Stytch through Squiid

What Stytch is

Stytch is an authentication platform with a passwordless emphasis. It covers magic links, one-time passcodes, passkeys and WebAuthn, OAuth providers and session management, with headless SDKs for teams that want their own interface and prebuilt UI for those who do not. Its fraud products are the distinctive part: device fingerprinting that identifies a browser across sessions, and bot and impersonation detection used to block automated signups. Stytch also offers B2B organization support with per-organization login methods and just-in-time provisioning.

That matters more than it used to. AI-coded products with free tiers attract automated abuse quickly, and the usual defences of a CAPTCHA and an email check stop very little. Being able to fingerprint a device and refuse the hundredth account from it is often the difference between a working free tier and one that gets drained by scripts. Rate limiting and session revocation come with the platform, which matters when a signup endpoint is being probed continuously.

Why connect it through Squiid

Stytch is on the Squiid roadmap. When it lands, Squiid will provision the project, hold the secret and route backend calls through https://api.squiid.io/v1/stytch/... with Authorization: Bearer $SQUIID_API_KEY, with SDKs working by base URL swap (gateway convention). Active users, fingerprinting requests and plan cost will bill at Stytch's listed price on one Squiid invoice, alongside the model spend that abuse protection is often there to defend. Fingerprinting verdicts are returned as a signal your own code acts on, rather than a block imposed without your knowledge. One credential also covers the fraud endpoints, which are called on paths where an extra vendor key is easy to forget.

• One account, one key, one bill, one dashboard. Stytch sits beside every other service your project uses, on the same invoice and the same credit balance.
• Key custody. Squiid holds the Stytch credentials. Your code carries SQUIID_API_KEY, so STYTCH_PROJECT_ID, STYTCH_SECRET, STYTCH_PUBLIC_TOKEN never land in a repository, a preview deployment or an agent’s context.
• Metering you can see. Every call is counted per service and per day, so you know what Stytch costs before the month ends.
• Pause on zero. When prepaid credits run out the gateway stops authorizing usage instead of running up a bill you did not fund.
• One rotation. Rotating the Squiid key cuts off every agent, worker and deployment at once, with no provider key to hunt down.

What you get

• A provisioned Stytch project with the secret held by Squiid
• Magic links, passkeys and one-time passcodes
• Device fingerprinting and bot detection
• Headless SDKs or prebuilt UI
• Stytch list pricing, no markup

How to connect Stytch

One variable replaces the provider credentials this service would normally need. Requests go to the gateway and the official SDKs work by pointing their base URL at it (gateway convention).

# .env
# replaces STYTCH_PROJECT_ID, STYTCH_SECRET, STYTCH_PUBLIC_TOKEN
SQUIID_API_KEY=sq_live_xxxxxxxxxxxxxxxxxxxxxxxx

# every request: https://api.squiid.io/v1/stytch/...
# header:       Authorization: Bearer $SQUIID_API_KEY

Pricing through Squiid

Stytch charges by monthly active users with fraud products priced per request, at the provider's listed price. Squiid passes that through at par: one dollar of prepaid credit is one dollar of Stytch usage, with no markup and no per-request margin.

Stytch has no subscription attached on Squiid today. If a plan is required for a feature you need, it passes through at the provider’s listed price with no Squiid fee.

Squiid adds no markup to provider prices. There is a free plan at $0 a month with a 15% fee when you top up credits, Solo at $19.97 a month with a top-up fee that starts at 8% and falls to 3.5% as your spend grows, Team from $29.97 a seat a month with the same ladder one point lower, and Custom with a rate of 3% or less. Credits are prepaid, so Stytch usage stops when the balance reaches zero rather than producing an invoice you did not fund. Auto top-up with a cap keeps production running without handing anyone an open-ended card.

If you leave

Export: users are exported from Stytch, with password hashes where Stytch supports it, and imported into an instance in your own account. Squiid never owns your code, your schema or your domain, and the gateway speaks Stytch's own API, so the client change is a base URL. The handover page lists what happens for every provider in the catalogue.

Works with every coding agent

Stytch through Squiid is just an HTTP call with a bearer token, so every agentic coding tool can use it with the single key already in your environment:

• Claude Code
• Cursor
• ChatGPT
• Codex
• Grok
• Gemini CLI
• GitHub Copilot
• Windsurf
• Perplexity
• Devin
• Replit
• v0
• Lovable
• Cline

Vibe coding a feature on Stytch usually means asking for it in plain language and letting the agent write the integration. Because the key is Squiid’s rather than the provider’s, it can do that without ever holding a credential that could be leaked, logged or committed.