - [Introspect Token](https://stytch.com/docs/api-reference/consumer/api/connected-apps/methods/introspect-token.md): Examine and introspect a token for a Connected Apps client. - [Authenticate Access Token (Local)](https://stytch.com/docs/api-reference/consumer/api/connected-apps/methods/authenticate-access-token-local.md): Authenticate a Connected App access token. - [Revoke Token](https://stytch.com/docs/api-reference/consumer/api/connected-apps/methods/revoke-token.md): Revoke a token for a Connected Apps client. - [Get UserInfo](https://stytch.com/docs/api-reference/consumer/api/connected-apps/methods/get-userinfo.md): Get claims about the authenticated end-user, using an Access Token. ##### Consent Management - [Start OAuth Authorization](https://stytch.com/docs/api-reference/consumer/api/connected-apps/consent-management/start-oauth-authorization.md): Initiates a request for authorization of a Connected App - [Submit OAuth Authorization](https://stytch.com/docs/api-reference/consumer/api/connected-apps/consent-management/submit-oauth-authorization.md): Completes a request for authorization of a Connected App. - [Get Authorized Connected Apps For A User](https://stytch.com/docs/api-reference/consumer/api/connected-apps/consent-management/get-connected-apps-user.md): Retrieves a list of Connected Apps for a User. - [Revoke Connected App Access for a User](https://stytch.com/docs/api-reference/consumer/api/connected-apps/consent-management/revoke-connected-app-access.md): Revoke a Connected App's access to a User ##### Application Management - [Dynamic Client Registration](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/dynamic-client-registration.md): Register a new OAuth 2.0 client dynamically. - [Create Connected App](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/create-connected-app.md): Create a new Connected App. - [Get Connected App](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/get-connected-app.md): Retrieve details of a specific Connected App by `client_id`. - [Search Connected Apps](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/search-connected-apps.md): Search for Connected Apps. - [Update Connected App](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/update-connected-app.md): Updates mutable fields of a Connected App. - [Delete Connected App](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/delete-connected-app.md): Delete a Connected App. ##### Rotate Secret - [Start Secret Rotation](https://stytch.com/docs/api-reference/consumer/api/connected-apps/rotate-secret/start-secret-rotation.md): Initiate the rotation of a Connected App client secret. - [Rotate Secret](https://stytch.com/docs/api-reference/consumer/api/connected-apps/rotate-secret/rotate-secret.md): Complete the rotation of a Connected App client secret. - [Cancel Secret Rotation](https://stytch.com/docs/api-reference/consumer/api/connected-apps/rotate-secret/cancel-secret-rotation.md): Cancel the rotation of a Connected App client secret. #### RBAC - [Resource Object](https://stytch.com/docs/api-reference/consumer/api/rbac/resource-object.md) - [Role Object](https://stytch.com/docs/api-reference/consumer/api/rbac/role-object.md) - [Scope Object](https://stytch.com/docs/api-reference/consumer/api/rbac/scope-object.md) - [Get RBAC Policy](https://stytch.com/docs/api-reference/consumer/api/rbac/get-rbac-policy.md): Get the active RBAC Policy for your current Stytch Project. #### User Impersonation - [Authenticate Impersonation Token](https://stytch.com/docs/api-reference/consumer/api/impersonation/authenticate-token.md): Authenticate an impersonation token to impersonate a User using the Stytch API ### Resources - [Stytch Postman collection](https://stytch.com/docs/api-reference/consumer/api/resources/postman.md) - [E2E Testing](https://stytch.com/docs/api-reference/consumer/api/resources/e2e-testing.md): End-to-end testing applications built with Stytch - [Sandbox Values](https://stytch.com/docs/api-reference/consumer/api/resources/sandbox-values.md): Sandbox values for testing in a Test environment - [Email Templates](https://stytch.com/docs/api-reference/consumer/api/resources/email-templates.md) - [URL Validation](https://stytch.com/docs/api-reference/consumer/api/resources/url-validation.md) - [Metadata](https://stytch.com/docs/api-reference/consumer/api/resources/metadata.md) - [User States](https://stytch.com/docs/api-reference/consumer/api/resources/user-states.md) #### Errors - [Errors Overview](https://stytch.com/docs/api-reference/consumer/api/errors/overview.md) - [Error object](https://stytch.com/docs/api-reference/consumer/api/errors/error-object.md) - [400](https://stytch.com/docs/api-reference/consumer/api/errors/400.md): Reference for Stytch API Bad Request errors - [401](https://stytch.com/docs/api-reference/consumer/api/errors/401.md): Reference for Stytch API Unauthorized errors - [403](https://stytch.com/docs/api-reference/consumer/api/errors/403.md): Reference for Stytch API Forbidden errors - [404](https://stytch.com/docs/api-reference/consumer/api/errors/404.md): Reference for Stytch API Not Found errors - [405](https://stytch.com/docs/api-reference/consumer/api/errors/405.md): Reference for Stytch API Method Not Allowed errors - [429](https://stytch.com/docs/api-reference/consumer/api/errors/429.md): Reference for Stytch API Too Many Requests errors - [499](https://stytch.com/docs/api-reference/consumer/api/errors/499.md): Reference for Stytch API Client Closed Request errors - [500](https://stytch.com/docs/api-reference/consumer/api/errors/500.md): Reference for Stytch API Internal Server Error errors - [503](https://stytch.com/docs/api-reference/consumer/api/errors/503.md): Reference for Stytch API Service Unavailable errors