# Stytch Docs: Documentation ## Documentation ### Get started - [Stytch documentation](https://stytch.com/docs/get-started/overview.md) - [Quickstart](https://stytch.com/docs/get-started/quickstart.md): Get up and running with Stytch in minutes. - [Modeling your app](https://stytch.com/docs/get-started/data-models.md): Multi-tenancy vs. consumer (single-tenancy) data models. - [Example apps](https://stytch.com/docs/get-started/example-apps.md): Working sample apps demonstrating how to implement Stytch Auth. #### Stytch platform - [Authentication and authorization](https://stytch.com/docs/get-started/guides/authentication.md): Build complete authentication and authorization flows with Stytch's developer-friendly APIs and SDKs. - [Enterprise ready](https://stytch.com/docs/get-started/guides/enterprise-ready.md): Ship enterprise features your customers expect—SSO, SCIM, RBAC, and org management—without months of development. - [Fraud & risk prevention](https://stytch.com/docs/get-started/guides/fraud-and-risk.md): Stop bots, prevent fraud, and protect your app with Device Fingerprinting and Intelligent Rate Limiting. - [AI agents & Connected Apps](https://stytch.com/docs/get-started/guides/ai-agents-and-apps.md): Make your app agent-ready with OAuth 2.0, MCP server integration, and enterprise-grade security for AI interactions. - [Migration & deployment](https://stytch.com/docs/get-started/guides/migration-and-deployment.md): Zero-downtime migration paths, hands-on developer support, and tools to help you seamlessly switch to Stytch. #### For developers - [LLM instructions](https://stytch.com/docs/get-started/for-developers/llm-instructions.md): Instructions for using LLMs and AI coding tools with Stytch documentation. - [API reference](https://stytch.com/docs/get-started/for-developers/api-reference-link.md) ### Multi-tenant auth - [Multi-tenant authentication](https://stytch.com/docs/multi-tenant-auth/overview.md): Use Stytch B2B API & SDKs to build multi-tenant auth for your app. - [Multi-tenant data model](https://stytch.com/docs/multi-tenant-auth/data-model.md): Multi-tenant auth is built around two core entities: Organizations and Members. - [API reference](https://stytch.com/docs/multi-tenant-auth/api-reference-link.md) #### Build login and signup - [Stytch UI](https://stytch.com/docs/multi-tenant-auth/build-auth/overview.md): How to build a log in and sign up flow for your app using the Stytch UI components included in the frontend SDK. - [Add login or signup](https://stytch.com/docs/multi-tenant-auth/build-auth/discovery.md): Build a centralized login or signup page across orgs with Discovery login, where users authenticate first before selecting which organization to log into. - [Add an org-specific login](https://stytch.com/docs/multi-tenant-auth/build-auth/org-specific.md): Build a specialized login page for a single tenant. ##### Customization - [Customize Stytch UI](https://stytch.com/docs/multi-tenant-auth/build-auth/branding/custom-themes.md): How to customize Stytch UI to fit the look and feel of your app ##### Build a custom auth flow - [Integration options](https://stytch.com/docs/multi-tenant-auth/build-auth/custom/overview.md): Using Stytch's SDKs or API to build your own custom auth flow. - [Via headless SDK](https://stytch.com/docs/multi-tenant-auth/build-auth/custom/via-sdk.md): Examples and considerations when using the headless SDKs to build your own custom auth. - [Via backend SDK or API](https://stytch.com/docs/multi-tenant-auth/build-auth/custom/via-api.md): Examples and considerations when doing a server-side integration with Stytch. #### Manage sessions ##### Stytch session layer - [Using Stytch's session layer](https://stytch.com/docs/multi-tenant-auth/manage-sessions/overview.md): Sessions provide a way to uniquely identify users on your application and maintain useful state information, such as detecting whether a user is logged in or not, determining access privileges, personalizing experiences, and building user insights. - [JWTs vs. session tokens](https://stytch.com/docs/multi-tenant-auth/manage-sessions/jwts-and-tokens.md): Both the `session_jwt` and `session_token` represent the underlying Stytch Session. Your application can use either one or both to balance performance and security. - [Check for an active session](https://stytch.com/docs/multi-tenant-auth/manage-sessions/check-active-session.md): Use the SDK to control your application's UI or navigation based on whether a member has an active session. - [Authenticate a session](https://stytch.com/docs/multi-tenant-auth/manage-sessions/validate-session.md): How to validate session tokens and JWTs. - [Hydrating sessions](https://stytch.com/docs/multi-tenant-auth/manage-sessions/hydrate-session.md): Hydrate the frontend session state from the backend. - [Cookies & sessions](https://stytch.com/docs/multi-tenant-auth/manage-sessions/cookies.md): Options for cookie configuration options and HttpOnly cookies. - [Add custom claims](https://stytch.com/docs/multi-tenant-auth/manage-sessions/custom-claims.md): Encode additional information into your session JWTs using custom claims. ##### Session lifecycle - [Start of a session](https://stytch.com/docs/multi-tenant-auth/manage-sessions/lifecycle/start-session.md): The session lifecycle through authentication to a full session. - [Exchange organization sessions](https://stytch.com/docs/multi-tenant-auth/manage-sessions/lifecycle/exchange-session.md): Seamlessly switch a member's session between organizations. - [Expire or extend sessions](https://stytch.com/docs/multi-tenant-auth/manage-sessions/lifecycle/extend-or-expire-session.md): Session duration and extending the lifetime of a session. - [Revoke sessions](https://stytch.com/docs/multi-tenant-auth/manage-sessions/lifecycle/revoke-session.md): Revoking a session immediately invalidates the session token, effectively logging the user out. Session JWTs are not immediately revoked; they will still validate locally until they hit the 5-minute expiration mark. ##### Intermediate sessions - [Intermediate sessions in authentication](https://stytch.com/docs/multi-tenant-auth/manage-sessions/intermediate-sessions/overview.md): Intermediate sessions are used during authentication flows that require intermediate steps before a member can be fully authenticated. - [Organization discovery](https://stytch.com/docs/multi-tenant-auth/manage-sessions/intermediate-sessions/discovery.md): Build a Discovery authentication flow for organizations. - [Multi-factor authentication (MFA)](https://stytch.com/docs/multi-tenant-auth/manage-sessions/intermediate-sessions/mfa.md): Sessions during multi-factor authentication flows. - [Step-up authentication](https://stytch.com/docs/multi-tenant-auth/manage-sessions/intermediate-sessions/step-up.md): Sessions during step-up authentication flows. #### Enterprise ready - [Admin Portal](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/admin-portal.md): Use Admin Portal to build Org Management UI in your application ##### RBAC - [Create your RBAC Policy](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy.md): Use Role-Based Access Control (RBAC) to manage access to specific resources - [Assigning Roles to Members](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/rbac/assigning-roles-to-members.md): Assign roles to your Members to grant them access to resources in your application - [SAML Role Assignments](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/rbac/saml.md): Assign roles to your Members via SAML connections - [Enforcing Permissions](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/rbac/enforcing-permissions.md): Enforce RBAC permissions in your application's frontend and backend ##### Member management - [Member management overview](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/org-management/overview.md): Understanding Stytch Organizations and Members - [Configure auth methods](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/org-management/configure-auth-methods.md): Multi-tenant auth allows granular configuration of which authentication methods can be used by Members. - [Invite members](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/org-management/invite-members.md): Invite Members to an Organization via email invitation. - [JIT provision members](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/org-management/jit-provision-members.md): Add Members to an Organization via just-in-time (JIT) provisioning. - [Org configuration rules](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/org-management/org-configuration-rules.md): To ensure that your Organization's authentication settings are valid, the following rules apply. ##### SCIM - [SCIM Overview](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/scim/overview.md): Allow enterprise customers to use SCIM to manage identity and access from a workforce IdP - [SCIM with Okta](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/scim/okta.md): Set up a SCIM connection with Okta - [Microsoft Entra](https://stytch.com/docs/multi-tenant-auth/enterprise-ready/scim/microsoft-entra.md): Set up a SCIM connection with Microsoft Entra #### Authentication - [User impersonation](https://stytch.com/docs/multi-tenant-auth/authentication/user-impersonation.md): Learn about Stytch's built-in user impersonation functionality. - [Fraud & risk protections](https://stytch.com/docs/multi-tenant-auth/authentication/fraud-and-risk.md): Ways to protect your application using Device Fingerprinting and Protected Auth. ##### SSO - [Overview](https://stytch.com/docs/multi-tenant-auth/authentication/sso/overview.md): Use SSO to authenticate users with their enterprise identity provider credentials. - [SSO Provider Setup](https://stytch.com/docs/multi-tenant-auth/authentication/sso/provider-setup.md): Instructions for setting up SSO connections with various Identity Providers (IdPs) in Stytch. - [Adding to Stytch Login](https://stytch.com/docs/multi-tenant-auth/authentication/sso/adding-sso-to-stytch-login.md): Integrate SSO with Stytch's pre-built UI components. - [Adding SSO to a custom auth flow](https://stytch.com/docs/multi-tenant-auth/authentication/sso/adding-to-custom-auth-flow.md): Integrate SSO with Stytch's headless or backend SDKs for complete control over your authentication flow. - [Standalone SSO](https://stytch.com/docs/multi-tenant-auth/authentication/sso/standalone.md): Implement SSO with Stytch without migrating your existing authentication stack. - [Multi-Organization SSO](https://stytch.com/docs/multi-tenant-auth/authentication/sso/multi-organization.md): Implement External SSO connections to support multi-Organization access. ##### OAuth - [Overview](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/overview.md): Use OAuth to allow Members to login to your application through their authenticated identity on common OAuth providers. - [Configuring OAuth for your project](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/configuring-oauth-for-your-project.md): Get started by configuring your OAuth settings in the Stytch Dashboard. - [Adding OAuth to Stytch Login](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-oauth-to-stytch-login.md): Integrate OAuth with Stytch's pre-built UI components. - [Adding OAuth to a custom auth flow](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-to-custom-auth-flow.md): Integrate OAuth with Stytch's headless or backend SDKs for complete control over your authentication flow. - [Adding PKCE to your OAuth flow](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-pkce.md): Secure your OAuth login flow with PKCE ###### Adding Providers - [Google OAuth](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/google-oauth.md): Configure Google OAuth for Multi-Tenant Authentication. - [Google One Tap](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/google-one-tap.md): Configure Google One Tap as an OAuth provider for Multi-Tenant Authentication. - [Microsoft](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/microsoft.md): Configure Microsoft OAuth for Multi-Tenant Authentication. - [HubSpot](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/hubspot.md): Configure HubSpot OAuth for Multi-Tenant Authentication. - [Slack](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/slack.md): Configure Slack OAuth for Multi-Tenant Authentication. - [GitHub](https://stytch.com/docs/multi-tenant-auth/authentication/oauth/adding-providers/github.md): Configure GitHub OAuth for Multi-Tenant Authentication. ##### MFA - [Overview](https://stytch.com/docs/multi-tenant-auth/authentication/mfa/overview.md): Implement Stytch's MFA using SMS OTP or TOTP as secondary factors. - [Adding MFA to Stytch Login](https://stytch.com/docs/multi-tenant-auth/authentication/mfa/adding-mfa-to-stytch-login.md): Integrate MFA with Stytch's pre-built UI components. - [Adding MFA to a custom auth flow](https://stytch.com/docs/multi-tenant-auth/authentication/mfa/adding-mfa-to-custom-auth-flow.md): Integrate MFA with Stytch's headless or backend SDKs for complete control over your authentication flow. ##### Magic links - [Email magic links](https://stytch.com/docs/multi-tenant-auth/authentication/magic-links/overview.md): Learn about email magic links in Multi-tenant authentication. - [Adding magic links to Stytch Login](https://stytch.com/docs/multi-tenant-auth/authentication/magic-links/adding-magic-links-to-stytch-login.md): Integrate magic links with Stytch's pre-built UI components. - [Adding magic links to a custom auth flow](https://stytch.com/docs/multi-tenant-auth/authentication/magic-links/adding-magic-links-to-custom-auth-flow.md): Integrate with Stytch's headless or backend SDKs for complete control over your authentication flow. ##### Passwords - [Overview](https://stytch.com/docs/multi-tenant-auth/authentication/passwords/overview.md): Stytch's Password product allows you to offer a familiar authentication option to your end users, with built-in protection against common password pitfalls like credential stuffing attacks and insecure account deduplication. - [Password setting flows](https://stytch.com/docs/multi-tenant-auth/authentication/passwords/password-setting-flows.md): Create a Member's password via password reset flows. - [Password strength policy](https://stytch.com/docs/multi-tenant-auth/authentication/passwords/strength-policy.md): Configure password strength rules with zxcvbn, LUDS, and breach detection. - [Cross-Organization Passwords](https://stytch.com/docs/multi-tenant-auth/authentication/passwords/cross-org.md): Share Passwords across Organizations. ##### Trusted auth tokens - [Trusted auth tokens overview](https://stytch.com/docs/multi-tenant-auth/authentication/trusted-auth-tokens/overview.md): Exchange signed JWTs for Stytch sessions to support external identity providers and custom auth factors. - [External identity providers](https://stytch.com/docs/multi-tenant-auth/authentication/trusted-auth-tokens/external-idps.md): Exchange third-party JWTs for Stytch sessions using Trusted Auth Tokens. - [Custom auth factors](https://stytch.com/docs/multi-tenant-auth/authentication/trusted-auth-tokens/custom-factors.md): Use your own JWTs to attest custom authentication factors with Trusted Auth Tokens. ##### M2M authentication - [Authenticate an M2M client](https://stytch.com/docs/multi-tenant-auth/authentication/m2m/authenticate-client.md): How to implement M2M authentication. - [Rotate client secrets](https://stytch.com/docs/multi-tenant-auth/authentication/m2m/rotate-secrets.md): Managing M2M client secret rotation. - [Import M2M clients from Auth0](https://stytch.com/docs/multi-tenant-auth/authentication/m2m/import-clients.md): Migrating M2M clients from other platforms like Auth0 to Stytch. - [Adding custom claims to M2M tokens](https://stytch.com/docs/multi-tenant-auth/authentication/m2m/custom-claims.md): Add custom claims to M2M access tokens. ### Consumer auth - [Consumer authentication](https://stytch.com/docs/consumer-auth/overview.md): Use Stytch Consumer API & SDKs to build auth tailored for consumer-based apps. - [Consumer data model](https://stytch.com/docs/consumer-auth/data-model.md): Users own and control their identity and how they authenticate. - [API reference](https://stytch.com/docs/consumer-auth/api-reference-link.md) #### Build login and signup - [Stytch UI](https://stytch.com/docs/consumer-auth/build-auth/overview.md): How to build a log in and sign up flow for your app using the Stytch UI components included in the frontend SDK. - [Add login or signup](https://stytch.com/docs/consumer-auth/build-auth/login-or-signup.md): Build a login or signup page. - [Customize Stytch UI](https://stytch.com/docs/consumer-auth/build-auth/theming.md): How to customize Stytch UI to fit the look and feel of your app ##### Build a custom auth flow - [Integration options](https://stytch.com/docs/consumer-auth/build-auth/custom/integration-options.md): Use Stytch's SDKs or API to build your own custom auth flow. - [Via headless SDK](https://stytch.com/docs/consumer-auth/build-auth/custom/via-sdk.md): Our frontend SDKs can be utilized headlessly for developing and managing your auth client-side. - [Via backend SDK or API](https://stytch.com/docs/consumer-auth/build-auth/custom/via-api.md): Examples and considerations when doing a server-side integration with Stytch. #### Manage sessions ##### Stytch session layer - [Using Stytch's session layer](https://stytch.com/docs/consumer-auth/manage-sessions/overview.md): Sessions provide a way to uniquely identify users on your application and maintain useful state information, such as detecting whether a user is logged in or not, determining access privileges, personalizing experiences, and building user insights. - [JWTs vs. session tokens](https://stytch.com/docs/consumer-auth/manage-sessions/jwts-and-tokens.md): Both the `session_jwt` and `session_token` represent the underlying Stytch Session. Your application can use either one or both to balance performance and security. - [Check for an active session](https://stytch.com/docs/consumer-auth/manage-sessions/check-active-session.md): Use the SDK to control your application's UI or navigation based on whether a user has an active session. - [Authenticate a session](https://stytch.com/docs/consumer-auth/manage-sessions/validate-session.md): How to validate session tokens and JWTs on your backend. - [Hydrating sessions](https://stytch.com/docs/consumer-auth/manage-sessions/hydrate-session.md): Hydrate the frontend session state from the backend. - [Cookies & sessions](https://stytch.com/docs/consumer-auth/manage-sessions/cookies.md): Options for cookie configuration options and HttpOnly cookies. - [Add custom claims](https://stytch.com/docs/consumer-auth/manage-sessions/custom-claims.md): Encode additional information into your session JWTs using custom claims. ##### Session lifecycle - [Start of a session](https://stytch.com/docs/consumer-auth/manage-sessions/lifecycle/start-session.md): A session starts after successful authentication. - [Expire or extend sessions](https://stytch.com/docs/consumer-auth/manage-sessions/lifecycle/extend-or-expire-session.md): Session duration and extending the lifetime of a session. - [Revoke sessions](https://stytch.com/docs/consumer-auth/manage-sessions/lifecycle/revoke-session.md): Revoking a session immediately invalidates the session token, effectively logging the user out. Session JWTs are not immediately revoked; they will still validate locally until they hit the 5-minute expiration mark. #### Authentication - [Mobile Biometrics](https://stytch.com/docs/consumer-auth/authentication/mobile-biometrics.md) - [User impersonation](https://stytch.com/docs/consumer-auth/authentication/user-impersonation.md): Learn about Stytch's built-in user impersonation functionality. - [Fraud & risk protections](https://stytch.com/docs/consumer-auth/authentication/fraud-and-risk.md): Ways to protect your application using Device Fingerprinting and Protected Auth. ##### OAuth - [OAuth overview](https://stytch.com/docs/consumer-auth/authentication/oauth/overview.md): Identity providers (IdPs), like Google, Apple, and GitHub, maintain user identity information and offer authentication services to developers and applications, so called relying parties. - [Adding OAuth to Stytch Login](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-oauth-to-stytch-login.md): Integrate OAuth providers with Stytch's pre-built login UI for Consumer Authentication. - [Integrate Google OAuth via the API](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-to-custom-auth-flow.md): Use the Consumer API to add Google OAuth to a custom login flow. - [Add Google One Tap](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-google-one-tap.md): Enable Google One Tap in your application to let users authenticate with a single prompt. - [Adding PKCE to an OAuth flow](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-pkce.md): Enable PKCE in OAuth flows for stronger protection on web and native redirects. - [Email address behavior](https://stytch.com/docs/consumer-auth/authentication/oauth/email-behavior.md): Learn about how Stytch handles email addresses returned by OAuth providers during authentication. ###### Adding Providers - [Google](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/google-oauth.md): Set up Google OAuth for Consumer Authentication. - [Google One Tap](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/google-one-tap.md): Set up Google One Tap OAuth for Consumer Authentication. - [Amazon](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/amazon.md): Set up Amazon OAuth for Consumer Authentication. - [Apple](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/apple.md): Set up Apple OAuth for Consumer Authentication. - [Bitbucket](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/bitbucket.md): Set up Bitbucket OAuth for Consumer Authentication. - [Coinbase](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/coinbase.md): Set up Coinbase OAuth for Consumer Authentication. - [Discord](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/discord.md): Set up Discord OAuth for Consumer Authentication. - [Facebook](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/facebook.md): Set up Facebook OAuth for Consumer Authentication. - [Figma](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/figma.md): Set up Figma OAuth for Consumer Authentication. - [GitHub](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/github.md): Set up GitHub OAuth for Consumer Authentication. - [GitLab](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/gitlab.md): Set up GitLab OAuth for Consumer Authentication. - [LinkedIn](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/linkedin.md): Set up LinkedIn OAuth for Consumer Authentication. - [Microsoft](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/microsoft.md): Set up Microsoft OAuth for Consumer Authentication. - [Salesforce](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/salesforce.md): Set up Salesforce OAuth for Consumer Authentication. - [Slack](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/slack.md): Set up Slack OAuth for Consumer Authentication. - [Snapchat](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/snapchat.md): Set up Snapchat OAuth for Consumer Authentication. - [Spotify](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/spotify.md): Set up Spotify OAuth for Consumer Authentication. - [TikTok](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/tiktok.md): Set up TikTok OAuth for Consumer Authentication. - [Twitch](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/twitch.md): Set up Twitch OAuth for Consumer Authentication. - [Twitter](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/twitter.md): Set up Twitter OAuth for Consumer Authentication. - [Yahoo](https://stytch.com/docs/consumer-auth/authentication/oauth/adding-providers/yahoo.md): Set up Yahoo OAuth for Consumer Authentication. ##### MFA - [Overview](https://stytch.com/docs/consumer-auth/authentication/mfa/overview.md): Enable multi-factor authentication (MFA) in your application to add an extra layer of security for your users. - [MFA frontend integration](https://stytch.com/docs/consumer-auth/authentication/mfa/adding-mfa-to-stytch-login.md): Integrate MFA with Stytch's pre-built UI components or headless JavaScript SDK. - [MFA backend integration](https://stytch.com/docs/consumer-auth/authentication/mfa/adding-mfa-to-custom-auth-flow.md): Integrate MFA with Stytch's backend SDKs for complete control over your authentication flow. ##### Magic links - [Email magic links](https://stytch.com/docs/consumer-auth/authentication/magic-links/overview.md): Learn about email magic links in Consumer authentication. - [Adding magic links to Stytch Login](https://stytch.com/docs/consumer-auth/authentication/magic-links/adding-magic-links-to-stytch-login.md): Integrate magic links with Stytch's pre-built UI components. - [Adding magic links to a custom auth flow](https://stytch.com/docs/consumer-auth/authentication/magic-links/adding-magic-links-to-custom-auth-flow.md): Integrate with Stytch’s headless or backend SDKs for complete control over your authentication flow. - [Adding PKCE to a magic link flow](https://stytch.com/docs/consumer-auth/authentication/magic-links/adding-pkce.md): Add PKCE to magic link redirects to protect against bot traffic and replay. - [Embeddable magic links](https://stytch.com/docs/consumer-auth/authentication/magic-links/embeddable-magic-links.md): Embed magic links into your own communication channels. ##### One-time passcodes (OTPs) - [One-time passcodes (OTP) overview](https://stytch.com/docs/consumer-auth/authentication/otps/overview.md): Use SMS or WhatsApp one-time passcodes to verify users during login and signup. - [Add OTPs to Stytch Login](https://stytch.com/docs/consumer-auth/authentication/otps/sdk.md): Add One-Time Passcodes (OTP) to the Stytch Login UI with the Consumer frontend SDK. - [Integrate OTPs via the API](https://stytch.com/docs/consumer-auth/authentication/otps/api.md): Build SMS one-time passcode signup and login flows with the Consumer API. ##### Time-based one-time passcodes (TOTPs) - [Time-based one-time passcodes (TOTPs) overview](https://stytch.com/docs/consumer-auth/authentication/totps/overview.md): Understand how TOTP works and when to use it as a second factor. - [Integrate TOTPs via the API](https://stytch.com/docs/consumer-auth/authentication/totps/api.md): Implement TOTP enrollment and verification with the Consumer API. ##### Passwords - [Add Passwords to Stytch Login](https://stytch.com/docs/consumer-auth/authentication/passwords/sdk.md): Add Password signup, login, and reset flows with the Consumer frontend SDKs. - [Integrate Passwords via the API](https://stytch.com/docs/consumer-auth/authentication/passwords/api.md): Implement Password signup, login, and reset flows with the Consumer API. - [Password strength policy](https://stytch.com/docs/consumer-auth/authentication/passwords/strength-policy.md): Configure password strength rules with zxcvbn, LUDS, and breach detection. ###### Email verification - [Email verification overview](https://stytch.com/docs/consumer-auth/authentication/passwords/email-verification/overview.md): Why email verification matters and how to verify addresses with Stytch Passwords. - [Email verification before password creation](https://stytch.com/docs/consumer-auth/authentication/passwords/email-verification/before-password-creation.md): Verify email addresses before users create a password. - [Email verification after password creation](https://stytch.com/docs/consumer-auth/authentication/passwords/email-verification/after-password-creation.md): Verify email addresses after users create a password. ##### Passkeys & WebAuthn ###### Passkeys - [Passkeys overview](https://stytch.com/docs/consumer-auth/authentication/passkeys/overview.md): Passkeys are a biometrics-based, phishing-resistant, replacement for passwords. - [Add Passkeys to Stytch Login](https://stytch.com/docs/consumer-auth/authentication/passkeys/login-sdk.md): Set up Passkeys in Stytch Login using the Consumer frontend SDKs. ###### WebAuthn - [Integrate WebAuthn via the API](https://stytch.com/docs/consumer-auth/authentication/webauthn/api.md): Register and authenticate WebAuthn credentials with the Consumer API. ##### Crypto wallets - [Integrate crypto wallets via the API](https://stytch.com/docs/consumer-auth/authentication/crypto-wallets/api.md): Implement Ethereum crypto wallet authentication with the Consumer API. ##### Trusted auth tokens - [Trusted auth tokens overview](https://stytch.com/docs/consumer-auth/authentication/trusted-auth-tokens/overview.md): Exchange signed JWTs for Stytch sessions to support external identity providers and custom auth factors. - [External identity providers](https://stytch.com/docs/consumer-auth/authentication/trusted-auth-tokens/external-idps.md): Exchange third-party JWTs for Stytch sessions using Trusted Auth Tokens. - [Custom auth factors](https://stytch.com/docs/consumer-auth/authentication/trusted-auth-tokens/custom-factors.md): Use your own JWTs to attest custom authentication factors with Trusted Auth Tokens. ##### M2M authentication - [Authenticate an M2M client](https://stytch.com/docs/consumer-auth/authentication/m2m/authenticate-client.md): How to implement M2M authentication. - [Rotate client secrets](https://stytch.com/docs/consumer-auth/authentication/m2m/rotate-secrets.md): Managing M2M client secret rotation. - [Import M2M clients from Auth0](https://stytch.com/docs/consumer-auth/authentication/m2m/import-clients.md): Migrating M2M clients from other platforms like Auth0 to Stytch. - [Adding custom claims to M2M tokens](https://stytch.com/docs/consumer-auth/authentication/m2m/custom-claims.md): Add custom claims to M2M access tokens. #### Authorization ##### RBAC - [Role-based access control overview](https://stytch.com/docs/consumer-auth/authorization/create-rbac-policy.md): Understand RBAC concepts and set up your policy in the Stytch Dashboard. - [Assign roles to users](https://stytch.com/docs/consumer-auth/authorization/assigning-roles-to-users.md): Assign roles to Users to grant permissions in your application. - [Enforcing permissions](https://stytch.com/docs/consumer-auth/authorization/enforcing-permissions.md): Enforce RBAC permissions in your application's frontend and backend. - [Implement RBAC with metadata (legacy)](https://stytch.com/docs/consumer-auth/authorization/legacy-rbac-metadata.md): Use trusted metadata to store roles when you can’t adopt native RBAC yet. #### 3rd party integrations - [Planetscale for user authentication](https://stytch.com/docs/consumer-auth/integrations/planetscale.md): Integrate Stytch Consumer Authentication with PlanetScale for user storage. - [Supabase](https://stytch.com/docs/consumer-auth/integrations/supabase.md): Check out the Stytch integration guide in the Supabase documentation. - [Feathery](https://stytch.com/docs/consumer-auth/integrations/feathery.md): Use Stytch and Feathery to build powerful forms with a visual editor, custom logic, and extensible code. - [Unit](https://stytch.com/docs/consumer-auth/integrations/unit.md): Use Stytch JWTs to satisfy Unit customer token requirements. ### Fraud & risk - [Fraud & Risk](https://stytch.com/docs/fraud-risk/overview.md): Use Stytch Device Fingerprinting to protect your application and its users. - [API reference](https://stytch.com/docs/fraud-risk/api-reference-link.md) #### Get started - [Get started with the API](https://stytch.com/docs/fraud-risk/get-started/using-dfp-api.md): Start collecting and analyzing fingerprints using the Device Fingerprinting API. - [Get started with Protected Auth](https://stytch.com/docs/fraud-risk/get-started/using-protected-auth.md): Use Protected Auth to defend your signup and login flows. - [Go-live checklist](https://stytch.com/docs/fraud-risk/get-started/go-live-checklist.md): This guide provides a checklist of recommended steps to take before enforcing decisions on your production traffic. ##### Use cases and recipes - [Invisible CAPTCHA](https://stytch.com/docs/fraud-risk/get-started/use-case/invisible-captcha.md): A recipe to add bot protection with a seamless user experience for your application - [Remembered device](https://stytch.com/docs/fraud-risk/get-started/use-case/remembered-device.md): A recipe to implement a remembered device flow with Stytch Device Fingerprinting - [New device notifications](https://stytch.com/docs/fraud-risk/get-started/use-case/new-device-notifications.md): Alerting users about logins from new devices - [Block traffic by country](https://stytch.com/docs/fraud-risk/get-started/use-case/block-countries.md): Using IP-based geographic filters for access control - [Prevent free trial abuse](https://stytch.com/docs/fraud-risk/get-started/use-case/prevent-free-trial-abuse.md): Protect your resources for real users by stopping fake accounts and related abuse - [Credential stuffing attack](https://stytch.com/docs/fraud-risk/get-started/use-case/credential-stuffing-attack.md): Protect your application and its users from credential stuffing attacks #### Device Fingerprinting - [Stytch Device Fingerprinting](https://stytch.com/docs/fraud-risk/device-fingerprinting/overview.md): Prevent fraud with device intelligence. Block bots and bad actors and improve UX for your real users. - [Protected Auth](https://stytch.com/docs/fraud-risk/device-fingerprinting/protected-auth.md): Stytch's combined solution for authentication and fraud prevention. - [Fingerprints & IDs](https://stytch.com/docs/fraud-risk/device-fingerprinting/fingerprints.md): Stytch Device Fingerprinting provides multiple device identifiers for different use cases. - [Add external metadata](https://stytch.com/docs/fraud-risk/device-fingerprinting/external-metadata.md): Provide context by attaching additional metadata to your fingerprints and verdicts. - [Privacy & compliance](https://stytch.com/docs/fraud-risk/device-fingerprinting/privacy-and-compliance.md): Considerations for privacy and compliance of your application when using Device Fingerprinting. ##### Verdicts - [Verdict actions & warning flags](https://stytch.com/docs/fraud-risk/device-fingerprinting/verdict/overview.md): Device Fingerprinting provides verdicts with a recommended action and warning flags. - [Allow verdict](https://stytch.com/docs/fraud-risk/device-fingerprinting/verdict/allow.md): Handling `ALLOW` verdicts for low-risk devices. - [Block verdict](https://stytch.com/docs/fraud-risk/device-fingerprinting/verdict/block.md): Handling `BLOCK` verdicts for high-risk devices. - [Challenge verdict](https://stytch.com/docs/fraud-risk/device-fingerprinting/verdict/challenge.md): Handling `CHALLENGE` verdicts for medium-risk devices. - [Not found errors](https://stytch.com/docs/fraud-risk/device-fingerprinting/verdict/not-found.md): Handling 404 errors for Fingerprint Lookup. ##### Decisioning - [Make decisions](https://stytch.com/docs/fraud-risk/device-fingerprinting/decisioning/overview.md): Make decisions with using verdicts, rules, Intelligent Rate Limiting, and custom decisioning logic. - [Set decisioning rules](https://stytch.com/docs/fraud-risk/device-fingerprinting/decisioning/set-rules.md): Create rules to customize your decisioning for Device Fingerprinting. - [Override verdict reasons](https://stytch.com/docs/fraud-risk/device-fingerprinting/decisioning/override-verdict-reasons.md): Customizing the action associated with a verdict reason. - [Intelligent Rate Limiting](https://stytch.com/docs/fraud-risk/device-fingerprinting/decisioning/intelligent-rate-limiting.md): Better rate limiting powered by device intelligence. ##### Enforcement - [Enforce decisions](https://stytch.com/docs/fraud-risk/device-fingerprinting/enforcement/overview.md): How to enforce decisions once you've made them. #### Email risk - [Email Risk is coming soon](https://stytch.com/docs/fraud-risk/email-risk/coming-soon.md): Detect suspicious email addresses for trust & safety and fraud prevention use cases. #### For developers - [Reference guides](https://stytch.com/docs/fraud-risk/development/overview.md): Developer reference guides for using Device Fingerprinting. ### Connected Apps - [Stytch Connected Apps](https://stytch.com/docs/connected-apps/overview.md): Enable your application to become an OAuth and OIDC Authorization server. #### Getting started ##### Stytch UI - [Build an authorization server using Stytch Connected Apps](https://stytch.com/docs/connected-apps/build-login-flow/login-flow.md): Enable your application to become an OAuth and OIDC Authorization server by leveraging the Stytch frontend SDK. ##### Build from scratch - [via the Stytch API](https://stytch.com/docs/connected-apps/build-custom-flow/getting-started-api.md): Examples and considerations when doing a server-side integration with Stytch. - [Implementing your own Connected App](https://stytch.com/docs/connected-apps/build-custom-flow/implementing-your-own.md): Examples and considerations when implementing your own Connected App. - [Public apps: Authorization Code Flow with PKCE](https://stytch.com/docs/connected-apps/build-custom-flow/public-apps.md): Examples and considerations when implementing a public app. #### OAuth Basics - [OAuth basics: terminology and grant types](https://stytch.com/docs/connected-apps/oauth-learn-more/oauth-basics.md): Key OAuth concepts including OAuth terminology and grant types. - [OAuth scopes](https://stytch.com/docs/connected-apps/oauth-learn-more/oauth-scopes.md): Understanding OAuth Scopes in Stytch Connected Apps - [Client types in Stytch Connected Apps](https://stytch.com/docs/connected-apps/oauth-learn-more/client-types.md): Understand the different types of OAuth clients #### Guides - [Add Stytch Connected Apps to an existing authentication system](https://stytch.com/docs/connected-apps/guides/integrate-with-existing-system.md): Make your application an OIDC/OAuth2.1 provider without migrating your entire authentication system. - [Integrate with AI agents](https://stytch.com/docs/connected-apps/guides/integrate-with-ai-agents.md): Enable AI agents to securely connect to your application. - [MCP authorization overview](https://stytch.com/docs/connected-apps/guides/mcp-auth-overview.md): Using Stytch for Remote MCP Server authorization - [Remote MCP servers](https://stytch.com/docs/connected-apps/guides/remote-mcp-servers.md): Create a Remote Model Context Protocol (MCP) server to manage authentication and authorization of a Stytch Connected App. - [Integrate with MCP servers on Cloudflare](https://stytch.com/docs/connected-apps/guides/mcp-servers-cloudflare.md): Create a remote MCP server with Stytch authentication on Cloudflare. - [Integrate with MCP servers on Vercel](https://stytch.com/docs/connected-apps/guides/mcp-servers-vercel.md): Create a remote MCP server with Stytch authentication on Vercel. - [Integrate with CLI agents](https://stytch.com/docs/connected-apps/guides/cli-agents.md): Create a CLI app with Stytch Authentication. - [Cross App Access (XAA) Flow](https://stytch.com/docs/connected-apps/guides/cross-app-access.md): Exchange a JWT from an external workforce identity provider for a Stytch Connected Apps access token without browser interaction. #### Resources - [Connected Apps Authorization Code Flow](https://stytch.com/docs/connected-apps/authorization-code-flow.md): Learn more about the authorization code flow for a Connected App. - [Consent management](https://stytch.com/docs/connected-apps/resources/consent-management.md): Learn how consent is requested, tracked, enforced, and revoked using Stytch. - [Custom domain](https://stytch.com/docs/connected-apps/resources/custom-domains.md): Configure Stytch to use your custom domain. - [Testing integrations](https://stytch.com/docs/connected-apps/resources/testing-integrations.md): Ensure your Stytch-powered app is functioning properly as an Authorization Server. ### Resources - [Resources](https://stytch.com/docs/resources/overview.md): Connect with the Stytch community and stay plugged in to what our team is shipping. - [Support](https://stytch.com/docs/resources/get-support.md): Learn about Stytch support resources and packages. - [Changelog](https://stytch.com/docs/resources/changelog.md): Stytch product updates and annoucements - [System Status](https://stytch.com/docs/resources/system-status.md) #### Policies ##### Messaging - [Messaging overview](https://stytch.com/docs/resources/policies/messaging/overview.md): Stytch provides reliable and timely email, SMS, and WhatsApp messaging through our providers out-of-the-box, allowing you to spend less time setting up and managing deliverability in your authentication services. - [SMS toll fraud](https://stytch.com/docs/resources/policies/messaging/toll-fraud.md): Learn about SMS toll fraud (SMS pumping), how it works, and how to protect your app from it. - [Unsupported countries for SMS and WhatsApp OTPs](https://stytch.com/docs/resources/policies/messaging/unsupported-countries.md): A list of countries where Stytch does not support sending SMS or WhatsApp passcodes. ###### Deliverability - [Message deliverability overview](https://stytch.com/docs/resources/policies/messaging/deliverability/overview.md): Learn about how Stytch handles and optimizes for message deliverability across all of our messaging channels. - [Email deliverability](https://stytch.com/docs/resources/policies/messaging/deliverability/email-deliverability.md): Learn about how Stytch handles and optimizes for email deliverability during our authentication flows. - [SMS and WhatsApp deliverability](https://stytch.com/docs/resources/policies/messaging/deliverability/sms-whatsapp-deliverability.md): Learn about how Stytch handles and optimizes for SMS and WhatsApp message deliverability during our authentication flows. ##### Platform - [Account enumeration](https://stytch.com/docs/resources/policies/platform/account-enumeration.md): Learn how to prevent account enumeration attacks and enhance the security of your platform with Stytch's comprehensive guide. - [IP validation](https://stytch.com/docs/resources/policies/platform/ip-validation.md): Learn how to specify a list of IP addresses to ensure only your servers are able to access the Stytch API. - [Rate limits](https://stytch.com/docs/resources/policies/platform/rate-limits.md): Learn about how Stytch treats rate limits. - [App store reviews](https://stytch.com/docs/resources/policies/platform/app-store-reviews.md): Learn more about the app store review process when using Stytch's authentication and fraud products. - [User locks](https://stytch.com/docs/resources/policies/platform/user-locks.md): Learn about how Stytch handles user account locking mechanisms. ##### Security & Trust - [Security](https://stytch.com/docs/resources/policies/security-and-trust/security.md) - [Privacy](https://stytch.com/docs/resources/policies/security-and-trust/privacy.md) ###### Compliance - [Overview](https://stytch.com/docs/resources/policies/security-and-trust/compliance/overview.md) - [Data compliance](https://stytch.com/docs/resources/policies/security-and-trust/compliance/data-compliance.md): Learn about Stytch's compliance with GDPR and Data Privacy Framework requirements. #### Branding - [Custom auth domains](https://stytch.com/docs/resources/branding/custom-domains.md): Use your custom domain for Stytch assets and API calls. - [Custom email domains](https://stytch.com/docs/resources/branding/custom-email-domains.md): Use your custom domain to send Stytch emails. - [Custom email templates](https://stytch.com/docs/resources/branding/custom-email-templates.md): Set up custom email templates to use in your Stytch authentication requests. #### Migrations - [Migrate from Consumer to B2B](https://stytch.com/docs/resources/migrations/migrating-from-consumer-to-b2b.md): Migrate from Consumer to B2B auth in Stytch. - [Exporting from Stytch](https://stytch.com/docs/resources/migrations/exporting-from-stytch.md): To export your passwordless Users from Stytch, use our Search users endpoint to export what you need. ##### Migrating your auth provider - [Migration overview](https://stytch.com/docs/resources/migrations/overview.md): Migrate your app's existing authentication system over to Stytch. - [Reconciling data models](https://stytch.com/docs/resources/migrations/reconciling-data-models.md): Map your existing user model to Stytch's authentication data model. - [Migrating user data](https://stytch.com/docs/resources/migrations/migrating-user-data.md): Choose a migration strategy for moving user data to Stytch. - [Additional migration considerations](https://stytch.com/docs/resources/migrations/additional-migration-considerations.md): Deploying a new authentication service is not always limited to just changing login and signup logic. - [Zero-downtime deployment](https://stytch.com/docs/resources/migrations/zero-downtime-deployment.md): Strategies and best practices to deploy your Stytch auth integration to production. - [External IDs](https://stytch.com/docs/resources/migrations/external-ids.md): Assign and use external IDs for Stytch resources in place of Stytch-assigned UUIDs. #### Workspace Management - [Programmatic Workspace Actions API](https://stytch.com/docs/resources/workspace-management/pwa-api.md) - [API Keys](https://stytch.com/docs/resources/workspace-management/api-keys.md) - [Redirect URLs](https://stytch.com/docs/resources/workspace-management/redirect-urls.md) - [Dashboard Roles and Permissions](https://stytch.com/docs/resources/workspace-management/dashboard-roles-and-permissions.md) - [Webhooks](https://stytch.com/docs/resources/workspace-management/webhooks.md) - [Stytch MCP Server](https://stytch.com/docs/resources/workspace-management/stytch-mcp-server.md) - [Event Logs](https://stytch.com/docs/resources/workspace-management/event-logs.md): Understand and debug your authentication flows using Stytch Event Logs. - [Event Log Streaming](https://stytch.com/docs/resources/workspace-management/event-log-streaming.md): Stream your Stytch event logs to your preferred observability platform. #### Documentation - [Glossary](https://stytch.com/docs/resources/glossary.md): Definitions of key terms and concepts