/
Contact usSee pricingStart building

    About B2B Saas Authentication

    Introduction
    Stytch B2B Basics
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Next.js
      Routing
      Authentication
      Sessions
    Migrations
      Overview
      Reconciling data models
      Migrating user data
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for members
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    Single Sign On
    • Resources

      • Overview
        External SSO Connections
    • Integration Guides

      • Start here
        Backend integration guide
        Headless integration guide
        Pre-built UI integration guide
    OAuth
    • Resources

      • Overview
        Authentication flows
        Identity providers
        Google One Tap
        Provider setup
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Connected AppsBeta
      Setting up Connected Apps
      About Remote MCP Servers
    • Resources

      • Integrate with AI agents
        Integrate with a remote MCP server
    Sessions
    • Resources

      • Overview
        JWTs vs Session Tokens
        How to use Stytch JWTs
        Custom Claims
    • Integration Guides

      • Start here
        Backend integration
        Frontend integration
    Email OTP
      Overview
    Magic Links
    • Resources

      • Overview
        Email Security Scanner Protections
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Multi-Factor Authentication
    • Resources

      • Overview
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Passwords
      Overview
      Strength policies
    UI components
      Overview
      Implement the Discovery flow
      Implement the Organization flow
    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0

    Authorization & Provisioning

    RBAC
    • Resources

      • Overview
        Stytch Resources & Roles
        Role assignment
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
    SCIM
    • Resources

      • Overview
        Supported actions
    • Integration Guides

      • Using Okta
        Using Microsoft Entra
    Organizations
      Managing org settings
      JIT Provisioning

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

B2B Saas Authentication

/

Guides

/

Authentication

/

DFP Protected Auth

/

Setting up DFP Protected Auth

Getting started with DFP Protected Auth

Stytch's Device Fingerprinting (DFP) Protected Auth is a frontend SDK feature that utilizes DFP to ensure that only legitimate users can accces your auth flows. We offer support across our Javscript, iOS, and Android SDKs.

In this guide, you'll learn how to set up DFP Protected Auth. By the end, you'll have:

  • Installed the frontend SDK.
  • Turned on Observation mode.
  • Turn on Decisioning mode.

If you haven't already, check out this high-level overview of DFP Protected Auth.

Before you start

In order to complete this guide, you'll need the following:

  • A Stytch project (either Consumer or B2B). If you don't have one already, in the Dashboard, click on your existing project name in the top left corner of the Dashboard, click Create a new project, and then select B2B Authentication or Consumer Authentication.
  • The project Test environment's project_id and secret from the API keys section. You'll need to pass these values into the Authorization request header for most Stytch API calls.
  • Device Fingerprinting enabled. If you don't have these product enabled, reach out to Stytch here.

Step 1: Install the frontend auth SDK

Since DFP Protected Auth is built on top of our frontend authentication SDKs, you need to install and use one of the SDKs before you can enable DFP Protected Auth.

Stytch offers multiple starting guides and example apps that you can use to build the authentication flows. Here are a few guides you can use as a starting point:

  • Email Magic Links for Consumer Auth
  • Passwords for Consumer Auth
  • Example Apps for Consumer Auth
  • Example Apps fpr B2B SaaS Auth
  • iOS example app
  • Android example app
  • React Native example app

If you're integrating the SDK directly into your application, you will need to check and ensure your SDK version is compatible with DFP Protected Auth. Here are the minimum versions for each SDK:

  • Vanilla JS SDK: v2.2.0
  • React-native SDK: v0.12.0
  • iOS SDK: v 0.18.0
  • Android SDK: v0.14.0

Step 2: Turn on Observation mode

With your auth SDK installed, you will need to turn on DFP Protected Auth under Frontend SDKs in the Dashboard. By default, Stytch enables Observation mode when you first turn on DFP Protected Auth.

Turning on DFP Protected Auth

Observation mode automatically generates and submits a fingerprint to the Stytch API. However, the Stytch API will take no actions on the fingerprint's verdict.

This mode allows you to test out DFP Protected Auth before making any decision actions. This ensures that DFP Protected Auth won’t cause any important requests to be blocked before you have a chance to analyze the results.

Step 3: View the results in the Dashboard

Once you have DFP Protected Auth enabled in Observation mode, you can start seeing the results of the automatic device fingerprint lookups at the Device Fingerprinting Dashboard page.

DFP Dashboard

The Device Fingerprinting Dashboard page will give you a high-level view of the various fingerprints, verdicts, and verdict reasons your application is experiencing. You can also deep dive into individual fingerprints to understand the various devices that are querying your service.

Step 4: Turn on Decisioning mode

Once you are comfortable with the results in our Device Fingerprinting service, you can change to the DFP Protected Auth to Decisioning mode. Once Decisioning mode is on, the Stytch API will react to each Device Fingerprint lookup triggered by the SDK. Specifically, it will:

  • Reject requests if the fingerprint has a BLOCK verdict and return a 401. You can be confident that a BLOCK verdict is an illegitimate attempt to access your service.
  • Continue requests with fingerprints with an ALLOW verdict.
  • By default, continue requests that can have a CHALLENGE verdict. That behavior can be changed and you can learn about the option in the handling challenges guide.
DFP Decisioning mode

With Decisioning mode on, your application's auth flows are now secured with DFP Protected Auth.

What's next

Learn about handling challenges with DFP Protected Auth.

Before you start

Step 1: Install the frontend auth SDK

Step 2: Turn on Observation mode

Step 3: View the results in the Dashboard

Step 4: Turn on Decisioning mode

What's next