​

Multi-Factor Authentication

Multi-factor authentication (MFA) enhances security by requiring users to provide two or more verification factors prior to accessing their account, which reduces the likelihood of account compromise.

​

How it works

Stytch supports two different methods of secondary authentication:

1. SMS one-time passcodes (OTPs). OTPs ask users to enter a unique numeric or alphanumeric code sent via SMS to a recognized mobile phone number.
2. Authenticator app time-based one-time passcodes (TOTPs). TOTPs ask users to confirm control of their device within a certain time frame using a passcode generated by a smartphone app like Authy or Google Authenticator.

Stytch handles:

• Enforced enrollment in MFA based on the Organization’s MFA policy, which determines whether MFA is optional or required and which methods are allowed.
• Optional enrollment in MFA, even if Organization does not require it.
• Enforcing that MFA requirements for the Member and Organization have been met prior to a Stytch session being issued.

​

OTP considerations

​

Cost

When using Stytch’s SMS OTP product, OTPs to end users in the United States and Canada are included in your Stytch plan at no additional cost. For international OTPs, Stytch will charge you the same amount that we are charged by our SMS providers with no upcharge. You can see the pricing for each country by visiting Twilio’s pricing page. This is important to keep in mind as you plan costs and which countries you want to support as pricing can vary significantly by country.

​

Country code allowlist

By default, a Stytch project will have only the United States (US) and Canada (CA) enabled for SMS OTP sends. To enable SMS OTP sends to other allowed countries, you can add the country to your country code allowlist in the Stytch Dashboard or via the country_code_allowlist endpoint. Stytch does not support sending SMS passcodes to the following countries. If you attempt to add a country listed below to your country code allowlist, the API will return an country_code_allowlist_invalid_country_codes error.

---

Adaptive MFA with remembered devices

Learn how to use Stytch’s Device Fingerprinting (DFP) product to implement a remembered device flow, a form of adaptive MFA, to trigger MFA only on unrecognized logins.