Skip to main content
import { useEffect } from 'react';
import { useStytchB2BClient, useStytchMemberSession } from '@stytch/nextjs/b2b';

export const AuthenticateByUrl = () => {
  const stytch = useStytchB2BClient();
  const { session } = useStytchMemberSession();

  useEffect(() => {
    if (session) {
      // Member is already logged in, redirect them to a logged in page
    } else {
      stytch.authenticateByUrl({ session_duration_minutes: 60 });
    }
  }, [stytch, session]);

  return <div>Loading</div>;
};
Added in @stytch/vanilla-js v5.44
To handle tokens passed via URL after the member has authenticated through an outside page, such as via Email Magic Link or OAuth, use the authenticateByUrl() method. This method parses the current page’s URL params and calls the appropriate authenticate() method associated with the token. authenticateByUrl takes an option object with one required property, session_duration_minutes. Other properties are passed through to the underlying authenticate() method.
​
session_duration_minutes
number
required
Set the session lifetime to be this many minutes from now.This value must be a minimum of 5 and may not exceed the maximum session duration minutes value set in the Frontend SDK page of the Stytch Dashboard.This param is optional for discovery email link and impersonation token types, but because this function can be used for any type of token, this param is typed as required.
Currently the following are supported: The response from the authenticate call is returned as the data property. 
{
  handled: true,
  tokenType: 'multi_tenant_magic_links',
  data: {
    "request_id": "requestId",
    "status_code": 200,
    "intermediate_session_token": "token",
    "email_address": "email",
    "discovered_organizations": [{...}, {...}]
  },
}
The following is parsed but not handled: In this case, the handled property on the returned object will be false. Use the token property to call the resetByEmail() method. 
{
  handled: false,
  tokenType: 'multi_tenant_magic_links',
  token: '...',
}
If a token is not found in the URL, the returned promise will resolve to null.

​
parseAuthenticateUrl

If you only want to get the token without calling authenticate(), you can use parseAuthenticateUrl(). This function returns synchronously and can be useful if you want to check the token type before calling authenticate. The following token types can be returned:
  • discovery
  • discovery_oauth
  • oauth
  • sso
  • multi_tenant_magic_links
  • multi_tenant_impersonation
  • multi_tenant_passwords (not handled)
  • login (not handled)
For methods which authenticateByUrl can handle, the method will also return handled: true. 
{
  token: '...',
  tokenType: '...',
  handled: true | false,
}
If a token is not found in the URL, the function will return null.