> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate using redirect URL params

> Call authenticate via token in the URL after the user is redirected back

<Note>Added in @stytch/vanilla-js v5.44</Note>

To handle tokens passed via URL after the user has authenticated through an outside page, such as via Email Magic Link or OAuth, use the `authenticateByUrl()` method.
This method parses the current page's URL params and calls the appropriate `authenticate()` method associated with the token.

`authenticateByUrl` takes an option object with one required property, `session_duration_minutes`. Other properties are passed through to the underlying `authenticate()` method.

<ParamField path="session_duration_minutes" type="number" required>
  Set the session lifetime to be this many minutes from now.

  This value must be a minimum of 5 and may not exceed the maximum session duration minutes value set in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration) of the Stytch Dashboard.

  This param is optional for impersonation token types, but because this function can be used for any type of token, this param is typed as required.
</ParamField>

Currently the following are supported:

* [Email Magic Link](./email-magic-links/authenticate)
* [OAuth](./oauth/authenticate)
* [Impersonation](./impersonation/authenticate)

The response from the authenticate call is returned as the `data` property.

```js theme={null}
{
  handled: true,
  tokenType: 'magic_links',
  data: {
    "request_id": "requestId",
    "status_code": 200,
    "user_id": "userId",
    "session_token": "token",
    "session": {...}
  },
}
```

The following is parsed but not handled:

* [Password reset by email](./passwords/reset-by-email)

In this case, the `handled` property on the returned object will be false. Use the `token` property to call the `resetByEmail()` method.

```js theme={null}
{
  handled: false,
  tokenType: 'reset_password',
  token: '...',
}
```

If a token is not found in the URL, the returned promise will resolve to `null`.

## parseAuthenticateUrl

If you only want to get the token without calling `authenticate()`, you can use `parseAuthenticateUrl()`. This function returns synchronously and can be useful if you want to check the token type before calling authenticate.

The following token types can be returned:

* oauth
* magic\_links
* impersonation
* reset\_password (not handled)
* login (not handled)

For methods which `authenticateByUrl` can handle, the method will also return `handled: true`.

```js theme={null}
{
  token: '...',
  tokenType: '...',
  handled: true | false,
}
```

If a token is not found in the URL, the function will return `null`.

<Panel>
  ```jsx theme={null}
  import { useEffect } from 'react';
  import { useStytch, useStytchSession } from '@stytch/nextjs';

  export const AuthenticateByUrl = () => {
    const stytch = useStytch();
    const { session } = useStytchSession();

    useEffect(() => {
      if (session) {
        // User is already logged in, redirect them to a logged in page
      } else {
        stytch.authenticateByUrl({ session_duration_minutes: 60 });
      }
    }, [stytch, session]);

    return <div>Loading</div>;
  };
  ```
</Panel>