Stytch

No entries match these filters. Clear filters

1. Product updates and improvements Sep 25, 2026 · release notes

   Stytch adds IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. param forwarding to SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Start API, browser session cookies for Frontend SDK, and new UI expiration configs.

   • The SSO Start API now supports provider_-prefixed parameters in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. flows for forwarding parameters to the IdP.
   • Adds browser session-lifetime cookies for Frontend SDK users with HttpOnly cookies enabled; contact support for access.
   • Connected Apps now supports advertising authorization_response_iss_parameter_supported in the Authorization Server metadata.
   • The B2B prebuilt UI now supports configuring email magic link expiration via the loginExpirationMinutes, signupExpirationMinutes, and discoveryExpirationMinutes parameters.
   • The prebuilt Admin Portal Member Management UI now supports configuring email magic link expiration via the inviteExpirationMinutes parameter.

   +1 more show less

   • Custom claim templates now support OR operators, for example "userID": {{ member.external_id || member.member_id }}.

   6 details in Everything

2. New languages for SMS and WhatsApp OTP messages Jun 10, 2026 · release notes

   Adds locale parameter to SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and WhatsApp OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. API for Japanese, Russian, Dutch, Polish, Turkish, Persian, Vietnamese, and Czech languages

   • locale API parameter now accepts ja, ru, nl, pl, tr, fa, vi, and cs to set the language of SMS/WhatsApp OTP messages

   1 detail in Everything

3. 2026.01.16 | Email Risk beta & update to Event Log Streaming (2026-01-16) Jan 16, 2026 · release notes

   Stytch adds Email Risk beta API for fraud detection and updates Event Log Streaming to remove Start events and add frontend SDK Error events

   • Adds Check Email Risk beta API endpoint returning ALLOW, BLOCK, or CHALLENGE actions based on email domain signals
   • Updates Event Log Streaming to remove duplicate Start events from the log stream starting 2026-01-30
   • Updates Event Log Streaming to include previously missing frontend SDK Error events in the log stream

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Start event type is removed from Event Log Streaming; monitoring/alerting using this event must switch to Success or Error events
4. 2026.01.16 | Email Risk beta & update to Event Log Streaming Jan 16, 2026 · release notes

   Introduces the Email Risk API beta and announces frontend SDK error events in Event Log Streaming beginning January 30, 2026.

   • Adds the Check Email Risk beta API (https://stytch.com/docs/fraud/api/check-email-risk) to return ALLOW, BLOCK, or CHALLENGE actions and risk scores for email addresses. Contact the fraud team for beta access.
   • Announces that Event Log Streaming will include frontend SDK error events beginning January 30, 2026.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removing Start events from the Event Log stream starting 2026-01-30 means API events will no longer generate duplicate Start records; alerting or monitoring relying on Start events must be updated to use Success or Error events instead.
5. 2025.11.07 | SSO Migration Gateway (beta) (2025-11-07) Nov 7, 2025 · release notes

   Stytch introduces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Migration Gateway (beta) to route SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. callbacks between legacy auth and Stytch with no downtime.

   └──▷ HOW TO FIND IT
   Migrate SSO connections to Stytch without downtime by routing traffic through the new gateway.
   📍Update your login domain DNS records to point to the provisioned SSO Migration Gateway endpoint, then enable Allow gateway processing for specific connections in the Stytch dashboard.
6. 2025.10.17 | Client ID Metadata Documents (CIMD) (2025-10-17) Oct 17, 2025 · release notes

   Adds Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.) support for Connected Apps to enable automatic client discovery and registration.

   └──▷ HOW TO FIND IT
   Turn on CIMD discovery and registration through the Stytch dashboard interface.
   📍In the Stytch Dashboard, navigate to your Connected App settings and toggle Enable CIMD discovery and registration.
   • Enables CIMD discovery and registration for Stytch Connected Apps via dashboard or Terraform modules.

   1 detail in Everything

7. 2025.10.17 | Client ID Metadata Documents (CIMD) Oct 17, 2025 · release notes

   Adds Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.) support for OAuth client discovery and registration

   • Enables CIMD discovery and registration directly in the Stytch Connected Apps dashboard.

   1 detail in Everything

8. 2025.09.09 | Stytch Connected Apps for existing auth systems (2025-09-09) Sep 9, 2025 · release notes

   Stytch Connected Apps now supports integration with existing external authentication systems via OAuth

   • Adds support for Connected Apps that function as identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for any existing authentication system, not just Stytch core auth

   1 detail in Everything

9. 2025.09.09 | Stytch Connected Apps for existing auth systems Sep 9, 2025 · release notes

   Stytch Connected Apps now supports existing auth systems for OAuth and agent workflows

   • Adds support for using any existing authentication system as the core identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Stytch Connected Apps
   • Enables issuing OAuth tokens for cross-app and AI agent + MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. interactions without migrating auth stacks
   • Provides consent UI with full lifecycle management and org-level policy controls for non-Stytch auth backends

   3 details in Everything

10. 2025.09.05 | Stytch Datadog integration (2025-09-05) Sep 5, 2025 · release notes

    Stytch adds a first-party Datadog integration for Event Log Streaming with one-click dashboard setup

    • Adds first-party Stytch Datadog integration to stream API events into observability

    1 detail in Everything

11. 2025.09.05 | Stytch Datadog integration Sep 5, 2025 · release notes

    Stytch adds first-party Datadog integration for Event Log Streaming with one-click dashboard

12. 2025.08.29 | Stytch PHP SDK, user device history (2025-08-29) Aug 29, 2025 · release notes

    Stytch PHP SDK GA with B2B auth headers and User Device History

    └──▷ USE IT
    Install the new Stytch PHP SDK via Composer to start building auth flows.
    shell copy

    composer require stytch/stytch-php

    • Enables User Device History integration by allowing passing of a Telemetry ID to authentication endpoints for new device notifications.

    1 detail in Everything

13. 2025.08.29 | Stytch PHP SDK, user device history Aug 29, 2025 · release notes

    Stytch PHP SDK release and User Device History for B2B/Consumer auth

    └──▷ TRY IT
    Install the new PHP SDK via Composer to start building auth flows.
    copy

    $ composer require stytch/stytch-php

    • Adds the stytch/stytch-php Composer package for building authentication flows in PHP ecosystems including Laravel, Symfony, or WordPress
    • Introduces MethodOptions to set custom headers like X-Stytch-Member-Session in B2B Authorization settings
    • Enables User Device History recording powered by Stytch Device Fingerprinting for known device tracking and adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. triggers

    3 details in Everything

14. 2025.08.15 | Standalone SSO refresh, consumer RBAC + custom scopes, copy env configs (2025-08-15) Aug 15, 2025 · release notes

    Stytch adds external ID support to standalone SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. API, copy env configs in Dashboard, and consumer RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with custom scopes

    └──▷ HOW TO FIND IT
    Configure RBAC roles and scopes for a consumer app in the dashboard.
    📍Dashboard › Management › RBAC Policies
    • Accepts external_id in Stytch SSO APIs to map unique identifiers from other sources for standalone modules.
    • Allows copying configurations across environments via the top-level environment switcher or Copy from button on config pages.
    • Supports RBAC policies and custom scopes for consumer applications, requiring explicit assignment of roles and resources.

    3 details in Everything

15. 2025.08.15 | Standalone SSO refresh, consumer RBAC + custom scopes, copy env con Aug 15, 2025 · release notes

    Stytch adds standalone SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. external IDs, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./copy-env via Dashboard UI, and consumer custom scopes

    • Adds support for external organization IDs in Stytch SSO APIs for standalone SSO alongside an existing authentication system.
    • Enables copying configurations across environments in the Stytch Dashboard
    • Introduces RBAC policies and custom scopes for consumer applications

    3 details in Everything

16. SAML Shield: open source protection for SAML CVEs (2025-08-06) Aug 6, 2025 · release notes

    Stytch launches open-source SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Shield to detect SAML protocol vulnerabilities like XML signature wrapping before they reach your app.

    • Launches SAML Shield, a new protocol-level validator that inspects incoming SAML responses using a hardened ruleset to detect threats such as XML signature wrapping, replay attacks, and entity injection.
    • Adds integration via a managed backend (with automatic rule updates within 24 hours of CVE drops), a proxy mode for applications you do not control, and an open-source Node.js library for local validation.

    2 details in Everything

17. 2025.08.01 | isAgent, MCP & AI Agents panel, redirect URL in dashboard (2025-08-01) Aug 1, 2025 · release notes

    New isAgent NPM package and panel for detecting agentic traffic; Dashboard redirect URL management.

    └──▷ HOW TO FIND IT
    Access the new redirect URL settings in the Stytch Dashboard.
    📍Go to https://stytch.com/dashboard/redirect-urls or Configuration › Redirect URLs tab.
    • Adds the @stytch/is-agent npm package with an isAgent() function returning is_agent_client_hint and identity, plus a React <IsAgent> component to detect and handle programmatic/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. traffic
    • Adds Dashboard navigation to Configuration > Redirect URLs tab at /dashboard/redirect-urls to update and assign defaults for project redirect URLs

    2 details in Everything

18. 2025.08.01 | isAgent, MCP & AI Agents panel, redirect URL in dashboard Aug 1, 2025 · release notes

    New isAgent NPM package for AI traffic detection, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. panel event, and dashboard redirect URL editor

    └──▷ HOW TO FIND IT
    Use the new package to conditionally render content for AI agents like ChatGPT.
    📍<IsAgent> <p>Hello, agent!</p> </IsAgent>
    • Adds @stytch/is-agent NPM package with JavaScript/React support to detect agentic traffic via is_agent_client_hint and identity fields This is not a security measure: attackers can modify browser responses.
    • Enables editing and assigning default project redirect URLs in the Dashboard under Configuration > Redirect URLs tab or /dashboard/redirect-urls path

    2 details in Everything

19. 2025.07.25 | Self serve event log streaming, member email updates, and country code allowlists (2025-07-25) Jul 25, 2025 · release notes

    Self-serve event log streaming setup, member-initiated email updates, and country code allowlists for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp.

    └──▷ TRY IT
    Enable self-serve email updates by calling the new endpoint during member onboarding flow.
    copy

    $ CALL Start a self-serve email update endpoint
    // Requires: active member, stytch.[self|member].update.info.email RBAC permission
    // Member must click magic link within 5 minutes

    Configure country code allowlists via Terraform to restrict SMS/WhatsApp outbound traffic.
    hcl copy

    # In Terraform provider config
    data "stytch_workspace" "current" {}
    resource "stytch_country_code_allowlist" "sms_wa" {
      workspace_id = data.stytch_workspace.current.id
      codes        = ["US", "GB"] # Only allow these countries
    }

    Navigate the dashboard to set up event log streaming destinations.
    📍In the Stytch Dashboard, go to Activity → Stream Settings and select Datadog or Grafana Loki as a destination.
    • Adds Activity → Stream Settings in the dashboard to self-serve configure event log streaming to Datadog or Grafana Loki without support contact.
    • Adds a Start a self-serve email update endpoint allowing members to change their own email via magic link with 5-minute reservation.
    • Adds per-project country code allowlists for SMS and WhatsApp traffic to block toll fraud, configurable via Dashboard, Terraform, or Programmatic Workspace Actions.

    3 details in Everything

20. 2025.07.25 | Self serve event log streaming, member email updates, and country c Jul 25, 2025 · release notes

    Stytch adds self-serve event log streaming via dashboard/API, member email update flow, and country code allowlists for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp.

    • Adds manual setup of event log streaming in the Activity → Stream Settings dashboard view to send logs to Datadog or Grafana Loki without support assistance.
    • Adds the ability for members to update their own email addresses via a self-serve flow using email magic links, controlled by the stytch.[self|member].update.info.email RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission.
    • Adds per-project country code allowlists for SMS and WhatsApp traffic to restrict outbound messages to specific countries, configurable via dashboard, Terraform, or Programmatic Workspace Actions.

    3 details in Everything

21. 2025.07.18 | Trusted Auth Tokens, text customization, fingerprinting improvements (2025-07-18) Jul 18, 2025 · release notes

    Stytch adds Trusted Auth Tokens via /sessions/attest, full text customization in Auth SDKs, and fingerprinting improvements.

    • Adds Trusted Auth Tokens capability to exchange any trusted JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. into a Stytch session
    • Adds the /sessions/attest endpoint for attesting external JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.
    • Adds strings prop support for full text customization in B2B and Consumer Auth SDKs (JS, Android, iOS)
    • Uses node_modules/@stytch/vanilla-js/messages/b2b/en.po and node_modules/@stytch/vanilla-js/messages/en.po as default text catalogs for overriding strings

    4 details in Everything

22. 2025.07.18 | Trusted Auth Tokens, text customization, fingerprinting improvement Jul 18, 2025 · release notes

    Stytch 2025.07.18 introduces Trusted Auth Tokens to extend sessions from third-party JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. and allows comprehensive text customization in JS/Android/iOS Auth SDKs.

23. 2025.07.10 | Stytch MCP Server (2025-07-10) Jul 10, 2025 · release notes

    Launch of official Stytch MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for programmatic agent configuration

    • Adds the Stytch MCP Server at mcp.stytch.dev to allow AI agents and developers to configure Stytch projects programmatically

    1 detail in Everything

24. 2025.07.10 | Stytch MCP Server Jul 10, 2025 · release notes

    Official Stytch MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. launch enables programmatic project configuration via AI agents

    • Launches the official Stytch Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server for programmatic automation of Stych projects, redirect URLs, and email templates.
    • Enables AI agents to configure Stytch assets programmatically using OAuth-based agent authorization, replacing dashboard clicks.

    2 details in Everything

25. 2025.06.27 | Stytch Dashboard refresh (2025-06-27) Jun 27, 2025 · release notes

    Stytch dashboard refresh introduces quick search (⌘K/Ctrl+K), unified Activity tab for logs, and reorganized workspace settings.

    └──▷ HOW TO FIND IT
    Rapidly find a specific setting or copy an environment ID without clicking through multiple menus.
    📍Press Ctrl+K (or ⌘K on Mac) to open the quick search bar
    • Adds keyboard shortcut ⌘K / Ctrl+K for quick search to find settings, products, project details, or copy IDs
    • Unifies Event Logs and Device Fingerprinting Logs under the new Activity tab in left-hand navigation
    • Relocates workspace settings (team, billing, project configurations) to a dedicated new page

    3 details in Everything

26. 2025.06.27 | Stytch Dashboard refresh Jun 27, 2025 · release notes

    Stytch dashboard refresh introduces global ⌘K/Ctrl+K search and unified Activity tab for logs.

    • Adds ⌘K / Ctrl+K keyboard shortcut to the dashboard to quickly find settings, products, project details, or copy IDs

    1 detail in Everything

27. 2025.06.20 | Improved user locking configuration, device fingerprinting verdict reason overrides (2025-06-20) Jun 20, 2025 · release notes

    New dashboard UI for user lockout thresholds and API overrides for fraud verdict reasons

    └──▷ HOW TO FIND IT
    Configure custom lockout limits directly via the dashboard UI to adjust how repeat failed login attempts are handled.
    📍In the Stytch Dashboard, navigate to Basic settings and update the new user locking thresholds.
    • Adds dashboard configuration for fine-tuned user locking thresholds in the Basic settings section with new default values

    1 detail in Everything

28. 2025.06.20 | Improved user locking configuration, device fingerprinting verdict Jun 20, 2025 · release notes

    Adds user-level lockout configuration in dashboard and fraud verdict reason overrides via API

    • Adds ability to override default actions for specific device fingerprinting verdict reasons (e.g. VIRTUAL_MACHINE) via API or backend SDKs

    1 detail in Everything

29. 2025.06.17 | Connected Apps: Organization App Policies and consent management (2025-06-17) Jun 17, 2025 · release notes

    Adds organization-level app policies allowing admins to manage, revoke, and allowlist connected third-party apps.

    └──▷ HOW TO FIND IT
    Manage connected app permissions for your organization via the dashboard.
    📍In the Stytch Dashboard, navigate to Connected Apps and use the new controls to revoke access or manage allowlists.
    • Enables IT administrators to view all authorized third-party apps and their granted scopes within a Stytch organization.
    • Allows revocation of access to any connected app through the dashboard or API.
    • Supports enforcing an allowlist to restrict which apps members can connect with.

    3 details in Everything

30. 2025.06.17 | Connected Apps: Organization App Policies and consent management Jun 17, 2025 · release notes

    Stytch adds organization-level app policies allowing admins to view grants, revoke access via API or dashboard, and enforce allowlists.

    • Adds ability to view all authorized third-party apps and their granted scopes for Stytch organization members
    • Enables admins to revoke access to a connected app through the dashboard or API.
    • Introduces an allowlist enforcement feature to restrict which apps members can connect with

    3 details in Everything

31. Hackathon Projects | Stytch Component Playground: A live UI builder for your nex May 23, 2025 · release notes

    Stytch introduces a live UI builder to help developers create and export custom login flow configurations quickly.

    • Adds Component Playground, a browser-based builder to theme, preview, and copy production-ready UI configuration.

    1 detail in Everything

32. Hackathon Projects | Unified mobile biometrics: ship faster, support everyone May 22, 2025 · release notes

    Stytch pre-built mobile UI now includes native Touch ID, Face ID, and Android Biometric Prompt support.

33. Hackathon Projects | Stytch CLI and Connected Apps in the command line May 19, 2025 · release notes

    Release of the Stytch CLI tool for managing authentication projects from the terminal.

    • Releases the stytch CLI tool (available via npm or go install) to run Stytch API commands directly in the terminal.

    1 detail in Everything

34. 2025.04.25 | Manage SCIM connections in the Stytch Dashboard Apr 25, 2025 · release notes

    New dashboard UI for managing SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. connections directly in the Stytch admin interface

35. 2025.04.11 | Connected Apps for Remote MCP Servers & Webhooks for Consumer Auth Apr 11, 2025 · release notes

    New support for Connected Apps on remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and webhooks for Consumer Auth user mutations

    • Adds Stytch Connected Apps support for authorization of Remote Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) servers
    • Adds webhook event types for user creation, updates, and deletion in the Consumer Auth platform
    • Adds a webhooks tab in the Stytch dashboard side navigation to configure webhook URLs and event types

    3 details in Everything

36. 2025.04.04 | External IDs Apr 4, 2025 · release notes

    New External IDs feature allows referencing users and members with custom identifiers instead of UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.

    └──▷ USE IT
    Create a new user with a custom external ID during migration or initial setup
    shell copy

    curl -s -X POST https://api.stytch.com/v1/users \
      -H "Content-Type: application/json" \
      -u "$project:$secret" \
      -d '{
      "email": "hello@stytch.example.com",
      "external_id": "my-cool-user"
    }'

    Retrieve a user directly using their custom external ID in the path parameter
    shell copy

    curl -s -X GET https://api.stytch.com/v1/users/my-cool-user \
      -H "Content-Type: application/json" \
      -u "$project:$secret"

    Create a member for an organization using both the org slug and custom external ID
    shell copy

    curl -s -X POST https://api.stytch.com/v1/b2b/organizations/my-org-slug/members \
      -H "Content-Type: application/json" \
      -u "$project:$secret" \
      -d '{
      "email_address": "hello@stytch.example.com",
      "external_id": "my-cool-member"
    }'

    • Adds external_id parameter to CreateUser, CreateMember, PasswordMigrate, UpdateUser, and UpdateMember endpoints
    • Allows using external IDs in path parameters for GET /v1/users/<external_id> and GET /v1/b2b/organizations/<slug>/member endpoints
    • Enables external IDs in user_ids/member_ids search filters for UserSearch and MemberSearch endpoints

    3 details in Everything

37. 2025.03.28 | CNAME Improvements for Test Environments Mar 28, 2025 · release notes

    Custom CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. support in Stytch test environments via Project Settings.

    • Adds full support for custom CNAMEs in test environments

    1 detail in Everything

38. 2025.03.07 | Improved Device Fingerprinting Dashboard Mar 7, 2025 · release notes

    Stytch adds rule impact testing and expanded identifiers (ip_address, country_code, asn) to Device Fingerprinting

    • Adds Rule Impact Testing to the Device Fingerprinting dashboard to compare potential verdict actions over the past 7 days before deploying a rule
    • Expands Device Fingerprinting rule identifiers to include ip_address, country_code, and asn alongside existing options
    • Adds Identifier Context view in the dashboard showing how many fingerprints share a particular identifier

    3 details in Everything

39. Launch Week | Admin Portal: Self-Serve Management for Organizations and Enterpri Feb 20, 2025 · release notes

    Stytch launches embeddable Admin Portal components for self-serve org and enterprise auth management

    └──▷ USE IT
    Import the new self-serve management components in a React application.
    code copy

    import {
      AdminPortalSSO,
      AdminPortalOrgSettings,
      AdminPortalMemberManagement,
      AdminPortalSCIM
    } from '@stytch/react/b2b/adminPortal';

    • Adds AdminPortalSSO, AdminPortalOrgSettings, AdminPortalMemberManagement, and AdminPortalSCIM components to the @stytch/react/b2b/adminPortal module

    1 detail in Everything

40. Launch Week | Connected Apps: Make Any App an OAuth Provider for Integrations an Feb 19, 2025 · release notes

    Stytch introduces Connected Apps to make any app an OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via dashboard and SDK

    • Introduces Connected Apps feature allowing applications to act as compliant OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0/OIDC Identity Providers
    • Adds ability to configure Client types, Custom scopes, Custom claims, Secret rotation, PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier., and Redirect URLs for Connected Apps
    • Enables issuing access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., transferring authentication state, and authenticating AI agents via the new Connected Apps integration

    3 details in Everything

41. Launch Week | Fraud & Risk Prevention: Intelligent Rate Limiting, Real-Time Moni Feb 18, 2025 · release notes

    Stytch adds live traffic charts to fraud dashboard, filters event logs without telemetry IDs, and enables SDK support for Fraud & Risk Prevention

    • Adds dashboard live chart view with filters for verdict actions, reasons, and detected device types to visualize traffic health
    • Upgrades event_log filtering to allow navigation by time frame or parameters without requiring a specific telemetry ID
    • Enables dashboard-based rule creation from existing fingerprints, allowing selection of action and expiration directly in the UI
    • Improves Intelligent Rate Limiting (IntRL) precision for low-volume fraudulent traffic detection via refined internal sub-signals
    • Extends Fraud and Risk Prevention endpoints to backend SDKs for Node, Go, Python, Ruby, Kotlin, Java, and Rust

    5 details in Everything

42. 2024.12.20 | Programmatic Workspace Actions & Terraform Dec 20, 2024 · release notes

    Stytch adds Programmatic Workspace Actions API and open beta Terraform provider for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. management

    • Adds Programmatic Workspace Actions through the Management API or Go SDK to create projects, configure SDK settings, manage public tokens and secrets, define RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. policies, set redirect URLs, and update email templates.
    • Launches open beta Stytch Terraform Provider for provisioning and automating Stytch projects via declarative Infrastructure-as-Code

    2 details in Everything

43. 2024.12.13 | Email OTP & Cross-Org Passwords Dec 13, 2024 · release notes

    Adds Email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. and Cross-Org Passwords as new B2B authentication methods.

    • Adds Email One-Time Passcodes (OTP) as a primary authentication method for B2B organizations, enabling verification of email ownership via one-time passcodes sent to the user's email.
    • Adds Cross-Organization Passwords support, allowing users to log in to all their organizations with a single shared password and supporting organization-specific logins and discovery flows. Enabling this requires a project with no active members who already have passwords.

    2 details in Everything

44. 2024.12.06 | DFP External Metadata & React Native Pre-Built UI Dec 6, 2024 · release notes

    Adds external_metadata field to DFP API and B2B pre-built UI components for React Native SDK

    • Adds external_metadata field to the Device Fingerprinting API's Fingerprint Lookup endpoint to associate user data with Stych fingerprints.
    • Enables searchable metadata in the DFP analytics Dashboard, allowing searches by external metadata fields.
    • Auto-populates the external_metadata field for DFP Protected Auth integrations via the Stytch SDK.
    • Adds a suite of B2B pre-built UI components (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., Passwords, Email Magic Links, OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip., Discovery) to the React Native SDK.

    4 details in Everything

45. 2024.11.08 | GitHub OAuth & B2B Sandbox Values Nov 8, 2024 · release notes

    Adds GitHub as a B2B OAuth provider with JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning and B2B sandbox test values

    • Enables GitHub as an official OAuth provider for B2B authentication, supporting Just-in-Time (JIT) Provisioning and Discovery.
    • Adds sandbox values to the B2B API, including sandbox@stytch.com email and sample organization IDs for testing in the Test environment.

    2 details in Everything

46. 2024.10.25 | Improved SSO Connections Oct 25, 2024 · release notes

    Adds External SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Connections for multi-org sharing and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. custom scopes, attribute mapping to trusted_metadata, and auto token refresh

    • Adds External SSO Connections enabling a single SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDC connection to authenticate across multiple organizations
    • Adds custom OIDC scopes configurable per connection or through query parameters.
    • Adds attribute mapping for OIDC connections to propagate values into the member's trusted_metadata field
    • Adds automatic refresh of OIDC access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.

    4 details in Everything

47. 2024.10.11 | Stytch SSO login Oct 11, 2024 · release notes

    Stytch dashboard now supports SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login for all accounts with self-serve configuration via Workspace Settings.

    • Adds SSO login to stytch.com for all account tiers, including Free, allowing developers to log in via SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..

    1 detail in Everything

48. 2024.09.18 | Stytch Fraud & Risk Prevention Sep 18, 2024 · release notes

    Stytch launches Fraud & Risk Prevention with intelligent rate limiting, a configurable rules engine (Allow/Challenge/Block), and ML-powered device detection via API.

    • Adds intelligent rate limiting driven by predictive analysis of device, user, and traffic sub-signals to detect unusual traffic volumes and adapt to new attacker profiles in real-time without restricting legitimate users.
    • Introduces a Security Rules Engine that allows programmatic configuration of Allow, Challenge, or Block verdicts via API or Dashboard for bespoke access rules.
    • Deploys an ML-powered device detection model that programmatically assesses the risk of new or spoofed browser types by comparing them against historical version data.
    • Provides a cloneable example app on GitHub demonstrating Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. implementation using Stytch's Device Fingerprinting to enforce MFA only for unrecognized devices.

    4 details in Everything

49. 2024.09.13 | Slack and HubSpot OAuth Sep 13, 2024 · release notes

    Adds Slack and HubSpot as OAuth providers with JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning and email verification capabilities

    • Adds support for Slack and HubSpot OAuth providers alongside Google and Microsoft
    • Introduces email_verification step to challenge users when OAuth providers do not guarantee verified emails
    • Enables JIT provisioning by OAuth tenant, allowing bypass of email verification for specific tenants

    3 details in Everything

50. 2024.09.06 | SCIM Groups & SCIM Admin Portal Sep 6, 2024 · release notes

    Stytch adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Groups support and a new Admin Portal UI for managing SCIM connections

    • Adds scim_group_implicit_role_assignments field to SCIM Connection config to automate role assignment from IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups
    • Adds SCIM configuration and management interface in the Stytch Admin Portal for creating, deleting, and rotating tokens

    2 details in Everything

51. 2024.08.30 | New Dashboard roles & SMS autofill Aug 30, 2024 · release notes

    New templated dashboard roles and SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. autofill for OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. login across mobile SDKs

    • Adds templated user roles (admins, developers, support agents) in Workspace settings for simpler permission management
    • Enables automatic Stytch role assignments based on email domains for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. Provisioning workflows
    • Adds SMS autofill for OTP login in pre-built UI components across iOS, Android, and React Native SDKs

    3 details in Everything

52. 2024.08.23 | Sign-in With Ethereum (SIWE) & FE SDK updates Aug 23, 2024 · release notes

    Adds Sign-In With Ethereum (SIWE) support and ability to unlink retired emails; major FE SDK updates.

    • Adds Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. support for Sign-In With Ethereum (SIWE) including domain-binding via EIP-4361
    • Enables viewing and unlinking retired email addresses for B2B Auth members

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Frontend SDKs v5.0.0+ (vanilla-js), v21.0.0+ (nextjs), and v19.0.0+ (react) redirect API traffic to api.stytch.com and test.stytch.com, requiring CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. updates if previously targeting web.stytch.com
53. 2024.08.09 | Admin Portal UI for B2B Auth Aug 9, 2024 · release notes

    Stytch introduces Admin Portal UI components for self-service B2B identity management and zero-downtime session migration.

    • Adds Admin Portal UI components to the B2B frontend JS SDKs for embedded organization identity management
    • Enables zero down-time session migration from non-Stytch providers like Auth0 in Consumer Auth projects

    2 details in Everything

54. 2024.07.19 | Dashboard updates and email reactivation Jul 19, 2024 · release notes

    Dashboard adds guided setup walkthrough for frontend/backend projects and self-serve email reactivation for hard bounces.

    • Adds a guided walkthrough when creating a new Stytch Project to help developers choose between frontend or backend integration and run an example app in three steps
    • Enables developers to reactivate inactive email addresses directly in the Dashboard after resolving the cause of a hard bounce, removing the need to contact support

    2 details in Everything

55. 2024.04.30 | Major updates to Stytch B2B Auth (& livestream on Thursday!) Apr 30, 2024 · release notes

    Stytch adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. sync, Google One-Tap for B2B, and pre-built OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. UIs

    • Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) authorization to the B2B Auth solution
    • Adds System for cross-domain identity management via SCIM / directory sync
    • Adds Google one-tap authentication support specifically for B2B tenants
    • Adds pre-built UI components for OTP and TOTP multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
    • Adds protected Email Magic Links feature for enhanced security

    +3 more show less

    • Adds zero-downtime session migration capability for B2B users
    • Releases new frontend-focused (pre-built UI) example app for React, Node, Express, and Astro
    • Releases new backend-focused (headless/custom UI) example app for React, Node, Express, and Astro

    8 details in Everything

56. 2024.03.15 | Pre-built UI for MFA & Google FedCM changes Mar 15, 2024 · release notes

    Pre-built UI components for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. flows in B2B SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. frontend SDKs

    • Updates JavaScript SDK to support Google's FedCM API for One Tap login experience.

    1 detail in Everything

57. 2024.03.07 | Webhooks for B2B SaaS Mar 7, 2024 · release notes

    Stytch adds webhook streaming for B2B SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. events on Pro plan and higher

    • Adds webhooks capability to B2B SaaS Authentication platform allowing developers on pro plan or higher to stream Stytch events by providing an endpoint URL.
    • Supports webhook events related to Members, Organizations, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. connections like SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..

    2 details in Everything

58. 2024.02.09 | Pre-built UI for mobile SDKs Feb 9, 2024 · release notes

    Adds themeable pre-built Android and iOS authentication UI flows for the Consumer Authentication platform.

    • For Consumer Authentication: Adds pre-built, themeable UI flows (login, signup) including Email Magic Links, Passwords, OAuth, and One-Time Passcodes to the Android SDK.
    • For Consumer Authentication: Adds pre-built, themeable UI flows with dark/light mode support to the iOS SDK.

    2 details in Everything

59. 2024.01.26 | TOTP and Recovery Codes for MFA Jan 26, 2024 · release notes

    Adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. and Recovery Codes as MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. methods with organization-level enforcement and member enrollment controls

    • Supports totp in the allowed_mfa_methods array for MFA policy enforcement at the Organization level.
    • Enables mfa_enrolled: true and default_mfa_method: "totp" on the Member object to opt in TOTP for individual users.
    • Introduces Recovery Codes generation, fetching, and rotation capabilities for members who lose their TOTP device.

    3 details in Everything

60. 2023.12.22 | Role-Based Access Control Dec 22, 2023 · release notes

    Stytch RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. is now GA for B2B SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. with programmatic role assignment and custom resource creation.

    • General availability of Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for all B2B SaaS Authentication Projects
    • Programmatic role assignment capability allowing developers to map roles to resources via API
    • Dashboard UI support for creating custom resources and assigning roles

    3 details in Everything

61. 2023.12.05 | Passkeys Dec 5, 2023 · release notes

    Stytch launches PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. toolkit with REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints and SDKs for web and mobile

    • Adds REST API endpoints for building passkeys in consumer applications.
    • Adds backend SDK support for Go, Ruby, Python, and Node.js to the Passkeys toolkit.
    • Adds mobile SDKs for Android, iOS, and React Native to the Passkeys toolkit.
    • Adds frontend SDKs for vanilla JavaScript, React, and Next.js to the Passkeys toolkit.
    • Adds pre-built UI components configurable and customizable for passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. flows.

    5 details in Everything

62. 2023.11.10 | OAuth custom parameters Nov 10, 2023 · release notes

    Stytch adds provider_ prefixed custom query parameters to OAuth Start endpoints for identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-specific behavior

    • Adds support for provider_prompt, provider_team, and provider_login_hint as custom query parameters in the /v1/public/oauth/{provider}/start API endpoint
    • Enables forwarding of identity-provider-specific settings (e.g., Google account selection, Slack workspace targeting, Microsoft login hints) via the OAuth Start flow

    2 details in Everything

63. 2023.10.27 | Device Fingerprinting + Auth = Bot Protection Oct 27, 2023 · release notes

    Device Fingerprinting Protected Auth adds telemetry ID generation in SDKs and new BLOCK/ALLOW/TRIGGER_RECAPTCHA actions to API calls.

    • Adds automatic telemetry ID generation in JavaScript, iOS, and Android SDKs for every auth API call when Device Fingerprinting is enabled
    • Checks device fingerprints before authentication to support BLOCK, ALLOW, or TRIGGER_RECAPTCHA decisions.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. outside the US and Canada is disabled by default for workspaces with no usage prior to October 2023; contact support to enable international SMS.
64. 2023.10.13 | Dashboard write actions Oct 13, 2023 · release notes

    New Dashboard features allow managing auth records directly in the UI.

    • Dashboard write actions enable creating, updating, and deleting Organizations, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Connections, Members, and Users.
    • Users can now force password resets and revoke sessions directly from the dashboard.

    2 details in Everything

65. 2023.09.01 | SQX, new demo apps, & new guides Sep 1, 2023 · release notes

    Stytch releases open-source Go SQX db library and new B2B demo apps

    └──▷ USE IT
    Use the new SQX library to query users from a Go application.
    go copy

    func GetUsers(ctx context.Context, filter GetUserFilter) ([]User, error) {
    	return sqx.Read[User](ctx).
    		Select("*").
    		From("users").
    		Where(sqx.ToClause(filter)).
    		All()
    }

    • Opens source SQX, a Go library for flexible database interactions.
    • Provides Authkit.dev interactive SDK builder for B2B login UIs.
    • Provides Survey Amp working SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. web application example using Stytch's SDK.

    3 details in Everything

66. 2023.08.18 | M2M authentication & MFA Aug 18, 2023 · release notes

    Stytch adds M2M authentication for service-to-service access and Organization-level MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. policy controls.

    • Adds M2M Auth API to create clients, retrieve access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., and define permissions with scopes for machine-to-machine communication
    • Adds MFA login support to B2B Authentication API and SDKs with enforcement at Organization-level or Member-level

    2 details in Everything

67. 2023.08.04 | Java SDK & example apps Aug 4, 2023 · release notes

    Stytch releases Java SDK supporting Consumer and B2B Auth platforms with example apps

    • Adds a backend Java SDK supporting Consumer Auth and B2B Auth products.

    1 detail in Everything

68. 2023.07.21 | New Docs, SDK updates, and Yahoo OAuth Jul 21, 2023 · release notes

    Yahoo OAuth identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Consumer authentication and B2B support in React Native SDK

    • Adds Yahoo as an OAuth identity provider for the Consumer authentication platform.
    • Updates React Native SDK to support Stytch’s B2B authentication, enabling member and organization management via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., Email Magic Links, and Discovery flow.
    • Bumps backend SDKs to major/minor versions: Go v9.0.0, Python v7.0.2, Ruby v6.0.0.

    3 details in Everything

69. 2023.07.07 | ISO 27001, Next.js 13 App router Jul 7, 2023 · release notes

    ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 certification, Next.js 13 App router example, and mobile SDK user update methods

    • Achieved ISO/IEC 27001 certification alongside existing SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Type II report
    • Published stytch-nextjs13-example showing usage with Next.js 13 App router for client and server components
    • Added User method to update name and untrusted metadata in stytch-ios and stytch-android SDKs

    3 details in Everything

70. 2023.06.23 | B2B OAuth & password strength configuration Jun 23, 2023 · release notes

    Stytch adds B2B OAuth support with Discovery flow and Dashboard UI for password strength configuration.

    • Adds B2B support for OAuth identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. like Google or Microsoft to authenticate Members into Organizations
    • Supports the OAuth Discovery flow to let end users see all their Organizations by logging in once
    • Adds a Dashboard UI for selecting preset LUDS or zxcvbn password strength policies
    • Enables custom password strength policy creation using LUDS (Lowercase Uppercase Digits Special characters)
    • Adds configuration to require password resets when end users don’t comply with the strength policy

    +1 more show less

    • Adds configuration for password breach detection with HaveIBeenPwned

    6 details in Everything

71. 2023.05.12 release May 12, 2023 · release notes

    Stytch adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. B2B auth to mobile SDKs, Node v7 supports Node 20 with breaking Node 14 removal

    • Adds iOS and Android SDK support for B2B discovery login, passwords, and Single Sign On with SAML and OIDC
    • Provides interactive iOS tutorials for setup, auth integration, and UI rebuilds based on auth status
    • Ships documented Android example app covering B2B/B2C auth, discovery login, biometrics, sessions, and org management
    • Node SDK v7.0.0 adds types export to package.json and supports Node 20

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes support for node v14 (EOL 2023-04-30) in Node SDK v7.0.0
72. 2023.04.28 release Apr 28, 2023 · release notes

    Stytch adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. for B2B SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. custom templates, pre-built UI components, Salesforce OAuth, and default localhost redirect.

    • Adds OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) to the B2B SSO suite
    • Releases pre-built UI components for JavaScript SDKs supporting Email Magic Links, SSO, and Discovery flows
    • Enables JWT custom claim templates to seed JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. with specified data via the Stytch Dashboard
    • Adds Salesforce OAuth support for B2C workflows

    4 details in Everything

73. 2023.04.14 release | New B2B auth products and features Apr 14, 2023 · release notes

    Adds Discovery auth flow and ExchangeSession endpoint for B2B multi-organization management.

    • Adds Discovery auth flow to allow end users to authenticate and select from associated Organizations or create a new one.
    • Adds ExchangeSession endpoint (API) enabling logged-in users to switch between Organizations.

    2 details in Everything

74. 2023.03.24 release Mar 24, 2023 · release notes

    Go SDK v7 accepts context.Context per API route; new UIKit and Vue.js example apps.

    • Adds ctx context.Context argument to every Go SDK API route for request cancellation and timeouts
    • Releases UIKit example app (iOS) with SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., Apple/Google OAuth, Session Management
    • Releases Vue.js example app with Email Magic Links, Google OAuth, Session Management

    3 details in Everything

75. 2023.03.10 release Mar 10, 2023 · release notes

    Stytch v2023.03.10 adds automatic login method enablement for new Frontend SDKs and one-click Live environment config copy.

    • Adds automatic toggling on all login methods when enabling a Frontend SDK for the first time, removing manual selection friction

    1 detail in Everything

76. 2023.03.03 release Mar 3, 2023 · release notes

    Stytch 2023.03.03 adds B2B Organizations/Members via JS/Android/iOS SDKs and Postman collection

    • Adds availableToSubdomains config key to JavaScript SDK v0.10.0 to control subdomain cookie sharing

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !JavaScript SDK v0.10.0 defaults availableToSubdomains to false, breaking apps that relied on cookies being shared with subdomains by default
77. 2023.02.24 release Feb 24, 2023 · release notes

    Stytch adds dashboard event logs, custom password policies, and a B2B example app in 2023.02.24.

    • Adds event logs to the Dashboard for searching Stytch API call activity by request_id, user_id, status, or date range
    • Enables custom password strength policies using zxcvbn or LUDS with HaveIBeenPwned integration
    • Releases a B2B example app available on GitHub and live at stytchb2bdemo.app

    3 details in Everything

78. 2023.02.10 release Feb 10, 2023 · release notes

    New React and Next.js example apps for Email Magic Links, Google OAuth, and Session Management; Brazilian Portuguese localization support.

    • Provides new React and Next.js example apps that implement Email Magic Links, Google OAuth, and Stytch Session Management.
    • Adds Brazilian Portuguese (pt-br) locale support for email templates and SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp templates.

    2 details in Everything

79. 2023.02.03 release Feb 3, 2023 · release notes

    New Dashboard feature: full fidelity JSON view for managing Stytch Users.

80. 2023.01.27 release Jan 27, 2023 · release notes

    Mobile SDKs v0.7.0 add TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. support for iOS and OAuth for Android.

    • iOS SDK v0.7.0 adds Time-based One-time Password (TOTP) support for two-factor authentication flows
    • iOS SDK v0.7.0 adds custom HTML email templates for Magic Links and OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.
    • Android SDK v0.7.0 enables OAuth integration with Google One Tap and third party providers

    3 details in Everything

81. 2023.01.20 release Jan 20, 2023 · release notes

    Stytch adds custom HTML email templates via Dashboard UI and API parameters.

82. 2023.01.13 release Jan 13, 2023 · release notes

    Adds OAuth Attach capability via new API endpoint and SDK methods to link OAuth providers to existing users

    • Adds user_id and OAuth provider parameters to the Attach API endpoint/SDK method for linking OAuth factors to existing Stytch Users
    • Returns an oauth_attach_token to be passed to the OAuth Start endpoint before redirecting the user
    • Simplifies setting redirect URLs in the Dashboard with new documentation on wildcard setups and query param preservation

    3 details in Everything

83. 2023.01.06 release Jan 6, 2023 · release notes

    Stytch Python SDK adds async APIs, typed response objects, IDE documentation, and StytchError responses.

    • Adds asynchronous equivalents of existing synchronous Python SDK methods, using the _async suffix.
    • Returns typed users.CreateResponse (and other <TYPE>Response) objects for both sync and async APIs instead of raw dicts.
    • Provides inline documentation within IDEs via built-in docstrings.
    • Reports Python SDK errors as StytchError responses.

    4 details in Everything

84. 2022.12.16 release Dec 16, 2022 · release notes

    Stytch adds Figma and Snapchat OAuth providers, EVM wallet support, and Python type hints.

    • Adds Figma to the OAuth Login suite for authentication via Figma accounts API support is available now; SDK support is forthcoming.
    • Adds Snapchat to the OAuth Login suite for authentication via Snapchat accounts API support is available now; SDK support is forthcoming.
    • Supports any EVM-compatible wallet by using ethereum as the value for the crypto_wallet_type parameter in the Crypto Wallets product

    3 details in Everything

85. 2022.12.02 release Dec 2, 2022 · release notes

    Stytch adds Custom Email Domains and Twitter/TikTok OAuth providers

    • Adds Custom Email Domain support for sender/reply-to addresses in Email Templates via the Dashboard UI
    • Adds Twitter and TikTok as new OAuth providers to the OAuth Login suite

    2 details in Everything

86. 2022.11.18 release Nov 18, 2022 · release notes

    Stytch 2022.11.18 adds Device Fingerprinting to identify devices and shape auth flows for fraud prevention.

    • Adds Device Fingerprinting capability to generate globally unique IDs and classify device trust levels for fraud prevention.

    1 detail in Everything

87. 2022.11.14 release Nov 14, 2022 · release notes

    Adds 18 degrees of UI customization for Stytch pre-built components and Spanish localization for Email Magic Links via the locale parameter.

    • Pre-built UI styling update enables 18 degrees of customization to match brand fonts, colors, and logos.
    • Stytch Email Magic Links now offer full Spanish versions for email templates when passing locale: es.

    2 details in Everything

88. 2022.11.04 release Nov 4, 2022 · release notes

    Stytch 2022.11.04 adds User Metadata allowing arbitrary JSON on user records via API/SDKs.

    • Adds Create user and Update user endpoints support for trusted_metadata (backend-only write) and untrusted_metadata (frontend/backend readable/writable) fields, storing up to 20 keys and 4KB of JSON data.

    1 detail in Everything

89. 2022.10.28 release Oct 28, 2022 · release notes

    Stytch adds Android SDK 0.5.0 and DELETE /users/oauth/{oauth_user_registration_id} endpoint for removing OAuth registrations.

    • Releases Android SDK 0.5.0 supporting Email Magic Links, OTPs (SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., WhatsApp, email), Passwords, and Session Management
    • Adds DELETE /users/oauth/{oauth_user_registration_id} endpoint to remove an OAuth registration from an existing User
    • Exposes oauth_user_registration_id field on API responses containing a User object

    3 details in Everything

90. Q3 wrap up Oct 24, 2022 · release notes

    Recaps Q3 2022 updates: Stytch ships Native Mobile Biometrics for iOS SDK, Strong CAPTCHA, and custom email domain/CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. support.

    • Quarterly recap: Adds Native Mobile Biometrics to the iOS SDK for smooth mobile login
    • Quarterly recap: Introduces Strong CAPTCHA to mitigate bot farm attacks on applications
    • Quarterly recap: Supports custom CNAMEs and custom email domains for Stytch integration control
    • Quarterly recap: Shrinks JavaScript SDK package size by 96% and improves Lighthouse performance by nearly 30%
    • Quarterly recap: Adds a new NextJS specific package to the JavaScript SDK

    5 details in Everything

91. 2022.10.14 release Oct 14, 2022 · release notes

    Stytch introduces Strong CAPTCHA to prevent authentication fraud.

    • Adds Strong CAPTCHA capability to prevent bot attacks in authentication flows.

    1 detail in Everything

92. 2022.10.10 release Oct 10, 2022 · release notes

    Stytch iOS SDK gains native OAuth support; new JS guides for Passwords.

    • iOS SDK now supports OAuth Logins out of the box
    • JavaScript SDK guides added for React, NextJS, and vanilla JavaScript

    2 details in Everything

93. 2022.09.30 release Sep 30, 2022 · release notes

    Stytch adds native mobile biometrics and SDK Send methods for selective gating.

    • Adds native Mobile Biometric support (FaceID/TouchID) to the iOS SDK
    • Adds Send methods to JavaScript and React Native SDKs for waitlist gating

    2 details in Everything

94. 2022.09.16 release Sep 16, 2022 · release notes

    Stytch adds a new JavaScript SDK with optimized packages for Next.js and React

    • Adds a new JavaScript SDK with package size reduced by over 40% when using pre-built UI components and 96% otherwise.
    • Adds Next.js and React packages to improve support for those frameworks.
    • Adds in-IDE documentation tooltips for methods within the new JavaScript SDK.

    3 details in Everything

95. 2022.09.02 release Sep 2, 2022 · release notes

    Branded Passcodes emails and Create TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. endpoint now returns the full User object.

    • Rolls out branding features to the Passcodes email template

    1 detail in Everything

96. 2022.08.29 release Aug 29, 2022 · release notes

    Stytch adds support for Twitch and Coinbase OAuth providers and custom CNAMEs for OAuth redirect domains.

    • Adds Custom CNAMEs capability for OAuth redirect URLs to brand consent panes

    1 detail in Everything

97. 2022.08.19 release Aug 19, 2022 · release notes

    Stytch adds password reset via existing password/session and a user migration endpoint

    • Adds password reset using an existing password.
    • Adds password reset using an existing session.
    • Adds a migration endpoint to help transition existing users to Stytch.

    3 details in Everything

98. 2022.08.12 release Aug 12, 2022 · release notes

    Stytch adds locale API parameter to Passcodes product for Spanish language support

99. Q2 wrap up Aug 1, 2022 · release notes

    Recaps Q2 2022 updates: Stytch Q2 release adds React Native/iOS SDKs, custom OAuth scopes, email branding, custom session claims, and a new Passwords product.

    • Quarterly recap: Adds React Native SDK to the Stytch tooling for mobile authentication flows
    • Quarterly recap: Adds iOS native SDK to the Stytch tooling for mobile authentication flows
    • Quarterly recap: Supports configuration of custom OAuth scopes when integrating new or existing OAuth providers
    • Quarterly recap: email brand customization.
    • Quarterly recap: Enables setting custom claims in sessions for granular identity attribute passing

    +1 more show less

    • Quarterly recap: Introduces Passwords as a new product category within the Stytch authentication suite

    6 details in Everything

100. 2022.07.22 release Jul 22, 2022 · release notes

     Stytch introduces React Native SDKs and custom session claims via session_custom_claims

     • Launches separate React Native SDKs for Expo managed workflows and bare projects to enable frontend authentication without backend endpoints
     • Adds support for session_custom_claims in authenticate endpoints to attach arbitrary metadata to sessions and associated JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.

     2 details in Everything

101. 2022.07.15 release Jul 15, 2022 · release notes

     Stytch adds Passwords with strength/breach detection, safe account de-duplication, and magic link resets in beta

     • Adds Passwords support allowing users to authenticate with traditional passwords alongside existing methods
     • Adds automated password strength assessment and breach detection via HaveIBeenPwned integration
     • Enables safe account de-duplication across authentication methods so OAuth, magic link, and password logins map to a single underlying user
     • Adds optional integration of a traditional password-reset email OR a password reset powered by Email Magic Links

     4 details in Everything

102. 2022.06.24 release Jun 24, 2022 · release notes

     Stytch adds iOS demo app and headless CAPTCHA for JS SDK

     └──▷ TRY IT
     Quickly inspect or test the iOS SDK implementation without writing code from scratch
     copy

     $ make demo

     • Adds make demo command to the iOS SDK to launch a ready-to-use example app
     • Enables CAPTCHA protection in the JS SDK via new headless methods, configurable in the Dashboard

     2 details in Everything

103. 2022.06.17 release Jun 17, 2022 · release notes

     Stytch adds Passcodes UI component, native iOS SDK with deep links, and email template customization for logos and buttons.

     • Adds Passcodes UI component in the JavaScript SDK to integrate One-Time Passcodes as a second factor or primary login
     • Adds support for native redirect URLs (deep links) via the new iOS SDK for mobile and desktop apps
     • Adds logo insertion and button styling options (border, font, font color) to email templates in the Dashboard

     3 details in Everything

104. 2022.06.10 release Jun 10, 2022 · release notes

     Stytch launches iOS SDK and brings Crypto Wallets out of beta with PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. for email/oauth flows

     • Adds iOS SDK offering native support for Email Magic Links, Passcodes (SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., WhatsApp, Email), and Sessions across iOS, macOS, and tvOS
     • Enables Crypto Wallets authentication out of beta for Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. OAuth-like login experiences
     • Adopts PKCE support in Email Magic Link and OAuth Login flows to enhance security

     3 details in Everything

105. 2022.06.03 release Jun 3, 2022 · release notes

     Google One Tap support for Safari, Vessel crypto wallet integration, and dashboard user ID fields.

     • Adds Google One Tap support for mobile and desktop Safari
     • Integrates Vessel multi-chain wallet into the SDK for Ethereum linking
     • Adds email_id and phone_id fields to User management in the Stytch Dashboard

     3 details in Everything

106. 2022.05.27 release May 27, 2022 · release notes

     Stytch adds Amazon/Bitbucket/LinkedIn OAuth, pre-built Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. UI, expanded User object in auth response, dashboard user deletion, and sandbox OAuth tokens

     • Adds support for Amazon, Bitbucket, and LinkedIn as OAuth social login providers with custom scope configuration
     • Adds pre-built JavaScript UI component for Ethereum and Solana wallet authentication (Web3 Login)
     • Returns full User object (including email addresses and name) directly in the response from any authenticate endpoint without requiring a separate call to /v1/users
     • Adds ability to delete individual users directly within the Stytch Dashboard via User management
     • Makes sandbox tokens available for OAuth Logins product integration testing

     5 details in Everything

107. 2022.05.20 release May 20, 2022 · release notes

     Stytch adds Discord and Slack OAuth providers, exposes stytch_token_type URL param, launches JS SDK workbench on Netlify, and provides an Expo + React Native example.

     • Adds stytch_token_type URL parameter with values magic_links and oauth to all Email Magic Link and OAuth redirect URLs to direct tokens to the correct /authenticate endpoint
     • Adds support for Discord and Slack as OAuth login providers, enabling access to their respective APIs via Stytch OAuth
     • Launches the JavaScript SDK workbench live on Netlify for testing frontend integration
     • Publishes an example app demonstrating SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. passcode implementation in an Expo + React Native environment

     4 details in Everything

108. 2022-04-27 release Apr 27, 2022 · release notes

     Solana wallet support, OAuth custom scopes, dual sessions, wildcard test domain matching

     • Adds Solana to Crypto wallets for crypto wallet login.
     • Adds support for custom scopes in OAuth integrations via the start call.
     • Provides an IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. session after a successful OAuth flow, plus a Stytch session when session_duration_minutes is included in the authenticate call.
     • Allows wildcard matching for allowlisted domains in the Test environment.

     4 details in Everything

109. Q1 wrap up Apr 25, 2022 · release notes

     Recaps Q1 2022 updates: Stytch Q1 adds GitHub/GitLab/Facebook OAuth, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., Crypto Wallets, headless JS SDK methods, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. sessions, and onboarding checklist.

     • Quarterly recap: Adds GitHub, GitLab, and Facebook as new OAuth provider integrations
     • Quarterly recap: Adds TOTP MFA support with compatibility for Google Authenticator and Authy
     • Quarterly recap: Adds Crypto wallets as a new authentication method for Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. users
     • Quarterly recap: Adds headless methods to the JavaScript SDK in addition to existing pre-built UI components
     • Quarterly recap: Adds JWT flavor to Sessions management product allowing custom session handling

     +1 more show less

     • Quarterly recap: Adds new onboarding flow checklist to the product interface

     6 details in Everything

110. 2022.04.12 release Apr 12, 2022 · release notes

     Stytch adds Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. crypto wallet support to JS SDK and session JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. to Python/Ruby clients

     • Adds Crypto wallets support in the JavaScript SDK for Web3 login
     • Adds Session JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. support in Python v4.13.0 client library
     • Adds Session JWT support in Ruby v2.12.0 client library

     3 details in Everything

111. 2022.04.05 release Apr 5, 2022 · release notes

     Stytch publishes a Login with Ethereum guide and a public Postman collection for API testing.

     • Adds Login with Ethereum guide for setting up Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. login using the Crypto wallets product
     • Makes Stytch APIs available in a new public Postman collection

     2 details in Everything

112. 2022-03-28 release Mar 28, 2022 · release notes

     New step-by-step onboarding checklist in the Stytch Dashboard guides users through their specific integration.

113. 2022.03.21 release Mar 21, 2022 · release notes

     Stytch adds Ethereum crypto wallet login and Session JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. minting/verification capabilities

     • Adds crypto wallets authentication via the API for any Ethereum based wallet such as MetaMask, Coinbase, or Rainbow
     • Adds session_jwt field to every Sessions product response containing session_id and session_token, enabling JWT-based session handling

     2 details in Everything

114. 2022.03.10 release Mar 10, 2022 · release notes

     Stytch v2022.03.10 expands SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. passcode country coverage and improves session latency.

     • Extends SMS passcode support to nearly all countries globally, replacing previous regional restrictions.
     • Improves Session management average latency by 80% and reduces p99 latency from 190ms to 90ms.
     • Adds a search function to the online Documentation interface.

     3 details in Everything

115. 2022.02.24 release Feb 24, 2022 · release notes

     Stytch adds mock values for Email/SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp passcodes and Sessions in Test/Live environments.

116. 2022.02.09 release Feb 9, 2022 · release notes

     Stytch JavaScript SDK now supports Facebook and GitHub OAuth out of the box.

117. 2022.01.28 Release Jan 28, 2022 · release notes

     Stytch adds GitHub OAuth and a frontend-only auth SDK private beta.

     • Adds GitHub as a new OAuth provider available in the API and JS SDK, configurable via the Dashboard
     • Introduces a private beta for a client-side JavaScript SDK that handles authentication and authorization without backend code

     2 details in Everything

118. 2022.01.21 Release Jan 21, 2022 · release notes

     Stytch 2022.01.21 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. to open beta and dashboard-configurable reCAPTCHA integration

     • Time-based One-time Passcodes (TOTP) launching to open beta for developers to build with immediately via the new TOTP Docs.
     • Dashboard now allows adding reCAPTCHA to the JavaScript SDK directly from the UI, enabling security increases and spam reduction without code changes.

     2 details in Everything

119. 2022.01.07 Release Jan 7, 2022 · release notes

     Stytch launches public beta for Search users endpoint and expands Get user response with OAuth providers

     • Adds the Search users endpoint to public beta, enabling searches by a variety of attributes.
     • Enhances the Get user API endpoint to include associated OAuth providers in the returned providers array.

     2 details in Everything

120. Stytch Q4-21 Update Dec 31, 2021 · release notes

     Recaps Q4 2021 updates: Stytch launches WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. beta, Google One Tap, new OAuth providers, and dashboard user management.

     • Quarterly recap: Adds WebAuthn support to beta for passwordless authentication
     • Quarterly recap: Adds Sign in With Apple and Sign in With Microsoft OAuth integrations via API/SDK
     • Quarterly recap: Adds Google One Tap for passwordless sign-up/login conversion
     • Quarterly recap: Enables User Management view in the Dashboard to see users and associated info
     • Quarterly recap: Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. Passcode support in 16 new countries including UK, India, Spain, and Japan

     5 details in Everything

121. 2021.12.17 Release Dec 17, 2021 · release notes

     Stytch adds User Management Dashboard and TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. preview

     • Adds User Management to the Stytch Dashboard, enabling viewing and searching across users with detailed information.
     • Releases API documentation for the upcoming TOTP (time based one time password) feature, supporting authenticator apps like Google Authenticator.

     2 details in Everything

122. 2021.12.03 Release Dec 3, 2021 · release notes

     Stytch adds WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. client library support and expands SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. Passcodes to 16 new countries

     • Expands SMS Passcodes support to UK, India, Spain, France, Peru, Germany, Australia, Israel, Netherlands, Mexico, Indonesia, Brazil, Japan, Singapore, Bermuda, and Italy

     1 detail in Everything

123. 2021.11.24 Release Nov 24, 2021 · release notes

     Stytch launches WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. public beta and adds user creation time to the get user response.

     • Adds WebAuthn support in public beta for passwordless authentication
     • The get user endpoint now returns the time a user was created.

     2 details in Everything

124. 2021.11.12 Release Nov 12, 2021 · release notes

     Stytch adds Sign in With Apple support to SDK

125. 2021.11.05 Release Nov 5, 2021 · release notes

     Stytch launches OAuth integration enabling Sign in With Apple via API

126. 2021.29.10 Release Oct 29, 2021 · release notes

     Stytch.js adds Sign in with Microsoft and configurable products in Storybook docs.

     • Adds Sign in with Microsoft provider support to the Stytch.js Javascript SDK
     • Enables product configuration in the SDK Storybook docs

     2 details in Everything

127. Stytch Q3-21 Update Oct 12, 2021 · release notes

     Recaps Q3 2021 updates: Stytch adds OAuth beta, embeddable magic links, session management, and OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. to email/WhatsApp in Q3-21 update

     • Quarterly recap: Adds OAuth integrations (Google and Microsoft) in beta for Sign In with functionality
     • Quarterly recap: Enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. Magic Link authentication into customer communication channels like SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., email, and WhatsApp via Stytch EMLs
     • Quarterly recap: Launches Session Management in public beta, exposing a new integration surface for session control
     • Quarterly recap: Adds support for sending One-Time Password (OTP) codes via email, SMS, and WhatsApp

     4 details in Everything

128. 2021.10.08 Release Oct 8, 2021 · release notes

     Adds Sign in with Microsoft OAuth integration and Next.js auth guide.

     • Provides a step-by-step guide for building authentication into Next.js apps

     1 detail in Everything

129. 2021.10.01 Release Oct 1, 2021 · release notes

     Stytch v2021.10.01 adds Google sign-in to the dashboard and wildcard subdomain redirect URLs in the Test environment.

     • Supports wildcard subdomain patterns (e.g., https://*.example.com/auth) for Test environment redirect URLs

     1 detail in Everything

130. 2021.09.17 Release Sep 17, 2021 · release notes

     Stytch adds beta OAuth Integrations (Google), Embeddable Magic Links, and SDK v2.0 with new config.

     • Launches OAuth Integrations in beta with initial support for Sign In with Google
     • Introduces Embeddable Magic Links, with access available by contacting support.
     • Introduces a new Stytch.js SDK configuration schema; the old configuration remains supported until November 15, 2021.

     3 details in Everything

131. 2021.08.20 Release Aug 20, 2021 · release notes

     Stytch launches email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. as a new authentication product alongside SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and WhatsApp

     • Adds email OTP, extending existing SMS and WhatsApp one-time passcode options.

     1 detail in Everything

132. 2021.07.23 Release Jul 23, 2021 · release notes

     Stytch adds a new WhatsApp provider to improve OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. deliverability.

133. 2021.07.09 Release Jul 9, 2021 · release notes

     Beta support for WhatsApp OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. authentication via API and client libraries

     • Adds beta WhatsApp OTP channel for user authentication in the Stytch API.
     • Updates Ruby client library to version 2.1.0 with new route naming conventions.
     • Updates Go client library to version 3.1.0 with new route naming conventions.
     • Updates Python client library to version 4.1.0 with new route naming conventions.
     • Updates Node client library to version 3.0.0 with new route naming conventions.

     +2 more show less

     • Adds email template preview functionality in the dashboard for invite and signup templates.
     • Enables mobile web access for selected dashboard functionalities.

     7 details in Everything