Migrating user data dynamically

If your users have passwords, Stytch recommends to use the static migration approach.

For users that do not have passwords (i.e. passwordless login), there are two strategies to migrate user data:

1. Implement a static migration via API.
2. Implementing a rolling migration (recommended).

For this strategy, exporting or importing users via API is not required. You do not need to write a script or a dual write + backfill job for user import.

With a rolling migration, you'll deploy your auth integration with Stytch to production with zero users pre-migrated to Stytch. As users log in to your application via any passwordless method, your application should execute the following logic:

1. As each user logs in, call the Stytch API and authenticate the user to create a Session.
2. Look up the user in your internal database.
3. If the user already exists in your internal db, append the Stytch user_id to the user internally.
4. If the user is not found in your internal database, this is a net new sign up. Create the user in your internal database and include the Stytch user_id with the new record.

Here is an example of a rolling migration architecture:

For auth factors like TOTP and Biometrics, you cannot use the Create User endpoint or Migrate Password endpoint.

Instead, you will need to re-enroll users using Stytch's APIs or SDKs after they've been imported and authenticated (i.e. the Stytch User record must have a user_id and an active status). See the relevant endpoints here: TOTP Register and Biometrics Register.

Note: You cannot add additional factors onto user's accounts until their primary factor has been verified. See the Email/phone verification status section under Additional Migration Considerations for more information.

Contact us for more information on enterprise grade bulk import support.

Check out the additional migration considerations guide to learn how to move your app logic to Stytch and for more user import guidance.