Authenticate

import { useEffect } from 'react';
import { useStytch, useStytchSession } from '@stytch/react';

export const Authenticate = () => {
const stytch = useStytch();
const { session } = useStytchSession();

useEffect(() => {
  if (session) {
    window.location.href = '${exampleURL}/profile';
  } else {
    stytch.authenticateByUrl({
      session_duration_minutes: 60,
    });
  }
}, [stytch, session]);

return <div>Loading</div>;
};

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
    "session_jwt": "eyJ...",
    "session": {...},
    "provider_subject": "10769150350006150715113082367",
    "provider_type": "Google"
}

{
  "status_code": 401,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "unable_to_auth_oauth_token",
  "error_message": "OAuth request could not be authenticated.",
  "error_url": "https://stytch.com/docs/api/errors/401"
}

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "oauth_token_not_found",
  "error_message": "OAuth token could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

import { useEffect } from 'react';
import { useStytch, useStytchSession } from '@stytch/react';

export const Authenticate = () => {
const stytch = useStytch();
const { session } = useStytchSession();

useEffect(() => {
  if (session) {
    window.location.href = '${exampleURL}/profile';
  } else {
    stytch.authenticateByUrl({
      session_duration_minutes: 60,
    });
  }
}, [stytch, session]);

return <div>Loading</div>;
};

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
    "session_jwt": "eyJ...",
    "session": {...},
    "provider_subject": "10769150350006150715113082367",
    "provider_type": "Google"
}

{
  "status_code": 401,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "unable_to_auth_oauth_token",
  "error_message": "OAuth request could not be authenticated.",
  "error_url": "https://stytch.com/docs/api/errors/401"
}

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "oauth_token_not_found",
  "error_message": "OAuth token could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

import { useEffect } from 'react';
import { useStytch, useStytchSession } from '@stytch/react';

export const Authenticate = () => {
const stytch = useStytch();
const { session } = useStytchSession();

useEffect(() => {
  if (session) {
    window.location.href = '${exampleURL}/profile';
  } else {
    stytch.authenticateByUrl({
      session_duration_minutes: 60,
    });
  }
}, [stytch, session]);

return <div>Loading</div>;
};

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
    "session_jwt": "eyJ...",
    "session": {...},
    "provider_subject": "10769150350006150715113082367",
    "provider_type": "Google"
}

{
  "status_code": 401,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "unable_to_auth_oauth_token",
  "error_message": "OAuth request could not be authenticated.",
  "error_url": "https://stytch.com/docs/api/errors/401"
}

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "oauth_token_not_found",
  "error_message": "OAuth token could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

import { useEffect } from 'react';
import { useStytch, useStytchSession } from '@stytch/react';

export const Authenticate = () => {
const stytch = useStytch();
const { session } = useStytchSession();

useEffect(() => {
  if (session) {
    window.location.href = '${exampleURL}/profile';
  } else {
    stytch.authenticateByUrl({
      session_duration_minutes: 60,
    });
  }
}, [stytch, session]);

return <div>Loading</div>;
};

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
    "session_jwt": "eyJ...",
    "session": {...},
    "provider_subject": "10769150350006150715113082367",
    "provider_type": "Google"
}

{
  "status_code": 401,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "unable_to_auth_oauth_token",
  "error_message": "OAuth request could not be authenticated.",
  "error_url": "https://stytch.com/docs/api/errors/401"
}

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "oauth_token_not_found",
  "error_message": "OAuth token could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

The authenticate method wraps the authenticate OAuth API endpoint which validates the OAuth token passed in. If this method succeeds, the user will be logged in, granted an active session, and the session cookies will be minted and stored in the browser.

Parameters

string

required

The token to authenticate.

object

required

Additional configuration.

Show properties

int

required

Set the session lifetime to be this many minutes from now. This will return both an opaque session_token and session_jwt for this session, which will automatically be stored either in the browser cookies if you’re using our JavaScript SDK, or in the iOS Keychain/ Android SharedPreferences if you’re using one of our mobile SDKs. The session_jwt will have a fixed lifetime of five minutes regardless of the underlying session duration, and will be automatically refreshed by the SDK in the background over time. This value must be a minimum of 5 and may not exceed the maximum session duration minutes value set in the Frontend SDK page of the Stytch Dashboard. A successful authentication will continue to extend the session this many minutes.

Response

string

The unique identifier for the User within a given OAuth provider. Also commonly called the “sub” or “Subject field” in OAuth protocols.

string

Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.

string

required

If available, the profile_picture_url is a url of the user’s profile picture set in OAuth identity the provider that the user has authenticated with, e.g. Facebook profile picture.

string

required

If available, the locale is the user’s locale set in the OAuth identity provider that the user has authenticated with.

object

required

The provider values object.

Show properties

string

required

The access token that you may use to access the user’s data in the provider’s API.

string

required

The ID token returned by the OAuth provider. ID Tokens are JWTs that contain structured information about a user. The exact content of each ID Token varies from provider to provider. ID Tokens are returned from OAuth providers that conform to the [OpenID Connect](https://openid.net/foundation/ OpenID Connect) specification, which is based on OAuth.

string

required

The refresh token that you may use to refresh a user’s session within the provider’s API.

array[string]

required

The OAuth scopes included for a given provider. See each provider’s section above to see which scopes are included by default and how to add custom scopes.

string

required

The timestamp when the access token expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

The unique ID of the affected User.

object

The user object affected by call. See the User object for complete response field details.

Show properties

string

The timestamp of the User’s creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

array[objects]

An array contains a list of all crypto wallets for a given User in the Stytch API.

Show properties

string

The unique ID for a crypto wallet

string

The actual blockchain address of the User’s crypto wallet.

string

The blockchain that the User’s crypto wallet operates on, e.g. Ethereum, Solana, etc.

boolean

If this method has been successfully authenticated by the User.

array[objects]

An array of email objects for the User.

Show properties

string

The unique ID of a specific email address.

string

The email address.

boolean

If this method has been successfully authenticated by the User.

object

The name of the User. Each field in the name object is optional.

Show properties

string

The first name of the user.

string

The middle name(s) of the user.

string

The last name of the user.

object

The trusted_metadata field contains an arbitrary JSON object of application-specific data. See the Metadata reference for complete field behavior details.

object

The untrusted_metadata field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and cannot be used to store critical information. See the Metadata reference for complete field behavior details.

array[objects]

An array of phone number objects linked to the User.

Show properties

string

The unique ID for the phone number.

string

The phone number.

boolean

If this method has been successfully authenticated by the User.

array[objects]

An array of OAuth provider objects linked to the User.

Show properties

string

The unique ID for an OAuth registration.

string

The unique identifier for the User within a given OAuth provider. Also commonly called the “sub” or “Subject field” in OAuth protocols.

string

Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.

string

If available, the profile_picture_url is a url of the User’s profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture.

string

If available, the locale is the User’s locale set in the OAuth identity provider that the user has authenticated with.

object

The password object is returned for users with a password.

Show properties

string

The unique ID of a specific password

boolean

Indicates whether this password requires a password reset

string

The status of the User. The possible values are pending and active.

array[objects]

An array containing a list of all TOTP instances for a given User in the Stytch API.

Show properties

string

The unique ID for a TOTP instance.

boolean

If this method has been successfully authenticated by the User.

string

The unique ID of the affected User.

array[objects]

An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API.

Show properties

string

The unique ID for the Passkey or WebAuthn registration.

string

The domain on which Passkey or WebAuthn registration was started. This will be the domain of your app.

string

The user agent of the User.

string

The authenticator_type string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are “platform” and “cross-platform”. If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference.

boolean

If this method has been successfully authenticated by the User.

string

The name of the Passkey or WebAuthn registration.

array[objects]

An array that contains a list of all biometric registrations for a given User in the Stytch API.

Show properties

string

The unique ID for a biometric registration.

boolean

If this method has been successfully authenticated by the User.

array[strings]

Roles assigned to this User. See the RBAC guide for more information about role assignment.

string

A secret token for a given Stytch Session.

string

The JSON Web Token (JWT) for a given Stytch Session.

object

If you initiate a Session, by including session_duration_minutes in your authenticate call, you’ll receive a full Session object in the response. See Session object for complete response fields.

Show properties

string

A unique identifier for a specific Session.

string

The unique ID of the affected User.

array[objects]

An array of different authentication factors that comprise a Session.

string

The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

object

Provided attributes help with fraud detection.

Show properties

string

The IP address of the user.

string

The user agent of the User.

map

The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.

array[string]

A list of the roles associated with the session.

object

If Protected Auth is enabled and returned fingerprinting results, the user_device response field will contain information about the user’s device attributes.

Show properties

string

The IP address of the user’s device.

object

Information about the ip_address.

Show properties

boolean

Whether this ip_address has been seen before for this user.

string

When this ip_address was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

When this ip_address was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

The country code where the IP address is located.

object

Information about the ip_geo_country.

Show properties

boolean

Whether this ip_geo_country has been seen before for this user.

string

When this ip_geo_country was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

When this ip_geo_country was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

string

The city where the IP address is located.

string

The region where the IP address is located.

string

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.

number

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

Pre-built UI

Hooks

Methods

More Resources

Parameters

Response