Skip to content

Stytch

Stytch offers sign-in for individual users and a separate organization-based setup for business apps.

Visit Stytch

Should you start with a Consumer or B2B project?

Start with the type of account the app needs. Consumer Auth starts with an individual user. B2B Auth starts with organizations and members. Choose B2B when the same app serves separate customer workspaces and each workspace controls who belongs.

Set up the matching browser integration and register the addresses the user can return to after sign-in. Your server must also use the matching project. Switching from Consumer to B2B later involves moving records and changing the sign-in flow.

How do you keep one company out of another company’s records?

For B2B, validate the member’s session on your server and check the organization attached to that session. Compare it to the organization that owns the requested record, then check the permission needed for the action.

The same email address can be a member in several organizations. When someone switches workspaces, check the active organization for the new request. The email address alone does not tell you which company’s data they can open.

How do you check a B2B setup without contacting customers?

Use a disposable app with two fictional organizations and a distinct test member for each. Before opening it, confirm the browser token, server credentials and endpoint all belong to the same Stytch Test environment. Verify the return address, sample records, webhooks and analytics are isolated. Use only a test sign-in path you have confirmed cannot deliver messages outside your test setup. Otherwise compare the two cases on paper.

  1. Check the member’s own workspace
    Using separate test browser sessions, check that each signed-in member can open the sample record in their own workspace.
  2. Check the other workspace
    Try to open the second workspace’s record as the first member. Confirm that the server returns no record data.
  3. Treat delivery as a separate check
    Stytch documents a direct B2B API sandbox check for a magic link request that sends no email. It checks the API response. It does not test browser sign-in or whether an actual inbox receives a message.

What happens when a B2B member forgets their password?

For a B2B password account, Stytch documents an emailed reset link for an existing member. The member follows the link and sets a new password. A successful reset by email revokes that member’s active sessions.

A company single sign-on user usually recovers access through the company’s identity provider. Keep the chosen reset path and its return address clear to the member.

What does Stytch count and how can you move the accounts?

Stytch’s pay-as-you-go pricing lists 10,000 monthly active users and agents and five SSO or SCIM connections included. SCIM is a way for a customer directory to keep its accounts in sync. Check the other usage and add-on charges your setup can trigger.

Stytch documents searches for Consumer user records and for B2B organization and member records. Ask support for password hashes. Check how account and organization IDs connect to app records, and test password compatibility and existing sessions before moving customers.