Integrating SailPoint with Stytch

Stytch is an identity and access management company that provides a developer-first platform for authentication and user management. It helps businesses build secure, seamless, and scalable login flows with a comprehensive suite of APIs for methods like passwordless magic links, OTPs, OAuth, biometrics, and B2B-focused features like organization management and SSO.

This document provides instructions to configure a new direct connection to a Stytch source.

For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Supported Features

The Stytch connector supports the following:

Account Management

• Aggregate Accounts

Entitlement Management

• Aggregate Groups
• Aggregate Roles

Supported Managed System

• Stytch API (v1)

Prerequisites

To successfully integrate with and manage the Stytch system, the following prerequisites must be met. These credentials allow for secure authentication and access to the Stytch API for user management and authentication workflows.

• Admin Access to the Stytch Dashboard

  You must have administrative or member access to your organization's Stytch Dashboard. This is required to access API keys, configure project settings, and view user data.

• An Active Stytch Project

  Your integration will be scoped to a specific project within your Stytch account. You will need credentials for the environment you intend to use (either Test or Live).

• API Key Authentication Credentials

  Stytch uses a project_id and a secret to authenticate API requests. Both are required for a successful connection.

  • project_id: A unique public identifier for your Stytch project.
  • secret: A private API key used to authenticate server-side requests to the Stytch API. This key must be kept confidential.

• Official Documentation for Generating Credentials

  For detailed instructions on how to locate your Project ID and Secret within the Stytch Dashboard, refer to the official developer documentation:

  Reference: B2B SaaS Authentication API Reference - API keys

  Note

  The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

Stytch's authentication model differs from systems that rely on granular OAuth scopes. Access is primarily controlled through API keys, which grant broad access to a project's resources, and role-based access control for users of the Stytch Dashboard.

1. API Key Authentication

   The primary method for granting permissions to an application or service is by providing it with your Project's API keys. Stytch provides two distinct sets of keys for different environments.

   • Test API Keys: Used for development and testing purposes. All API requests made with these keys operate in a sandboxed test environment and will not affect your live user data.
   • Live API Keys: Used for your production application. These keys interact with your real user data and live configuration. They should be kept confidential and stored securely.

   Each set of keys consists of a project_id and a secret. The secret is the sensitive credential that authenticates your API requests.

   Permissions Granted by API Keys:

   A Stytch API key (project_id and secret) grants full programmatic access to all API endpoints associated with that Project. This includes, but is not limited to, the ability to:

   • Authenticate users (Magic Links, OTPs, OAuth, etc.)
   • Create, retrieve, update, and delete users
   • Manage organizations and members (B2B products)
   • Manage sessions
   • Validate JWTs

   Important

   Unlike OAuth 2.0, Stytch does not currently provide granular, scope-based permissions to restrict an API key's access to specific endpoints (e.g., a "read-only" API key). A valid key grants comprehensive access to its corresponding environment (Test or Live).

   For instructions on how to locate your keys, refer to Stytch API keys in the Stytch documentation.

   Note

   The linked document is not maintained by SailPoint and is subject to change without notice.

2. Dashboard User Roles & Permissions

   To manage managing access to the Stytch Dashboard itself, Stytch uses a Role-Based Access Control (RBAC) system. These permissions are for human users managing the project and do not apply to API requests.

   The predefined roles are:

   • Owner: Has full access to the project, including managing billing, deleting the project, and managing team members.
   • Admin: Has full access to configure project settings and view data but cannot manage billing or team members.
   • Read-only: Can view all project settings and data but cannot make any changes.

Summary of Permissions