/
Contact usSee pricingStart building
Node
​

    About Stytch

    Introduction
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Migrations
      Migration overview
      Migrating users statically
      Migrating users dynamically
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for users
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    Magic Links
    • Email Magic Links

      • Getting started with the API
        Getting started with the SDK
        Replacing your password reset flow
        Building an invite user flow
        Add magic links to an existing auth flow
        Adding PKCE to a Magic Link flow
        Magic Link redirect routing
    • Embeddable Magic Links

      • Getting started with the API
    MFA
      Overview
      Backend integration
      Frontend integration
    Mobile Biometrics
      Overview
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0
    OAuth
    • Identity providers

      • Overview
        Provider setup
      Getting started with the API (Google)
      Add Google One Tap via the SDK
      Email address behavior
      Adding PKCE to an OAuth flow
    Connected AppsBeta
      Setting up Connected Apps
      About Remote MCP Servers
    • Resources

      • Integrate with AI agents
        Integrate with MCP servers
        Integrate with CLI Apps
    Passcodes
      Getting started with the API
      Getting started with the SDK
    • Toll fraud

      • What is SMS toll fraud?
        How you can prevent toll fraud
      Unsupported countries
    Passkeys & WebAuthn
    • Passkeys

      • Passkeys overview
        Set up Passkeys with the frontend SDK
    • WebAuthn

      • Getting started with the API
        Getting started with the SDK
    Passwords
      Getting started with the API
      Getting started with the SDK
      Password strength policy
    • Email verification

      • Overview
        Email verification before password creation
        Email verification after password creation
    Sessions
      How to use sessions
      Backend integrations
      Frontend integrations
      Custom claims
      Custom claim templates
      Session tokens vs JWTs
      How to use Stytch JWTs
    TOTP
      Getting started with the API
      Getting started with the SDK
    Web3
      Getting started with the API
      Getting started with the SDK

    Authorization

    Implement RBAC with metadata

    3rd Party Integrations

    Planetscale
    Supabase
    Feathery
    Unit

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

Consumer Authentication

/

Guides

/

About Stytch

/

Migrations

/

Zero-downtime deployment

Zero-Downtime deployment

This section covers strategies and best practices to deploy your Stytch auth integration to production. There are a few approaches when it comes to deployment.

Option 1: Zero-Downtime Sessions deployment

We offer a Zero-Downtime Sessions feature which enables developers to mint Stytch Sessions from an external session (such as an Auth0 JWT). This solution is designed to facilitate a smooth zero-downtime cutover between Stytch and an external provider, by ensuring your end users stay logged into your application throughout the entire migration process. For this guide, we will use Auth0 as an example.

Step 1: Add OIDC-compliant UserInfo endpoint URL to Dashboard

To enable this feature for your account, go to your Dashboard's Migrations. Enter your external provider's OIDC-compliant UserInfo endpoint in the form.

Zero-downtime userinfo image

For Auth0, you can find the UserInfo URL in the application settings:

Auth0 Application Settings

Step 2: Acquire the access token from the legacy auth provider

Grab your access token from your legacy provider. For example, with Auth0, you can use the Authorization Code Flow to grab the access_token (for example, with Auth0, this starts with eyJ).

{
  "access_token": "eyJz39a...hOo5WwA",
  "id_token": "eyJhb...Vp8hog",
  "token_type": "Bearer"
}

Step 3: Call the Migrate Sessions endpoint with the access token

After you have migrated a user to Stytch, call the Migrate Session API with your external provider's access token / session token. Stytch will respond with a session you can associate with this user.

curl --request POST \
  --url https://test.stytch.com/v1/sessions/migrate \
  -u 'PROJECT_ID:SECRET' \
  -H 'Content-Type: application/json' \
  -d '{
    "session_token": "eyJz39a...hOo5WwA"
  }'

You should receive a response with a User object as well as a User session object usable with Stytch.

{
  "status_code": 200,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "user_id": "user-test-32fc5024-9c09-4da3-bd2e-c9ce4da9375f",
  "session": "{...}",
  "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
  "session_jwt": "eyJ...",
  "user": "{...}"
}

Option 2: All-at-once deployment

An all-at-once deployment adheres to the following sequence:

  1. Deploy your Stytch auth implementation to production and to all users at once.
  2. Upon deployment, your users will require Stytch Sessions in your middleware / server-side logic. As a result, all users will be logged out and need to log back in.
  3. Users log back in with the Stytch auth flow when they revisit your app.

An all-at-once deployment is the most straightforward. It is the best option when you’re ready to move quickly as it removes any need to build secondary logic to aid in the migration.

Option 3: Rolling deployment

A rolling deployment roughly adheres to the following sequence:

  1. Deploy auth changes to a portion of your users at a time using a feature flag (IP, geography, other measures such as a cookie).
  2. Users under the feature flag will see Stytch powered login flow and will need a Stytch Session to be considered logged in.
  3. Users that are not feature flagged into Stytch will continue to see your legacy auth flow. These users will not be logged out and can continue using their existing legacy sessions.
  4. In your middleware / server-side logic, you will need to determine if each JWT is from Stytch or your legacy flow.
  5. You will also need to maintain two middleware routes to authenticate the session: one for Stytch's auth flow and another for your legacy auth flow.

This strategy requires a few bits of additional logic in your app to ensure a smooth transition:

  • A feature flag within your authentication flow that bifurcates your user base between Stytch and your legacy authentication at a controllable percentage.
  • If desired, you can set a cookie (or similar) on each user’s device that tracks which authentication flow to present. You may also use factors such as IP or geography if you have access to that information.
  • For new users that go through your sign up flow via Stytch, you will need to create a record in your legacy flow to handle the edge case where this user returns logged out on a different device and is presented with the legacy authentication UI.

A rolling deployment strategy allows you to quickly and easily monitor your integration with minimal user impact, and adjust your transition if necessary. It's also typically used when your application stack includes mobile clients, since you need to manage the user base on older versions of your application.

General Deployment Best practices

Stytch recommends to use environment variables (such as .env-live and .env-test) in your application for test and live Stytch keys. When using env files, the Stytch public token, project ID and secret map to your environment dynamically, preventing the common mistake of forgetting to change your API keys to your live set upon deployment to production.

Option 1: Zero-Downtime Sessions deployment

Step 1: Add OIDC-compliant UserInfo endpoint URL to Dashboard

Step 2: Acquire the access token from the legacy auth provider

Step 3: Call the Migrate Sessions endpoint with the access token

Option 2: All-at-once deployment

Option 3: Rolling deployment

General Deployment Best practices