​

Multi-Factor Authentication

Multi-factor authentication (MFA) enhances security by requiring users to provide two or more verification factors prior to accessing their account, which reduces the likelihood of account compromise.

​

How it works

Stytch supports two different methods of secondary authentication:

1. SMS one-time passcodes (OTPs). OTPs ask users to enter a unique numeric or alphanumeric code sent via SMS to a recognized mobile phone number.
2. Authenticator app time-based one-time passcodes (TOTPs). TOTPs ask users to confirm control of their device within a certain time frame using a passcode generated by a smartphone app like Authy or Google Authenticator.

Stytch handles:

• Enforced enrollment in MFA based on the Organization’s MFA policy, which determines whether MFA is optional or required and which methods are allowed.
• Optional enrollment in MFA, even if Organization does not require it.
• Enforcing that MFA requirements for the Member and Organization have been met prior to a Stytch session being issued.

​

OTP considerations

​

Cost

When using Stytch’s SMS OTP product, Stytch will passthrough SMS costs from our upstream providers. You can see the pricing for each country by visiting Country Code Allowlists in the Stytch Dashboard. This is important to keep in mind as you plan costs and which countries you want to support as pricing can vary significantly by country.

​

Country code allowlist

By default, a Stytch project will have only the United States (US) and Canada (CA) enabled for SMS OTP sends. To enable SMS OTP sends to other allowed countries, you can add the country to your country code allowlist in the Stytch Dashboard or via the country_code_allowlist endpoint. Stytch does not support sending SMS passcodes to the following countries. If you attempt to add a country listed below to your country code allowlist, the API will return an country_code_allowlist_invalid_country_codes error.

---