This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Stytch is an identity platform for developers, and its MCP offer is built on a feature called Connected Apps. Connected Apps turns your app into an OAuth provider, so MCP clients like Claude or ChatGPT can sign users in and get scoped tokens for your remote MCP server. Stytch announced on 30 October 2025 that it has joined Twilio.
Checked against: Stytch's MCP server guide on 28 October 2026. eSEOspace did not test Stytch's products.
Key Takeaways
- Stytch's docs say "MCP Clients are a type of Connected App" that request access through the OAuth authorization code flow.
- Stytch hosts the authorization server metadata, client registration and token endpoints; your MCP server validates the tokens.
- Dynamic Client Registration (DCR) is opt-in, and Client ID Metadata Documents (CIMD) are offered as a beta.
- The free tier covers 10,000 monthly active users and AI agents, per Stytch's pricing page.
- Stytch says its compliance documents, including a SOC 2 report and ISO 27001 certification, are in the Twilio Trust Center.
At a glance
| Company | Stytch (part of Twilio) |
|---|---|
| What it offers for MCP | Connected Apps: OAuth provider for MCP clients, consent UI components, token validation |
| Who it's for | B2B and consumer apps adding a remote MCP server with user sign-in |
| Open source? | Hosted service; SDKs and examples published |
| Pricing | Free to 10,000 MAUs and agents; pay as you go after that |
What Stytch offers for MCP
The Stytch MCP guide splits the work into three actors:
- Your MCP server validates Stytch-issued tokens, returns a
401with aWWW-Authenticateheader, and serves protected resource metadata. - Your main app shows the consent screen. Stytch provides prebuilt components for this, and the user must already be logged in.
- The MCP client opens the authorization page and swaps the returned code for tokens.
Stytch hosts the rest. That includes authorization server metadata, client registration and the token endpoint. Your server can check tokens with Stytch's Introspect Access Token API or by validating the JWT itself.
Client registration
Stytch's client types page lists two automatic ways for MCP clients to register:
- DCR, turned on in the Connected Apps section of the dashboard. Stytch notes DCR has "numerous operational issues in large enterprise environments."
- CIMD (Beta), also turned on in the dashboard. The client uses an HTTPS URL as its ID, and Stytch fetches the metadata from it. Stytch warns that manual edits to such a client "may be overwritten" when it refreshes the document.
All dynamically registered and CIMD clients are treated as third-party clients, so users always see a consent screen. This matches the current spec, where CIMD is recommended and DCR is kept for older clients.
SDKs and examples
The guide covers Node with Express, Next.js through Vercel's MCP adapter, Python through FastMCP, and Hono. Stytch runs a reference MCP server at mcp.stytch.dev and links a Cloudflare demo.
On its agent-ready page, Stytch also lists org-level allowlists for which third-party apps and agents members may connect, and rate limiting for misbehaving agents.
Who it's for
Stytch fits a software company that wants its product reachable from AI apps through a remote MCP server. It suits both business (B2B) apps with organizations and consumer apps. Teams already using Stytch for login gain the most, since the consent screen runs inside the existing app.
It is an auth layer, not a gateway. It does not scan tools or filter tool calls.
Pricing
Stytch's pricing page shows two plans as of October 2026:
- Pay as you go: starts at $0 per month. The always-free allowance covers 10,000 monthly active users and AI agents, unlimited organizations, 5 SSO or SCIM connections and 1,000 machine-to-machine tokens.
- Enterprise: custom pricing, with a 99.99% uptime SLA and HIPAA BAA.
Above the free allowance, Stytch charges per extra active member or agent, but the page does not list the rate. Extra SSO or SCIM connections are $125 each. There is no separate price for Connected Apps or MCP.
Security and trust
Stytch's compliance page says its documents, "including our SOC 2 report, ISO 27001 certification, CAIQ, PCI-DSS, and more," are in the Twilio Trust Center.
On ownership, Stytch's own announcement of 30 October 2025 says "Stytch is now a part of Twilio." It says there are no immediate changes to contracts, pricing, SDKs, API keys or integrations.
Alternatives
- WorkOS offers AuthKit as an OAuth server for MCP, with a Standalone Connect mode.
- Auth0 offers Auth for MCP plus Token Vault for third-party API calls.
- Descope offers an Agentic Identity Hub with MCP server auth and policies.
Next step
Before you pick an auth provider, read how MCP authorization works end to end. Then compare vendors in our MCP companies hub. If you need a remote MCP server built, see our MCP development service.
Frequently asked questions
Is Stytch owned by Twilio?
Yes. Stytch announced on 30 October 2025 that it is now part of Twilio. Its homepage also says "Stytch has joined Twilio."
Does Stytch support CIMD for MCP clients?
Yes, as a beta. Stytch's client types page lists Client ID Metadata Documents as a beta option you enable in the Connected Apps dashboard. DCR is also available.
Do I need my own login to use Stytch for MCP?
Your app hosts the consent screen, and the user must be logged in first. Stytch's guide shows this with its React and JavaScript components for consumer and B2B apps.
Does Stytch charge extra for MCP?
The pricing page does not list a separate MCP price. AI agents count toward the free 10,000 monthly active users and agents. Machine-to-machine tokens are priced separately.
