> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate using redirect URL params

> Call authenticate via token in the URL after the member is redirected back

<Note>Added in @stytch/vanilla-js v5.44</Note>

To handle tokens passed via URL after the member has authenticated through an outside page, such as via Email Magic Link or OAuth, use the `authenticateByUrl()` method.
This method parses the current page's URL params and calls the appropriate `authenticate()` method associated with the token.

`authenticateByUrl` takes an option object with one required property, `session_duration_minutes`. Other properties are passed through to the underlying `authenticate()` method.

<ParamField path="session_duration_minutes" type="number" required>
  Set the session lifetime to be this many minutes from now.

  This value must be a minimum of 5 and may not exceed the maximum session duration minutes value set in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration) of the Stytch Dashboard.

  This param is optional for discovery email link and impersonation token types, but because this function can be used for any type of token, this param is typed as required.
</ParamField>

Currently the following are supported:

* [Email Magic Link](./email-magic-links/authenticate)
* [OAuth](./oauth/authenticate)
* [SSO](./sso/authenticate)
* [Impersonation](./impersonation/authenticate)

The response from the authenticate call is returned as the `data` property.

```js theme={null}
{
  handled: true,
  tokenType: 'multi_tenant_magic_links',
  data: {
    "request_id": "requestId",
    "status_code": 200,
    "intermediate_session_token": "token",
    "email_address": "email",
    "discovered_organizations": [{...}, {...}]
  },
}
```

The following is parsed but not handled:

* [Password reset by email](./passwords/reset-by-email)

In this case, the `handled` property on the returned object will be false. Use the `token` property to call the `resetByEmail()` method.

```js theme={null}
{
  handled: false,
  tokenType: 'multi_tenant_magic_links',
  token: '...',
}
```

If a token is not found in the URL, the returned promise will resolve to `null`.

## parseAuthenticateUrl

If you only want to get the token without calling `authenticate()`, you can use `parseAuthenticateUrl()`. This function returns synchronously and can be useful if you want to check the token type before calling authenticate.

The following token types can be returned:

* discovery
* discovery\_oauth
* oauth
* sso
* multi\_tenant\_magic\_links
* multi\_tenant\_impersonation
* multi\_tenant\_passwords (not handled)
* login (not handled)

For methods which `authenticateByUrl` can handle, the method will also return `handled: true`.

```js theme={null}
{
  token: '...',
  tokenType: '...',
  handled: true | false,
}
```

If a token is not found in the URL, the function will return `null`.

<Panel>
  ```jsx theme={null}
  import { useEffect } from 'react';
  import { useStytchB2BClient, useStytchMemberSession } from '@stytch/nextjs/b2b';

  export const AuthenticateByUrl = () => {
    const stytch = useStytchB2BClient();
    const { session } = useStytchMemberSession();

    useEffect(() => {
      if (session) {
        // Member is already logged in, redirect them to a logged in page
      } else {
        stytch.authenticateByUrl({ session_duration_minutes: 60 });
      }
    }, [stytch, session]);

    return <div>Loading</div>;
  };
  ```
</Panel>