Authentication is the part of an app that every developer thinks they understand until they have to support SSO for their first enterprise customer. Stytch built its reputation on making that transition less painful, and the documentation reflects it. The best section is not a how-to at all. It is the explanation of data modelling, specifically the difference between consumer auth, where a user is a user, and B2B auth, where a user belongs to one or more organisations, each with its own SSO settings, SCIM provisioning and access policies. Getting this wrong early is one of the most expensive mistakes a SaaS company can make, because it gets baked into every table.
Stytch's docs explain the trade-off clearly enough that we would send a founder to them regardless of which vendor they choose. The second standout is the material on AI agent authentication. The practical question of how an agent acting on a user's behalf gets scoped, revocable access to your API is suddenly everyone's problem, and most auth vendors are still treating it as a footnote. Stytch walks through making your app an OAuth-compliant provider that agents can connect to, which is the right framing. This is presumably much of why Twilio bought the company in November 2025 for about $104 million, pitching it as an identity layer for agentic AI. That acquisition is our main criticism.
The documentation does not mention it. The changelog does, but someone reading the docs to evaluate Stytch as a supplier would reasonably want to know that the product now belongs to a large communications company with its own priorities. We noted the same failing with Neon after Databricks bought it. Ownership changes are material information for anyone signing a multi-year contract. The docs are also, like most vendor docs, better at integration than at security thinking.
You will learn how to add passkeys and magic links. You will not learn much about which attacks each method actually stops, which is the knowledge you need when something goes wrong. Our take: very good vendor documentation with two sections that are worth reading for their own sake. It is not a course, and it will not teach you security, but it will stop you making the classic multi-tenant mistake.