Remove token from URL as authenticate() call is made rather than after success. This prevents rare double calling if the user reloads the page while the call was being made.
Released 2026-02-11This is a major release, containing a redesign of our frontend components and package structure.We recommend reading our upgrade guide when updating to this version.
Add keepSessionAlive boolean flag to StytchClientOptions. When set, the client will automatically refresh the session as long as the client is active
Add TypeScript typings for strings prop / param. The types is available as Strings and is opt in. We recommend using them like const strings: Strings = { 'button.usePassword': 'Log in with password' }. Strings is a partial since we recommend you only include strings that you need, but if you need every string mapped (such as in a full localization), you can use Required<Strings>.
Patch Changes
B2B: Add support for ALL_ALLOWED organization email_jit_provisioning setting
When initializing StytchClient, the endpointOptions object is now deprecated
apiDomain and testApiDomain are now configured using customBaseUrl directly on the root object
fppaDomain and dfpCdnDomain are now configured as dfppaUrl and dfpCdnUrl directly on the root object
Add options to the Admin Portal Member Management and SSO Connections configuration to specify the redirect URL when inviting members and testing SSO connections
Add the ability for users to go back from the MFA enrollment screen to change their enrollment method
Store last used OAuth and SSO method locally and move it to the top of the list the next time users visit the log in page.
Add “provider.lastUsed” translation string for “Last used” text indicating the last used auth method.
Update labels to use <label> element and improve accessibility
New formField.phone.label string for phone number input label and formField.countryCode.label for country code label
formField.password.ariaLabel string has been folded into formField.password.label and can be removed
Add a new assumeHydrated prop to the StytchProvider and StytchB2BProvider components. This prop allows the provider to assume whether or not the app might be hydrated in a browser environment after initially being rendered in a server environment. When true, the provider eagerly reads from the browser’s local cache to retrieve cached session and related data. When false, the provider defers this initialization until after the first render, to avoid hydration errors. This prop defaults to false in @stytch/nextjs, which preserves the behavior from previous versions.We recommend setting assumeHydrated={false} if your app hydrates server-rendered content on the client. Otherwise, it is safe to set assumeHydrated={true}. If you’re unsure or notice hydration errors in your app, set assumeHydrated={false}.Unless you set assumeHydrated={true}, you should continue to check the initialized state of the provider by checking the isInitialized value (returned from hooks like useStytchUser, useStytchSession, useStytchMember, useStytchMemberSession, useStytchOrganization, and useStytchIsAuthorized) or *IsInitialized prop (injected by HOCs like withStytchUser, withStytchSession, withStytchMember, withStytchMemberSession, and withStytchOrganization) before relying on any other values.
This is a major version bump with potential breaking changes.
Major Changes
Updated API routes to use api.stytch.com for live and test.stytch.com for test, replacing web.stytch.com.
If you use Content Security Policy (CSP) headers, ensure the URL is updated.
This was done to reduce the number of network calls and simplify internal routing, resulting in faster API response times—improving request speeds by up to 40 milliseconds roundtrip.
This is a major version bump with potential breaking changes.
Major Changes
Breaking Changes: The intermediate session token (IST) will no longer be accepted as an argument for the discovery list organizations, intermediate sessions exchange, and create organization via discovery endpoints. The IST will be passed in automatically. ISTs are stored as browser cookies or persisted on device when they are generated after calls to discovery authenticate endpoints, such as email magic link discovery authenticate, or primary authenticate endpoints in the case where MFA is required, such as email magic link authenticate or SSO authenticate.New Features: Our B2B product now supports multi-factor authentication (MFA) with one-time passcodes (OTPs) via SMS. MFA policies can be set on the Organization level or on the Member level. See the Stytch docs for more information.
Add support for template ID parameters to Magic link Login or create and Send methods, Email OTP Login or create and Send methods, and Reset Password Start
