Stytch is a developer identity platform that lets software teams build sign-in, account security and authorisation into their own applications through APIs and SDKs. It serves consumer apps, multi-tenant B2B products and, increasingly, applications that need to let AI agents and MCP clients act on a user’s behalf.
The problem it addresses is that every product team ends up rebuilding the same identity plumbing. Stytch lets them start with a consumer or multi-tenant model and grow into enterprise requirements without replacing their auth stack.
At A Glance
| Vendor | Stytch, part of Twilio |
|---|---|
| Category | Customer and developer authentication (CIAM) |
| Identities covered | Consumer users, B2B organisation members, services (M2M) and AI agents |
| Deployment | Hosted APIs with frontend and backend SDKs and UI components |
| Agentic AI | Connected Apps for AI agent and MCP authorisation; AI agent detection |
| Customers | HubSpot, Replit, Crew, Crossmint, Genomoncology |
| Market classification | Customer Identity & Access |
What Stytch Does
Authentication is hard to get right and easy to get wrong, and most product teams would rather not build passkeys, SSO, provisioning and bot defence themselves. Stytch packages these as hosted services that sit behind the customer’s own interface. The same platform also covers a newer problem: when an AI agent or another app wants to use a customer’s API, someone has to issue, scope and revoke its access. The founders report that the platform has powered hundreds of millions of users and thousands of apps.
Products
Consumer And B2B Authentication
The core authentication product handles sign-in for both consumer and business software. It offers passkeys, breach-resistant passwords, email magic links built to survive enterprise link scanners, and device-aware MFA. For B2B products it adds multi-tenancy, with per-organisation auth policies, discovery across several organisations, account deduplication and role-based access control. Enterprise customers get SSO over SAML or OIDC with SCIM and just-in-time provisioning, and one-time codes fail over between email and SMS providers so they still arrive.
Admin Portal And Stytch UI
The Admin Portal is an embeddable, self-service console where a customer’s own clients manage their users, organisations, SSO and SCIM settings without filing support tickets. Stytch UI provides customisable sign-in components for web and mobile.
Connected Apps And M2M Authentication
Connected Apps is for teams that want other applications, or AI agents, to integrate with their product securely. It implements OAuth 2.0 and OIDC flows end to end and manages token issuance, validation and revocation, so the customer can act as an identity provider without writing that machinery. Alongside it, M2M authentication lets backend services call one another with no human involved, with support for API keys.
Fraud And Risk Prevention
Device intelligence fingerprints each visitor using deterministic signals and supervised machine learning, added to a site with a JavaScript snippet. It protects sign-up and login flows from bots, credential stuffing and account abuse, with a reported 99.99% accuracy in bot detection.
How It Works
Stytch is a hosted service. Applications call its backend APIs and SDKs, with quickstarts and example apps for Next.js, React and Node, while prebuilt components render the sign-in and admin experiences inside the customer’s product. In the B2B model, users belong to organisations, and each organisation carries its own auth policies, SSO connections, SCIM provisioning and roles. The device intelligence snippet runs in the browser and sends device signals back to Stytch, where each request is scored before the application decides how to respond.
Identities And Systems Covered
| Consumer users | End users of customer applications signing in with passkeys, passwords, magic links and MFA |
|---|---|
| B2B users | Members of customer organisations, provisioned through SSO, SCIM and just-in-time provisioning |
| Services | Machine-to-machine clients and API keys |
| AI agents | Agents and MCP clients authorised through Connected Apps, and browsing agents such as OpenAI’s Operator and Anthropic’s Computer Use API |
| Enterprise identity providers | SAML and OIDC compliant identity providers used for SSO and role mapping |
Agentic AI Capabilities
MCP And Agent Authorisation
Stytch offers a turnkey layer for agent authentication, authorisation and consent. Connected Apps can turn existing REST APIs into secured MCP endpoints and supports OAuth 2.1 with full DCR and CIMD support for MCP clients.
Consent And Human Approval
Administrators see, per organisation, which apps and agents are connected, which users approved them and which scopes they hold. They can revoke tokens and keep an allowlist of permitted apps and agents. Human-in-the-loop flows require approval before critical operations, and a user can never grant an app more permission than they hold themselves.
Agent Detection
Device intelligence recognises browsing agents as a distinct class of traffic, and the customer decides whether to monitor, allow or restrict that traffic.
Company Background
| Founders and leadership | Reed McGinley-Stempel (Co-founder and CEO) and Julianna Lamb (Co-founder and CTO) |
|---|---|
| Headquarters | San Francisco, United States |
| Funding | A $90 million Series B in November 2021 led by Coatue, valuing the company at $1 billion; earlier backers include Benchmark, Index Ventures and Thrive Capital |
| Acquisition | Twilio announced an agreement to acquire Stytch on 30 October 2025 |
Note: This overview is compiled from Stytch’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.