Stytch Features

Process of providing credentials and logging into multiple systems is easy and intuitive for users

Supports required 3rd party Authentication Technologies. Example systems: bioMetric, passwords, key cards, token based systems, etc.

Provides support for Multi-Factor authentication, so users are required to provide multiple factors to authenticate. For example, something they know, Something they have or something they are.

Support SSO via Web agents, proxy agents, agent-less, SAML or oAuth and WS-Federation authentication and authorization Web services depending upon the application and business use case

Can serve as the Service provider from an external service so that when the user logs in externally they have seamless SSO to internal applications from a service provider.

Provides ability to control access to PC's, Mobile devices, and other endpoint devices.

Controls access to legacy applications, web based applications, network resources and servers while employees are on the companies local area network.

Controls access to legacy applications, web based applications, networks resources while employees are outside the local area network.

Controls access to users that are not company employees that are either within the companies local area network or outside the network

Enables users to use their own device to access company applications.

Installation process is easy and flexible.

Options for resetting and enforcing password policies

Provides Administration tools/console that are easy to use and learn for routine maintenance tasks

Easily provisions new systems, platforms or applications using configuration and not customization.

Users can set, change passwords without interaction from IT staff

Tags users suspected of committing fraud and identifies them upon return.

Prevents previous committers of fraud from future transactions.

Syncronizes passwords across company systems.

Provides a tool for IT administrators to manage the software.

Configure specific policies for users or groups using group policy objects.

Supports multiple password policies.

Supports multiple languages.

Supports Endpoint access control to multiple operating systems

Allows user authentication to be honored by all the hosts in two or more domains

Support access to browser based applications across required browser types

Provides required failover mechanisms to ensure if one server, network, etc fails users are still able able to authenticate

Contains pre-built and custom reporting tools to required to manage business

Provides mechanism for auditing authentication for trouble shooting purposes.

Can call and pass credentials to third party web services.

Sends a one-time passcode (OTP) via SMS.

Provides a one-time passcode (OTP) via voice-call.

Sends a one-time passcode (OTP) via email.

Supports hardware tokens, which are often USB-sized, fob-like devices that store codes.

Offers software tokens, which are applications installed on a mobile phone, wearable devices, or desktops and generate time-based one-time passcodes (TOTP) that a user can easily copy. Software tokens work both online and offline.

Allows biometric factors such as fingerprints, faceprints, voiceprints, or other biometric information to be used as an authentication factor.

Offers mobile push authentication, which is a user-friendly method that does not require a user to copy a code, but rather accept or deny an authentication using a mobile application. Mobile push authentication only works when a user is connected to the internet.

Analyzes users' IP addresses, devices, behaviors and identities to authenticate a user.

Allows the use of tokens on multiple devices. This feature can also be turned off if the user does not want this.

Offers encrypted backup recovery stored by the vendor.

Intetgrates with Active Directory.

Integrates with Lightweight Directory Access Protocol (LDAP)-based directory services.

Utilizes existing known hacking dictionaries to disallow users to select passwords that have been compromized.

Allows administrators to create a custom blacklist to disallow employees from using specific words in their passwords.

Enables a seamless customer experience with self-registration and self-service functions, including account creation and preference management.

Verifies user identity with authentication, which may include multiple multi-factor authentication methods.

Scales to support growing a customer base.

Captures and manages a customer's consent and preferences to comply with data privacy laws such as GDPR and CCPA.

Offers users the option to sign in with social media accounts.

Integrates with directories or other data stores that house customer data to create a complete view of a customer.

Offers FIDO2-enabled authentication method

Works with hardware security keys

Offer users multiple ways to authenticate including, but not limited to: mobile push on trusted devices, FIDO-enabled devices, physical security keys, keycards, smart watches, biometrics, QR codes, desktop app + pin, and others.

Offers solutions when users are offline or do not have access to a mobile phone.

Monitors for and rids systems of bots suspected of committing fraud.

Constantly monitors system to detect anomalies in real time.

Alerts administrators when fraud is suspected or transactions have been declined.

Stores data from external or internal sources related to fake accounts, evaluating users for risk.

Actively gathers data on suspicious purchasing sources and characteristics of common committers of fraud.

Produces reports detailing trends and vulnerabilities related to payments and fraud.

Complies with the National Institute of Standards and Technology password best practice recommendations.

Complies with the National Cyber Security Centre (NCSC) password best practice recommendations.

Compliant with Section 508 to enable employees with disabilities to use this software.

Offers an easy to understand user interface to make setup smooth.

Offers a mobile software development kit (SDK) for iOS, Blackberry, and Android.

Offers a software development kit (SDK) for web-based applications.

Works across multiple software systems or databases

Improves performance based on feedback and experience

Makes informed choices based on available data and objectives

Possesses AI-driven triggers to determine when to require MFA or stronger authentication rather than always requiring it.

Builds profiles of known devices/environments per user and flags deviations such as new devices, new networks, and/or suspicious locations as higher risk.

Spot fraudulent behavior, such as account takeover attempts, credential stuffing, bots, and brute force attacks through the use of AI.

Uses machine learning to analyze past authentication events and suggest optimizations to security policies (e.g. thresholds, triggers) or to adjust rules over time.

Leverages AI to assign a risk score to a login attempt based on context, device, IP, historical patterns to dynamically decide whether to prompt for MFA, additional challenges, or allow seamless login.

Monitors behavioral signals including typing patterns, mouse movement, and/or touch/swipe dynamics to verify user identity either at login or continuously after login.

Uses computer vision, facial recognition, or other biometrics during onboarding or at risk events, with AI-based liveness checks to prevent spoofing or replay attacks.

Generates dynamic prompts to guide users through account recovery workflows.

Implements artificial intelligence to filter, rewrite, or block prompts that attempt to access unauthorized data, escalate privileges improperly, exploit system weaknesses, or otherwise re-provision customer access permissions.