/
Contact usSee pricingStart building

    About B2B Saas Authentication

    Introduction
    Stytch B2B Basics
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Next.js
      Routing
      Authentication
      Sessions
    Migrations
      Overview
      Reconciling data models
      Migrating user data
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for members
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    Single Sign On
    • Resources

      • Overview
        External SSO Connections
    • Integration Guides

      • Start here
        Backend integration guide
        Headless integration guide
        Pre-built UI integration guide
    OAuth
    • Resources

      • Overview
        Authentication flows
        Identity providers
        Google One Tap
        Provider setup
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Connected AppsBeta
      Setting up Connected Apps
      About Remote MCP Servers
    • Resources

      • Integrate with AI agents
        Integrate with a remote MCP server
    Sessions
    • Resources

      • Overview
        JWTs vs Session Tokens
        How to use Stytch JWTs
        Custom Claims
    • Integration Guides

      • Start here
        Backend integration
        Frontend integration
    Email OTP
      Overview
    Magic Links
    • Resources

      • Overview
        Email Security Scanner Protections
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Multi-Factor Authentication
    • Resources

      • Overview
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
        Pre-built UI frontend integration
    Passwords
      Overview
      Strength policies
    UI components
      Overview
      Implement the Discovery flow
      Implement the Organization flow
    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0

    Authorization & Provisioning

    RBAC
    • Resources

      • Overview
        Stytch Resources & Roles
        Role assignment
    • Integration Guides

      • Start here
        Backend integration
        Headless frontend integration
    SCIM
    • Resources

      • Overview
        Supported actions
    • Integration Guides

      • Using Okta
        Using Microsoft Entra
    Organizations
      Managing org settings
      JIT Provisioning

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

B2B Saas Authentication

/

Guides

/

About B2B Saas Authentication

/

Migrations

/

Zero-downtime deployment

Zero-Downtime deployment

This section covers strategies and best practices to deploy your Stytch auth integration to production. There are a few approaches when it comes to deployment.

Option 1: Zero-Downtime Sessions deployment

We offer a Zero-Downtime Sessions feature which enables developers to mint Stytch Sessions from an external session (such as an Auth0 JWT). This solution is designed to facilitate a smooth zero-downtime cutover between Stytch and an external provider, by ensuring your end users stay logged into your application throughout the entire migration process. For this guide, we will use Auth0 as an example.

1
Add OIDC-compliant UserInfo endpoint URL to Dashboard

To enable this feature for your account, go to your Dashboard's Migrations. Enter your external provider's OIDC-compliant UserInfo endpoint in the form.

Zero-downtime userinfo image

For Auth0, you can find the UserInfo URL in the application settings:

Auth0 Application Settings

2
Acquire the access token from the legacy auth provider

Grab your access token from your legacy provider. For example, with Auth0, you can use the Authorization Code Flow to grab the access_token (for example, with Auth0, this starts with eyJ).

{
  "access_token": "eyJz39a...hOo5WwA",
  "id_token": "eyJhb...Vp8hog",
  "token_type": "Bearer"
}

3
Call the Migrate Sessions endpoint with the access token

After you have created a Stytch member, call the Migrate Session API with your external provider's access token / session token . Stytch will respond with a session you can associate with this member.

curl --request POST \
  --url https://test.stytch.com/v1/b2b/sessions/migrate \
  -u 'PROJECT_ID:SECRET' \
  -H 'Content-Type: application/json' \
  -d '{
    "session_token": "eyJz39a...hOo5WwA",
    "organization_id": "organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931",
  }'

You should receive a response with a Member object as well as a Member Session object usable with Stytch.

{
  "status_code": 200,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "member_id": "member-test-32fc5024-9c09-4da3-bd2e-c9ce4da9375f",
  "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
  "session_jwt": "eyJ...",
  "member": "{...}",
  "organization": "{...}"
}

Option 2: Rolling deployment

A rolling deployment roughly adheres to the following sequence:

  1. Deploy auth changes incrementally across your user base by using feature flags to segment your users into discrete groups. You could divide your user base by IP, geography, and other measures like cookies. If your application only utilizes organization-specific login flows, you could create feature flags users by Stytch Organizations.
  2. Users under the feature flag will see Stytch powered login flow and will need a Stytch Session to be considered logged in.
  3. Users that are not feature flagged into Stytch will continue to see your legacy auth flow. These users will not be logged out and can continue using their existing legacy sessions.
  4. In your middleware / server-side logic, you will need to determine if each JWT is from Stytch or your legacy flow.
  5. You will also need to maintain two middleware routes to authenticate the session: one for Stytch's auth flow and another for your legacy auth flow.

This strategy requires a few bits of additional logic in your app to ensure a smooth transition:

  • A feature flag within your authentication flow that bifurcates your user base between Stytch and your legacy authentication at a controllable percentage.
  • If desired, you can set a cookie (or similar) on each user’s device that tracks which authentication flow to present. You may also use factors such as IP or geography if you have access to that information.
  • For new users that go through your sign up flow via Stytch, you will need to create a record in your legacy flow to handle the edge case where this user returns logged out on a different device and is presented with the legacy authentication UI.

A rolling deployment strategy allows you to quickly and easily monitor your integration with minimal user impact, and adjust your transition if necessary. It's also typically used when your application stack includes mobile clients, since you need to manage the user base on older versions of your application.

Option 3: All-at-once deployment

An all-at-once deployment adheres to the following sequence:

  1. Deploy your Stytch auth implementation to production and to all users at once.
  2. Upon deployment, your users will require Stytch Sessions in your middleware / server-side logic. As a result, all users will be logged out and need to log back in.
  3. Users log back in with the Stytch auth flow when they revisit your app.

An all-at-once deployment is the most straightforward. It is the best option when you’re ready to move quickly as it removes any need to build secondary logic to aid in the migration.

General deployment best practices

Stytch recommends to use environment variables (such as .env-live and .env-test) in your application for test and live Stytch keys. When using env files, the Stytch public token, project ID and secret map to your environment dynamically, preventing the common mistake of forgetting to change your API keys to your live set upon deployment to production.

Option 1: Zero-Downtime Sessions deployment

1.

Add OIDC-compliant UserInfo endpoint URL to Dashboard

2.

Acquire the access token from the legacy auth provider

3.

Call the Migrate Sessions endpoint with the access token

Option 2: Rolling deployment

Option 3: All-at-once deployment

General deployment best practices