Stytch
- Free allowance
- Always free: 10,000 monthly active users and AI agents, unlimited organizations, 5 SSO or SCIM connections and 1,000 M2M tokens; usage beyond is billed pay as you go with no hard cap
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- cardcard required, phone unknown
- Binding limit
- write-gatedLive environment endpoints answer billing_not_verified until credit card details are added, and the error reference names none of them; email goes only to the sign-up address or addresses on its domain until then...
- Evidence
- documented37 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-03checked 2026-11-02 (live); stale on 2026-12-03
| Free tier | Always free: 10,000 monthly active users and AI agents, unlimited organizations, 5 SSO or SCIM connections and 1,000 M2M tokens; usage beyond is billed pay as you go with no hard cap unit users; metered on identity-count; A project has one Live and one Test environment by default. In the Live environment some endpoints answer billing_not_verified until credit card details are added, and the error reference names none of them; email goes only to the sign-up address or addresses on its domain until then, which a Stytch staff reply of 2024-11-14 on its forum applies to a Test environment too. SMS and WhatsApp are enabled for United States and Canada numbers by default, and other countries need an allowlist entry and credit card details. Dashboard seats are unlimited. |
|---|---|
| Price | none stated |
| Limits |
|
| Binding | write-gated Without a card on file the Live environment cannot email arbitrary users, so a public app with email login meets the card gate before the 10,000 MAU allowance. |
| Identity | card Sign-up takes a Google, GitHub or single sign-on login or an email address, and the sign-up flow asks which authentication type to set up, such as B2B Authentication, before it creates a first project. The Test environment works without payment details; Live-environment endpoints answer billing_not_verified until credit card details are added, and email to addresses outside the sign-up domain needs them too, in a Test environment as well. Whether a later step asks for a phone number is unverified: behind a sign-up. |
| Egress | not applicable: an authentication API; no traffic allowance or egress term is published |
| Per-object cap | a metadata object (trusted_metadata or untrusted_metadata) of a user or member holds at most 20 top-level keys and cannot exceed 4KB in size |
| Retention | unverified: no data or log retention period is stated on the pages read |
| Interface | rest REST API with JSON responses and HTTP Basic auth (project_id and secret); Test environments at test.stytch.com and the Live environment at api.stytch.com. A GET to a user on test.stytch.com without credentials answered 400 invalid_authorization_header. An OpenID configuration endpoint per project for Connected Apps implements OpenID Connect discovery and lists the OAuth 2.0 grant types supported. endpoint: https://api.stytch.com/v1 |
| Tooling | Stytch backend SDKs for Node, Python, Ruby, Go and Java, front-end SDKs, or any HTTP client with Basic auth. |
| Composes with | Passwordless or OAuth login for an app on free compute; building and testing in a Test environment needs no card. |
| Reliability | Rate limits answer 429 and reset at the top of the interval; a limit reached for a field or user generally cannot be reset. |
| Notes | Custom branding is a USD 99 add-on, SSO or SCIM connections past 5 are USD 125 each, and fraud fingerprints past 10,000 are USD 0.005 each. |
| Evidence note | documented Every value is quoted from the first-party pricing page, API reference, error reference and sign-up page; the Test API host was probed and answered 400 invalid_authorization_header without credentials. Which Live endpoints are card-gated is not listed on the pages read. |
| Parsed numbers |
|
Evidence 37
| date | source | what it proved |
|---|---|---|
| 2026-10-30 | stytch.com/pricing | the free allowance is 10,000 MAUs and AI agents, unlimited organizations, 5 SSO or SCIM connections and 1,000 M2M tokens |
| 2026-10-30 | stytch.com/pricing | dashboard seats are unlimited |
| 2026-10-30 | stytch.com/pricing | part of the text of Notes, above |
| 2026-10-30 | stytch.com/pricing | SSO or SCIM connections past 5 cost USD 125 each |
| 2026-10-30 | stytch.com/pricing | fingerprints past 10,000 cost USD 0.005 each |
| 2026-10-31 | stytch.com/pricing | there is no hard cap on the free allowance |
| 2026-10-31 | stytch.com/pricing | usage above the free tier is billed |
| 2026-10-30 | stytch.com/docs/api-reference/consumer/api/errors/400 | some Live endpoints need credit card details on the account |
| 2026-10-30 | stytch.com/docs/api-reference/consumer/api/errors/400 | email goes only to the sign-up domain until a card is added |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | the API is REST with JSON |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | direct calls use HTTP Basic auth |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | a project has one Live and one Test environment |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | Test environments are served at test.stytch.com |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | the Live environment is served at api.stytch.com |
| 2026-10-31 | stytch.com/docs/api-reference/consumer/api/overview.md | a Node backend SDK exists |
| 2026-10-31 | stytch.com/dashboard/start-now | a front-end SDK for Next.js exists |
| 2026-10-30 | stytch.com/docs/resources/platform/rate-limits | Test environments send at most 60 SMS OTP codes an hour per project |
| 2026-10-30 | stytch.com/docs/resources/platform/rate-limits | rate limit intervals reset at the top of the interval |
| 2026-10-30 | stytch.com/docs/resources/platform/rate-limits | a reached rate limit generally cannot be reset |
| 2026-10-30 | stytch.com/docs/resources/policies/messaging/overview | SMS and WhatsApp reach US and Canada numbers by default |
| 2026-10-31 | stytch.com/dashboard/start-now | the sign-up takes Google, GitHub, single sign-on or an email address |
| 2026-10-31 | probe: https://test.stytch.com/v1/users/user-test-00000000-0000-0000-0000-000000000000 | test.stytch.com answers a request without credentials with invalid_authorization_header |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/resources/metadat | a Stytch metadata object holds at most 20 top-level keys and cannot exceed 4KB |
| 2026-11-01 | stytch.com/docs/api-reference/b2b/api/members/overview | B2B member metadata has the same limits: 20 top-level keys and 4KB per metadata object |
| 2026-11-01 | changelog.stytch.com/announcements/2022-11-04-release | user metadata objects are limited to 20 top-level keys and 4KB in total |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/errors/400 | the billing_not_verified error says an endpoint cannot be used in the Live environment until credit card details are added, and names no endpoint |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/errors/400 | billing_not_verified_for_email limits email to the sign-up address and its domain until credit card details are added |
| 2026-11-01 | stytch.com/docs/api-reference/b2b/api/errors/400 | the B2B API answers country_code_allowlist_billing_not_verified for allowlist updates until credit card details are added |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/errors/400 | SMS outside the United States and Canada is off by default for newer customers |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/errors/400 | enabling international SMS needs credit card details on the account besides an allowlist entry |
| 2026-11-01 | forum.stytch.com/t/magic-link-fails-billing-not-verified-for | a Stytch staff reply of 2024-11-14, read in an archived copy of 2025-05-20, says a Test environment user needs a credit card to email addresses other than the sign-up address |
| 2026-11-01 | forum.stytch.com/t/magic-link-fails-billing-not-verified-for | the forum post describes a request made against a Test environment |
| 2026-11-01 | forum.stytch.com/t/magic-link-fails-billing-not-verified-for | a Stytch staff reply calls the email restriction intended behaviour |
| 2026-11-01 | github.com/stytchauth/stytch-b2b-node-example | the sign-up flow asks for an authentication type such as B2B Authentication and then creates a first project |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/connected-apps/co | the Connected Apps OpenID configuration endpoint implements OpenID Connect discovery |
| 2026-11-01 | stytch.com/docs/api-reference/consumer/api/connected-apps/co | the OpenID configuration lists the OAuth 2.0 grant types supported |
| 2026-11-01 | stytch.com/dashboard/start-now | the sign-up page offers Google, GitHub, single sign-on and an email address |