Stytch Blog

Co-founder of Stytch (http://stytch.com/) here -- would love to see if you think we're a fit. We have a generous free tier and we're more reasonably priced that tools like Auth0, but not as cheap as tools like Cognito + Firebase auth. If pricing is a concern, would love your feedback on your optimal cost-structure as we have some startup programs and are always looking to make pricing more compelling for early-stage projects.

> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. Something that we're looking to solve at Stytch[1] from the developer's perspective. We're finding that the different platforms have their own twist on Passkeys implementation and all have different UX suggestions. [1] https://stytch.com/

Check out https://stytch.com - we’re hybrid, but the SF and NYC offices have people in just about every day. I usually go in twice a week and it’s been great for in-person collaboration. https://jobs.ashbyhq.com/stytch

Hi HN! I’m one of the founders of Stytch (https://stytch.com/?utm_source=social&utm_medium=hackernews&ut… We provide developer APIs and SDKs that make it simple to embed passwordless authentication in your apps. Today, we support email magic links, SMS and WhatsApp passcodes, and one-click user invitations. We’re working on adding more features like session management, WebAuthn, OAuth support, QR codes, and more in the coming months. Our docs and guides make it really simple to set up authentication for a new app or add additional features to an existing app. Here’s more on why we’re building Stytch: https://stytch.com/blog/why-stytch/?utm_source=social&utm_medium=h… Sign up today and try it out: https://stytch.com/?utm_source=social&utm_medium=hackernews&ut… Would love any feedback and questions!

Stytch | Various roles | San Francisco, CA ONSITE/HYBRID | https://stytch.com Stytch helps developers protect their applications and make authentication that's simple and scalable, so that teams can stay focused on building differentiated products. That's various forms of signup/login flows, SSO and multi-tenant organization needs, integrated bot detection and fraud prevention, and more. Beyond core authentication for humans, I'm also excited about our work in auth for AI: making it easy for companies to serve AI agents, and for AI agent developers to securely get things done. Stytch Connected Apps makes it easy to authenticate AI agents, and IsAgent and Device Fingerprinting help companies understand and control their AI traffic. Personally, I enjoy working on interesting things, with the ability to make customer impact, and with great people. If you do too, consider joining us. We are hiring for Software Engineer, DevRel/Marketing Engineer, Product Designer, and Solutions Engineer roles. Apply here: https://jobs.ashbyhq.com/stytch

> Subagents do not work well for coding at all Subagents can work very well, especially for larger projects. Based on this statement, I think you're experiencing how I felt in my early experience with them, and that your mental model for how to use them effectively is still embryonic. I've found that the primary benefit for subagents is context/focus management. For example, I'm doing auth using Stytch. What I absolutely don't want to do is load https://stytch.com/docs/llms.txt and instructions for leveraging it in my CLAUDE.md. But it's perfect for my auth agent, and the quality of the output for auth-related tasks is far higher as a result. A recommended read: https://jxnl.co/writing/2025/08/29/context-engineering-slash-commands-…

Great article, but the actual technical details of their current “browser fingerprinting” approach are linked at the bottom: https://stytch.com/docs/fraud/guides/device-fingerprinting/overview This seems semi-effective for professional actors working at scale, and pretty much useless for more careful, individual actors — especially those running an actual browser window! I agree that the paywalls around LinkedIn and Twitter are in serious trouble, but a more financially pressing concern IMO is bad faith Display Ads publishers and middlemen. Idk exactly how the detectors work, but it seems pretty impossible to spot an unusually-successful blog that’s faking its own clicks… IMHO, this is great news! I believe society could do without both paywalls or the entire display ads industry.

Regarding SMS only auth, you should be cautious. Here's a blog with more detail: https://stytch.com/blog/totp-vs-sms. As a suggestion for what to implement (I'm biased because I work there) but I'd encourage you to check out Stytch (https://stytch.com). We're an API-first authentication, authorization and fraud prevention B2C and B2B solution with several methods including email/password, email magic links, social logins and 2FA (OTP, TOTP).

Stytch | Remote (US) | Hybrid in SF/NY| * We have a mix of remote and hybrid roles, please look at the location when you apply. https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/stytch Here are our open roles: - Experienced Full-stack (Backend Leaning) - Experienced Full- Stack Engineer - Experienced Backend Engineer - Experienced Infra Engineer - Experienced Data-Infra Engineer - Product Manager, Activation - Technical Product Marketing Manager - Product Designer - Developer Advocate Engineer - Developer Education https://jobs.ashbyhq.com/stytch?utm_source=OEvbo87dAp Tech Stack: Go for backend services, Node and Typescript for our web services, Next.js and React/Typescript on the frontend. We run on AWS with Kubernetes for containerization, and gRPC and protobufs for internal service communication.

> I've found that the primary benefit for subagents is context/focus management. For example, I'm doing auth using Stytch. What I absolutely don't want to do is load https://stytch.com/docs/llms.txt and instructions for leveraging it in my CLAUDE.md. > But it's perfect for my auth agent, and the quality of the output for auth-related tasks is far higher as a result. What about just using a sub agent specifically to fetch llms.txt and find the answer to the question for the parent agent? Instead of handing a full task off to it

> whether we can take advantage of people’s tendencies towards learned behaviour like this See, thoughts like that turn into billion dollar valuations at Series B for, among other things, a login button that emails you a login link, taking advantage of people's tendencies towards behavior like this: https://stytch.com/products/email-magic-links https://stytch.com/blog/announcing-series-b/ (Or maybe turn into Tell HN posts on common SaaS vulns, like https://news.ycombinator.com/item?id=33162854, but point is lots of companies offer this including most SaaS-y IdPs, search: passwordless email magic link, it's not new: https://auth0.com/blog/auth0-passwordless-email-authentication-and-sms… ...)

The big cloud providers have substantial free tiers (50k MAUs). Cognito, Firebase and Azure AD B2C all have a similar free tier. After you go through the free tier, you pay per MAU ($0.005 per MAU, according to https://aws.amazon.com/cognito/pricing/ , I think similar for the other providers. For smaller players, I think Stytch is 10c/MAU/month, where an MAU is any interaction with the Stytch service (login in all the many forms). https://stytch.com/pricing has more. You'll have to dig a bit deeper into each pricing page to determine what actions make a user 'active'. I'm not aware of anyone who does MAU calculations on a day to day basis; monthly rollups are the standard. Some folks charge per MAU (FusionAuth does) but in a band (the first 10k MAUs for a FusionAuth paid version are all one price). HTH.

Author links to the docs, but fails to mention if they emailed [email protected] - which has not only been in docs since at least late 2021, but also found doing a simple Google: - https://stytch.com/docs/#security_overview * Note: Search for “security@“ on link above. - https://web.archive.org/web/20210801185042/https://stytch.com/docs/ - https://www.google.com/search?q=stytch+security+disclosure To me, little strange to be so critical and have obviously spent time to research and document their findings, then fail to do even basic due diligence. Also appears author is posting this anonymously, which given the prior information, makes me wonder what their motives are. To me, this feels more like an attack than responsible disclosure. Flagging the post.

I signed in to stytch.com and see a cookie called "stytch_session_jwt" that is not set with HttpOnly. It appears to refresh against https://stytch.com/web/sdk/sessions/authenticate with a Basic auth token which is also set on the client-side Is there any protection to prevent this from leaking during an XSS attack? How does that work?

Stytch | SF (US) | Onsite or Remote | https://stytch.com Stytch is the most powerful identity platform built for developers. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. Our open positions: * Engineering Manager, Platform: https://jobs.ashbyhq.com/stytch/146ef566-c5fc-4d9b-bd60-433910968853?d… * Experienced Backend Engineer: https://jobs.ashbyhq.com/stytch/a935d43e-bc19-496b-b25c-32852eff0d91?d… * Experienced Full-Stack Engineer: https://jobs.ashbyhq.com/stytch/bdbcbc82-b85f-4f7c-8569-dbccabbf98a4?d… * Frontend Engineer: https://jobs.ashbyhq.com/stytch/216e38c6-5b9c-4e2b-82c1-9e85da5af1a1?d… Tech Stack: Go for backend services, Node and Typescript for our web services, Next.js and React/Typescript on the frontend. We run on AWS with Kubernetes for containerization, and gRPC and protobufs for internal service communication.