Deployment Strategies

This section covers strategies and best practices to deploy your Stytch auth integration to production. There are two broad approaches when it comes to deployment.

An all-at-once deployment adheres to the following sequence:

1. Deploy your Stytch auth implementation to production and to all users at once.
2. Upon deployment, your users will require Stytch Sessions in your middleware / server-side logic. As a result, all users will be logged out and need to log back in.
3. Users log back in with the Stytch auth flow when they revisit your app.

An all-at-once deployment is the most straightforward. It is the best option when you’re ready to move quickly as it removes any need to build secondary logic to aid in the migration.

A rolling deployment roughly adheres to the following sequence:

1. Deploy auth changes to a portion of your users at a time using a feature flag (IP, geography, other measures such as a cookie).
2. Users under the feature flag will see Stytch powered login flow and will need a Stytch Session to be considered logged in.
3. Users that are not feature flagged into Stytch will continue to see your legacy auth flow. These users will not be logged out and can continue using their existing legacy sessions.
4. In your middleware / server-side logic, you will need to determine if each JWT is from Stytch or your legacy flow.
5. You will also need to maintain two middleware routes to authenticate the session: one for Stytch's auth flow and another for your legacy auth flow.

This strategy requires a few bits of additional logic in your app to ensure a smooth transition:

• A feature flag within your authentication flow that bifurcates your user base between Stytch and your legacy authentication at a controllable percentage.
• If desired, you can set a cookie (or similar) on each user’s device that tracks which authentication flow to present. You may also use factors such as IP or geography if you have access to that information.
• For new users that go through your sign up flow via Stytch, you will need to create a record in your legacy flow to handle the edge case where this user returns logged out on a different device and is presented with the legacy authentication UI.

A rolling deployment strategy allows you to quickly and easily monitor your integration with minimal user impact, and adjust your transition if necessary. It's also typically used when your application stack includes mobile clients, since you need to manage the user base on older versions of your application.

Stytch recommends to use environment variables (such as .env-live and .env-test) in your application for test and live Stytch keys. When using env files, the Stytch public token, project ID and secret map to your environment dynamically, preventing the common mistake of forgetting to change your API keys to your live set upon deployment to production.