Feed

Stytch joins Twilio; no immediate contract or pricing changes

Stytch is joining Twilio to build the intelligent identity layer for the internet ↗

What happened

• Stytch states it is now a part of Twilio.
• Stytch states the company will continue to develop and support the Stytch platform with more resources.
• Stytch states there are no immediate changes to its contracts, pricing, SDKs, API keys, or integrations.

Why it matters to Signicat

• Twilio ownership of a developer-focused identity platform with phone and email reputation data may strengthen a competitor in CIAM and fraud prevention in Signicat's markets.
• The deal feeds the narrative of identity data accumulating in a single vendor hub, relevant to Signicat's watchlist; the source itself claims a trust network 'unavailable elsewhere'.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch adds Web Bot Auth verification to IsAgent and Device Fingerprinting

Stytch supports Web Bot Auth for agent and bot verification ↗

What happened

• Stytch announced support for Web Bot Auth, an emerging open standard for bots and AI agents to identify themselves.
• Stytch launched Web Bot Auth support alongside Browserbase, Anchor Browser, Cloudflare, and Akamai.
• Web Bot Auth verification is available through Stytch's IsAgent SDK and Device Fingerprinting product.
• Bot and agent operators do not need to register with Stytch to be verified.

Why it matters to Signicat

• Bot-identity verification is adjacent to Signicat's authentication and fraud-screening lines; the article shows a competitor extending into agent identity, with no Signicat product overlap stated.
• Launch partner list and third-party quotes are vendor-published; independent adoption volume is not reported in the article.

4 of 4 facts verified against the source · confidence high · claude-haiku-5-5

Stytch announced that Connected Apps is generally available and free to use for the first 10,000 active users and AI agents.

Stytch Connected Apps: auth for AI Agents & MCP that fits within your existing identity stack ↗

What happened

• Stytch describes Connected Apps as able to plug into existing authentication infrastructure without replacing the identity stack.
• Connected Apps uses Trusted Auth Tokens: the customer app asserts a logged-in user, Stytch verifies the token, renders consent, and completes the OAuth flow.
• Stytch describes a headless SDK option for full UI control over the OAuth authorization flow.
• Stytch describes a one-sprint path to shipping MCP servers with scoped access, a claim the vendor has not substantiated with independent data.

Why it matters to Signicat

• Stytch is entering the agent-delegation and MCP authorization layer, which overlaps with Signicat's orchestration and identity-brokering positioning for AI-driven access.
• The 'drop into existing CIAM' and free-tier approach targets customers locked into legacy CIAM contracts, a segment Signicat could contest with low-friction trials.

5 of 5 facts verified against the source · confidence medium · claude-haiku-5-5

The guide describes MCP dynamic client registration and states PKCE is required for dynamically registered clients in Stytch Connected Apps.

Agent-to-agent OAuth: a guide for secure AI agent connectivity with MCP ↗

Why it matters to Signicat

• Educational content on MCP and OAuth for agents; no Signicat product reference found in the excerpt.

1 of 2 facts verified against the source · confidence high · claude-haiku-5-5

Stytch announced SAML Shield, a product that validates SAML Responses before they reach the service provider's SAML library.

Introducing SAML Shield: open source protection for SAML CVEs ↗

What happened

• SAML Shield is offered via API mode, proxy mode (nginx, Istio, Envoy) and a self-hosted open-source Node.js library.
• Stytch states SAML Shield has a permanent free tier of 500 SAML responses per month, with usage beyond that at $0.10 per response.
• Stytch states the first two months after launch are free for SAML Shield.
• Stytch states SAML Shield does not perform cryptographic signature validation.

Why it matters to Signicat

• SAML Shield targets SAML-based SSO security for apps Stytch does not own, a adjacent layer to federation and authentication stacks Signicat sells.

5 of 5 facts verified against the source · confidence high · claude-haiku-5-5

Stytch states that IsAgent is free to start using with registration of a Stytch account.

Introducing IsAgent: understand and support AI agents using your site ↗

What happened

• Stytch states that IsAgent results are best-effort heuristics that may be incorrect at times.

Why it matters to Signicat

• Stytch is extending its identity tooling into agent traffic classification, a adjacent signal to Signicat's fraud and orchestration offering; no direct overlap with Signicat's eID brokering or EUDI scope is shown in the article.
• Agent-facing OAuth positioning (Connected Apps referenced) is a narrative Signicat may need to track against its authentication and identity-provider messaging.

2 of 4 facts verified against the source · confidence high · claude-haiku-5-5

Stytch presented a live demonstration showcasing how attackers can deploy AI-powered bots to mimic human behavior and target login flows.

Live Demo: Stytch’s Device Fingerprinting vs. AI Bots ↗

What happened

• Stytch demonstrated blocking modified automated scripts through deception flags such as JavaScript property deception and intelligent rate limiting.
• Stytch confirmed that its device fingerprinting solution intentionally excludes typing speed and mouse dynamics because it considers them noisy signals.

Why it matters to Signicat

• Signicat monitors fraud prevention and anti-automation capabilities across authentication and onboarding workflows, though Stytch is showcasing an existing capability rather than a new launch.

3 of 3 facts verified against the source · confidence high · gemini-3.8-flash

Equixly's research found 43% of tested MCP server implementations had unsafe shell calls.

Securing Model Context Protocol (MCP): Threats & Defenses for AI Agents ↗

What happened

• The article describes a pull request proposing that MCP servers integrate with external identity providers rather than act as OAuth providers.

Why it matters to Signicat

• Stytch's position on external IdPs and OAuth scope control overlaps with agent-identity competition for authorization of AI tools, relevant to Signicat's agentic identity monitoring.

2 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch states that its Connected Apps product enables any app to become an OAuth compliant identity provider, meeting MCP server requirements out-of-the-box.

The age of agent experience: now with MCP servers ↗

What happened

• Stytch lists consent flows, dynamic client registration, and audit logging among Connected Apps capabilities.
• The article states that the MCP spec updates support OAuth 2.1-based authorization for remote access.
• The article states that Google, Microsoft, and OpenAI have launched first class support for MCP.

Why it matters to Signicat

• Stytch is positioning identity-provider functionality for agent access, an adjacent area to Signicat's authentication and orchestration lines; the article is thought leadership with no independent data.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch's Connected Apps allows users to turn an application into a secure OAuth / OIDC identity provider for delegating access to AI agents, external tools, or third-party apps.

Handling AI agent permissions ↗

Why it matters to Signicat

• Content is educational guidance on agent authorization with a product call-to-action; it signals Stytch's push into agent identity, a theme outside Signicat's core product lines.

1 of 2 facts verified against the source · confidence high · claude-haiku-5-5

The article is a Stytch blog post that compares Stytch Device Fingerprinting with Auth0 bot detection.

Stytch vs Auth0: Bot detection ↗

What happened

• The article states that Auth0 bot detection relies on ephemeral signals like IP addresses, user agents, and browser headers.
• The article states that Auth0 bot detection is only fully supported in its Universal Login product.

Why it matters to Signicat

• Named competitor comparison targets an auth-provider bot-detection feature; claims are one-sided vendor assertions attributed to Stytch.
• Device-fingerprint persistence and fraud-beyond-bots positioning overlaps with Signicat risk and authentication screening.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch reports that an authentication bypass in the node-saml library was reported to it on March 4, 2025.

Authentication bypass in node-saml ↗

What happened

• Stytch reports a patch was deployed to production on March 5, 2025 at 2:08 PM PT.
• Stytch reports a second bypass in xml-crypto involving multiple SignedInfo nodes, with a blocking patch deployed on March 13, 2025.
• Stytch reports that an independent third party concluded with high confidence that the vulnerability was not exploited on its systems.
• Stytch reports CVEs for both vulnerabilities and a patched xml-crypto version were released as of 3/14/25.

Why it matters to Signicat

• SAML signature-validation flaws in widely used libraries affect SAML SSO providers and relying parties, a category Signicat's brokering and authentication products may depend on; exposure of Signicat's own stack is not stated in this source.

5 of 5 facts verified against the source · confidence high · claude-haiku-5-5

Stytch states that its Connected Apps product lets any application become its own identity provider.

Connecting AI agents to every app ↗

What happened

• Stytch lists Connected Apps capabilities: exposing APIs, read/write permission scopes for users and AI agents, OAuth2.0/OIDC authentication, and tracking of agent actions.
• Stytch uses Supabase's OAuth-based integration with Lovable as its example of an app acting as an IdP.

Why it matters to Signicat

• The article is a vendor thought-leadership post with no customer metrics, deployments, or independent validation, so its market impact is likely limited.

3 of 3 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch launches Admin Portal for customer self-serve auth and SSO management

Stytch Admin Portal: Self-serve management for organizations and enterprise auth ↗

What happened

• Stytch announced the launch of the Admin Portal, an embeddable suite of UI components within its frontend SDKs for customers to self-serve manage auth and security settings.
• The Admin Portal components are available in Next.js, React, and Vanilla JS SDKs.
• Components support SAML and OIDC identity providers including Microsoft Entra, Google Workspace and Okta for SSO configuration.
• Components are protected by Stytch's RBAC product and enforce RBAC at UI and API levels.

Why it matters to Signicat

• Competitive overlap is with Signicat's orchestration and enterprise B2B identity administration; the article does not address Signicat's core European eID or verification products.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch launches Connected Apps for OAuth 2.0/OIDC identity provider role

Stytch Connected Apps: Make any app an OAuth provider for integrations and AI agents ↗

What happened

• Stytch introduced Connected Apps, a feature that lets an application become an OAuth 2.0 identity provider for integrations with AI agents and third-party apps.
• Connected Apps is built on OAuth 2.0 and OIDC to authenticate and authorize users across applications.
• The post states Stytch handles OAuth 2.0/OIDC flows end-to-end, including token issuance, validation, and revocation.
• The post was published as part of Stytch's Launch Week.

Why it matters to Signicat

• Positions Stytch against Signicat's eID Hub and orchestration offer by extending identity-provider roles to app-to-app and AI agent delegation; overlap is with authentication and orchestration, not eID brokering.
• Relevance to Signicat's core European eID and signing lines is limited; the feature targets developer-built OAuth provider functions.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch announced enhancements to its Fraud and Risk Prevention solution, including Intelligent Rate Limiting, enhanced data visualization, event log filtering, streamlined rule creation, backend SDK support and external metadata support.

Stytch Fraud & Risk Prevention: Intelligent Rate Limiting, real-time monitoring, and more ↗

What happened

• Fraud and Risk Prevention improvements are available in backend SDKs for Node, Go, Python, Ruby, Kotlin, Java and Rust, usable with B2C and B2B clients.
• Stytch states that Intelligent Rate Limiting identifies tools such as Puppeteer, Selenium, Anthropic's Computer Use API and OpenAI's Operator.
• Stytch states that IPGEO decisioning is in closed beta for BLOCK/ALLOW decisions based on IP addresses, ASNs and country codes.

Why it matters to Signicat

• Feature content is a fraud and bot-defence update with limited overlap with Signicat's document, eID brokering or wallet lines; watch-level only.
• Stytch's claims of superior accuracy are vendor self-description and uncorroborated by independent benchmarks in the article.

4 of 4 facts verified against the source · confidence high · claude-haiku-5-5

Stytch blog tests AI agent detection across three agent toolkits

Detecting AI agent use & abuse ↗

What happened

• Stytch states it tested multiple AI agent toolkits across high-traffic consumer sites.
• Stytch reports that in its tests only YouTube and Reddit consistently blocked the three tested agent toolkits.
• Stytch states it uses machine learning trained on browser fingerprints to identify headless or emulated browsers.
• Stytch states that OpenAI Operator and BrowserBase Open Operator run full Chromium builds, while the Anthropic Firefox browser fails to emulate certain real-user characteristics.

Why it matters to Signicat

• Article frames bot-detection and agent observability as a gap for application developers, relevant to Signicat's fraud and authentication offerings.
• Vendor-reported test results lack disclosed sample size, sites, or methodology, so the effectiveness claims are uncorroborated.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch announced new pricing that removes feature gates, offers a pay-for-what-you-use model with no hard caps, and provides a generous free tier.

Announcing Stytch’s new self-serve pricing ↗

What happened

• Stytch states that every user has access to MFA, SSO, RBAC, SCIM, social logins, OTPs and passwordless auth in its free tier.
• Stytch states it charges only for MAUs or SSO Connections above the free tier allowance, without sales engagement.
• Stytch's article names Auth0 as its most common competitor and publishes a pricing comparison against Auth0.

Why it matters to Signicat

• Competitive attack on named rival Auth0 with pricing criticism; Signicat is not named, so direct exposure is indirect.

4 of 4 facts verified against the source · confidence high · claude-haiku-5-5

Stytch published commentary criticizing announced pricing changes for Auth0.

Auth0’s 2024 Pricing Update: What They’re Hiding About the Real Costs ↗

What happened

• The post reports Auth0 raised included free MAUs on the Free plan from 7,500 to 25,000.
• The post states Auth0 self-service plans have hard caps of 30,000 MAUs for B2C and 10,000 MAUs for B2B.

Why it matters to Signicat

• Direct competitor attack on a major CIAM rival; Signicat-relevant only as a pricing-transparency narrative that may be reused against Signicat's quote-based pricing.
• Post is the competitor's own framing; claims about unnamed engineering teams' cost jumps are uncorroborated vendor assertions.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch announced a set of updates to its B2B authentication solution, including zero-downtime session migration, Google One-Tap, pre-built OTP and TOTP MFA UI, RBAC, SCIM and protected email magic links.

Introducing major updates to Stytch B2B authentication ↗

What happened

• Stytch states that its zero-downtime session migration lets customers move from an existing auth provider without users logging out of their existing session.
• Stytch published two new B2B multi-tenant example apps, one using pre-built UI and one using a headless UI.
• Stytch published case studies on Tome, which it says migrated from Auth0 to Stytch B2B, and Orb, which it says migrated from Auth0 to Stytch’s SSO offering.

Why it matters to Signicat

• Stytch's SCIM, RBAC and SSO additions target enterprise B2B authentication, a segment adjacent to Signicat's authentication and orchestration offerings; impact is low-to-moderate.

4 of 4 facts verified against the source · confidence high · claude-haiku-5-5

The article is a developer tutorial walking through a React example app that logs users in with Stytch passkeys and OTP.

Log in with Passkeys: an example app using React and Stytch’s frontend SDK ↗

What happened

• The example app uses Stytch's login component configured with passkeys and OTP, with OTP used for signup because passkeys support login only.
• The example app requires step-up authentication with a second factor before users create or modify passkeys.

Why it matters to Signicat

• Tutorial lowers the implementation barrier for passkeys in web apps; it is developer content rather than a product or commercial change.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch announced its Passkeys offering, described as a complete developer toolkit for building passkeys into web and mobile applications.

Introducing Passkeys authentication ↗

What happened

• The offering abstracts passkey logic into two API calls, according to Stytch.

Why it matters to Signicat

• Passkey developer tooling targets authentication_passwordless, a Signicat product line area; overlap with Signicat's authentication offering is assessed as limited on this evidence.

2 of 2 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch launches new self-serve pricing tiers and free tier

Announcing new pricing and self-serve options ↗

What happened

• Stytch launched new pricing tiers effective for all new customers on the announcement date.
• Stytch created a free tier covering all B2C auth products and 5,000 MAUs, and basic B2B auth products with 1,000 MAUs and 25 monthly active organizations.
• Stytch will add pass-through usage fees for international (non-US or Canada) WhatsApp and SMS passcodes, not applying to existing customers until 8/1/23.
• Existing contracted customers keep their existing pricing, and existing pay-as-you-go customers move to the free self-serve tier while keeping existing features.

Why it matters to Signicat

• Stytch restructures self-serve pricing by segment and per-MAU cost, a commercial packaging shift relevant to Signicat's authentication pricing.
• Free tier and separate B2B pricing lower entry barriers in authentication, which may pressure Signicat's developer-led self-serve acquisition.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch reports a 2023-02-23 infrastructure configuration change took down all Kubernetes worker nodes, causing a full outage of the live API for 14 minutes, Frontend SDKs for 17 minutes and the Dashboard for 17 minutes.

Stytch postmortem 2023-02-23 ↗

1 of 3 facts verified against the source · confidence high · level lowered after verification · claude-haiku-5-5

Stytch states it uses Dropbox's zxcvbn strength estimator instead of rigid LUDS requirements for passwords.

How we (re)made Passwords for next-generation auth ↗

What happened

• Stytch states it automatically deduplicates accounts by email regardless of login method.
• Stytch states it integrated Have I Been Pwned to check credentials against a database of 623+ pwned websites and nearly 12 billion pwned accounts.
• Stytch states that when users start a forgotten-password flow, they can skip the reset and log in via Email Magic Link.
• Stytch states Passwords can serve as the primary or secondary factor in an MFA flow or alongside other passwordless methods.

Why it matters to Signicat

• Stytch's password-plus-passwordless framing targets customers slow to adopt passwordless, a segment overlapping Signicat's authentication line.

5 of 5 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch's GTM lead published a post comparing Stytch with Amazon Cognito across flexibility, reliability, pricing and support.

Stytch vs. Amazon Cognito ↗

What happened

• The post states Amazon Cognito defaults to Amazon SNS for messaging, which it says lacks failover redundancy.
• The post states Amazon Cognito charges per click, including for failed or duplicated requests.
• The post states Amazon Cognito does not allow password exports.

Why it matters to Signicat

• Direct named comparison against a hyperscaler IdP; relevant to Signicat's authentication and orchestration sales where buyers weigh vendor lock-in and per-check pricing.
• Post frames per-user pricing against per-click pricing, a comparison pattern similar to the narrative that Signicat quote-based pricing is opaque versus published per-check prices.

4 of 4 facts verified against the source · confidence medium · claude-haiku-5-5

Stytch announced a password-based authentication solution called Passwords.

Stytch introduces a modern upgrade to Passwords ↗

What happened

• Stytch integrates with HaveIBeenPwned to block passwords present in a dataset of nearly 12 billion compromised credentials.
• Stytch uses Dropbox's zxcvbn password strength estimator for password strength assessment.
• Stytch de-duplicates accounts by email regardless of authentication method.
• Customers can offer password reset via traditional email or via Email Magic Links.

Why it matters to Signicat

• Password management features are a passwordless-adjacent bridge that competes for login flows in the authentication theme, with limited direct overlap with Signicat's eID or document verification lines.

5 of 5 facts verified against the source · confidence high · claude-haiku-5-5

Stytch launched support for JSON web tokens as part of its session management product, letting developers choose JWTs, session tokens, or a hybrid approach.

Introducing JWTs for session management ↗

What happened

• Stytch session JWTs expire every 5 minutes, and a new JWT can be retrieved through the Stytch API while the underlying session remains valid.
• Stytch signs all JWTs for a project with project-specific signing keys and publishes verification keys at a project-specific, publicly accessible URL.

Why it matters to Signicat

• Low relevance to Signicat's core eID brokering, document IDV and wallet lines; session-token design is adjacent to Signicat's authentication product. Assessment only.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5

Stytch offers route-based (just-in-time) authentication that staggers verification factors by action sensitivity.

Build vs. buy: what to consider when setting up an auth flow ↗

What happened

• The article states that an early study found the average engineering overrun to be 27%.

Why it matters to Signicat

• The piece is generic vendor content positioning buy-over-build for auth; it contains no Signicat mention and no new Signicat-relevant product event.

2 of 2 facts verified against the source · confidence high · claude-haiku-5-5

Stytch introduced TOTP (time-based one-time passcodes) as a passwordless two-factor authentication option.

Introducing TOTP Authentication for Next-Level Security ↗

What happened

• Developers can use Stytch's /totps/authenticate endpoint to verify TOTP passcodes.
• Stytch's product works with any authenticator app that follows the TOTP protocol, such as Google Authenticator, Authy, and Microsoft Authenticator.

Why it matters to Signicat

• Stytch targets high-risk use cases such as fintech money movement and crypto, overlapping with Signicat's authentication and risk verticals; moderate relevance, as the article is a single-feature announcement.

3 of 3 facts verified against the source · confidence high · claude-haiku-5-5