AI agents & Connected Apps - Stytch Docs

Agent-ready authentication

As AI agents gain the ability to access applications, Stytch Connected Apps provides the infrastructure to securely authenticate and authorize agent interactions—without rebuilding your auth system.

• OAuth 2.0 & OIDC compliant: Turn your app into an authorization server that AI agents and third-party apps can securely connect to
• MCP server ready: Native support for the Model Context Protocol, enabling Claude, ChatGPT, and other AI agents to access your app’s resources
• Works with existing auth: Add agent authentication to your current auth stack with no migration required
• Granular consent management: Users control exactly what data and actions agents can access, with org-level visibility for IT admins
• Token lifecycle management: Issue, validate, refresh, and revoke access tokens with full control over expiration and scopes
• Enterprise controls: Org-wide allowlists, audit logs, and one-click revocation for compliance and security teams

Core capabilities

Build an authorization server \ \Use Stytch’s pre-built UI components or headless SDK to create an OAuth-compliant authorization endpoint.

MCP server integration \ \Connect AI agents to your app via the Model Context Protocol with dynamic registration and scoped access.

Custom OAuth scopes \ \Define granular permissions based on real actions and resources in your app.

Client types \ \Configure first-party, third-party, confidential, and public clients with appropriate security controls.

Token management \ \Issue access tokens, refresh tokens, and ID tokens with built-in validation and revocation.

Consent management \ \View connected apps, authorized scopes, and revoke access at the user or organization level.

Use cases

MCP servers on Cloudflare \ \Deploy MCP servers on Cloudflare Workers with Stytch handling authentication and authorization.

MCP servers on Vercel \ \Build MCP servers on Vercel’s edge runtime with secure token management.

CLI applications \ \Authenticate command-line tools using the Authorization Code Flow with PKCE for public clients.

Third-party integrations \ \Allow external developers to build apps that integrate with your platform through OAuth.

Start building

Connected Apps overview \ \Learn the fundamentals of OAuth, OIDC, and how Connected Apps works.

API reference \ \Complete API documentation for token exchange, consent management, and client configuration.