Stytch

REST API at api.stytch.com/v1/ (consumer) or stytch.com/v1/b2b/ (B2B). Magic link: POST /magic_links/email/send to send, POST /magic_links/authenticate to verify. OTP: POST /otps/email/send or /otps/sms/send, POST /otps/authenticate. OAuth: POST /oauth/{provider}/authenticate after redirect. Session management: POST /sessions/authenticate to validate, POST /sessions/revoke to end. User management: POST /users/create, GET /users/{user_id}. The API returns session tokens and JWTs on successful authentication. Each auth method follows a consistent two-step pattern: initiate (send) and verify (authenticate). The B2B API adds /organizations for multi-tenant management. Response payloads include user, session, and method-used details. The API design is clean and consistent across auth methods.

API errors return JSON with status_code, error_type, error_message, and error_url (link to documentation for the specific error). The error documentation linking is unique and helpful — agents can programmatically reference error documentation. Standard HTTP status codes. Rate limits are per-project with generous defaults. Auth method errors are descriptive: expired magic link, invalid OTP, session expired, organization not found. The test environment enables full auth flow testing without sending real emails or SMS. Device fingerprinting provides risk signals that agents can use for adaptive authentication. The main reliability consideration: email/SMS delivery depends on provider availability — Stytch handles retries and fallbacks.

Stytch provides authentication infrastructure with a passwordless-first approach: magic links, one-time passwords (email/SMS), passkeys, OAuth social login, and WebAuthn. For agents, the API covers user creation, authentication method management, session handling, and MFA orchestration. The B2B product adds organization management, SSO (SAML/OIDC), SCIM provisioning, and RBAC. Session management is built into the authentication flow — sessions are returned on successful authentication with configurable duration and attributes. Device fingerprinting provides fraud prevention signals. For agents building auth flows that prioritize passwordless methods (reducing credential management complexity), Stytch's API is well-designed. The main consideration: the passwordless-first approach means traditional username/password is available but not the primary flow.

Project credentials: project_id and secret used via HTTP Basic Auth. Separate credentials for test and live environments. Public tokens for client-side SDK initialization. The test/live separation prevents accidental production authentication. JWTs use configurable signing keys for session verification. JWKS endpoint provides public keys for token validation. B2B product uses organization-specific settings for SSO and RBAC. For agents, the project credentials model is straightforward. The session JWTs can be verified locally without API calls — reducing latency and API dependency. No OAuth for API access (OAuth is a feature they provide, not an auth method for their API). The security model is well-designed for authentication infrastructure.

Documentation at stytch.com/docs is excellent — well-organized with quickstart guides, API reference, SDK documentation, and integration guides. The API reference includes every endpoint with request/response examples and error codes. SDK documentation covers JavaScript, React, Next.js, Python, Ruby, Go, Java, and Kotlin. The documentation clearly separates consumer (B2C) and B2B product documentation. Interactive API examples in the dashboard enable auth flow testing. The documentation's strength: practical implementation guides that show complete auth flows, not just individual endpoints. Error documentation with linked error_url provides context-rich debugging. For agents, the quickstart guide for their chosen auth method is the fastest path to integration.