Stytch Password API

openapi: 3.2.0
info:
  title: Stytch Password API
  version: '1.0'
  description: 'Operations tagged Password across 3 of this provider''s published API definitions: stytch-b2b-openapi.yml, stytch-consumer-openapi.yml, stytch-management-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stytch.com
  description: Production
- url: https://test.stytch.com
  description: Test
- url: https://management.stytch.com
  description: Production server
tags:
- name: Password
paths:
  /v1/b2b/passwords/strength_check:
    post:
      summary: Strengthcheck
      operationId: api_b2b_password_v1_StrengthCheck
      tags:
      - Password
      description: 'This API allows you to check whether the user’s provided password is valid, and to provide feedback to the user on how to increase the strength of their password.


        This endpoint adapts to your Project''s password strength configuration.

        If you''re using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the default, your passwords are considered valid if the strength score is >= 3.

        If you''re using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), your passwords are considered valid if they meet the requirements that you''ve set with Stytch.

        You may update your password strength configuration on the [Passwords Policy page](https://stytch.com/dashboard/password-strength-config) in the Stytch Dashboard.


        ## Password feedback

        The `zxcvbn_feedback` and `luds_feedback` objects contains relevant fields for you to relay feedback to users that failed to create a strong enough password.


        If you''re using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain warning and suggestions for any password that does not meet the [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) strength requirements. You can return these strings directly to the user to help them craft a strong password.


        If you''re using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain a collection of fields that the user failed or passed. You''ll want to prompt the user to create a password that meets all requirements that they failed.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_b2b_password_v1_StrengthCheckRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_b2b_password_v1_StrengthCheckResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/b2b/passwords/strength_check\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  password: \"${examplePassword}\",\n};\n\nclient.Passwords.StrengthCheck(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/b2b/passwords/strength_check\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.StrengthCheckParams{\n\t\tPassword: \"${examplePassword}\",\n\t}\n\n\tresp, err := client.Passwords.StrengthCheck(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/b2b/passwords/strength_check\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.StrengthCheckRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n        StrengthCheckRequest params = new StrengthCheckRequest();\n        params.setPassword(\"${examplePassword}\");\n\n        Object result = StytchB2BClient.getPasswords().strengthCheck(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/b2b/passwords/strength_check\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.StrengthCheckRequest\n\nfun main() {\n    StytchB2BClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchB2BClient.passwords.strengthCheck(\n                StrengthCheckRequest(\n                    password = \"${examplePassword}\",\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/b2b/passwords/strength_check\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  password: \"${examplePassword}\",\n};\n\nclient.passwords.strengthCheck(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->passwords->strength_check([\n    'password' => '${examplePassword}',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/b2b/passwords/strength_check\nfrom stytch import B2BClient\n\nclient = B2BClient(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.passwords.strength_check(\n    password=\"${examplePassword}\",\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/b2b/passwords/strength_check\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.passwords.strength_check(\n  password: \"${examplePassword}\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/b2b/passwords/strength_check\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::StrengthCheckRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.passwords.strength_check(\n        StrengthCheckRequest{\n            password: \"${examplePassword}\",\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/b2b/passwords/strength_check\ncurl --request POST \\\n  --url https://test.stytch.com/v1/b2b/passwords/strength_check \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"password\": \"${examplePassword}\"\n  }'"
    servers:
    - url: https://api.stytch.com
      description: Production
    - url: https://test.stytch.com
      description: Test
  /v1/b2b/passwords/migrate:
    post:
      summary: Migrate
      operationId: api_b2b_password_v1_Migrate
      tags:
      - Password
      description: "\n**Warning:** This endpoint marks the Member's email address as verified. Do **not** use this endpoint unless the user has already verified their email address in your application. \n\nAdds an existing password to a Member's email that doesn't have a password yet.\n\nWe support migrating members from passwords stored with bcrypt, scrypt, argon2, MD-5, SHA-1, SHA-512, and PBKDF2. This endpoint has a rate limit of 100 requests per second.\n\nThe Member's email will be marked as verified when you use this endpoint.\n\nIf you are using **cross-organization passwords**, i.e. allowing an end user to share the same password across all of their Organizations, call this method separately for each `organization_id` associated with the given `email_address` to ensure the password is set across all of their Organizations."
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_b2b_password_v1_MigrateRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_b2b_password_v1_MigrateResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/b2b/passwords/migrate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  email_address: \"${email}\",\n  hash: \"${examplePasswordBcryptHash}\",\n  hash_type: \"bcrypt\",\n  organization_id: \"${organizationId}\",\n  external_id: \"my-new-external-id\",\n};\n\nclient.Passwords.Migrate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/b2b/passwords/migrate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.MigrateParams{\n\t\tEmailAddress:   \"${email}\",\n\t\tHash:           \"${examplePasswordBcryptHash}\",\n\t\tHashType:       passwords.MigrateRequestHashTypeBcrypt,\n\t\tOrganizationID: \"${organizationId}\",\n\t\tExternalID:     \"my-new-external-id\",\n\t}\n\n\tresp, err := client.Passwords.Migrate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/b2b/passwords/migrate\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.MigrateRequest;\nimport com.stytch.java.b2b.models.passwords.MigrateRequestHashType;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n        MigrateRequest params = new MigrateRequest();\n        params.setEmailAddress(\"${email}\");\n        params.setHash(\"${examplePasswordBcryptHash}\");\n        params.setHashType(MigrateRequestHashType.BCRYPT);\n        params.setOrganizationId(\"${organizationId}\");\n        params.setExternalId(\"my-new-external-id\");\n\n        Object result = StytchB2BClient.getPasswords().migrate(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/b2b/passwords/migrate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.MigrateRequest\nimport com.stytch.java.b2b.models.passwords.MigrateRequestHashType\n\nfun main() {\n    StytchB2BClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchB2BClient.passwords.migrate(\n                MigrateRequest(\n                    emailAddress = \"${email}\",\n                    hash = \"${examplePasswordBcryptHash}\",\n                    hashType = MigrateRequestHashType.BCRYPT,\n                    organizationId = \"${organizationId}\",\n                    externalId = \"my-new-external-id\",\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/b2b/passwords/migrate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  email_address: \"${email}\",\n  hash: \"${examplePasswordBcryptHash}\",\n  hash_type: \"bcrypt\",\n  organization_id: \"${organizationId}\",\n  external_id: \"my-new-external-id\",\n};\n\nclient.passwords.migrate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->passwords->migrate([\n    'email_address' => '${email}',\n    'hash' => '${examplePasswordBcryptHash}',\n    'hash_type' => 'bcrypt',\n    'organization_id' => '${organizationId}',\n    'external_id' => 'my-new-external-id',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/b2b/passwords/migrate\nfrom stytch import B2BClient\nfrom stytch.b2b.models.passwords import MigrateRequestHashType\n\nclient = B2BClient(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.passwords.migrate(\n    email_address=\"${email}\",\n    hash=\"${examplePasswordBcryptHash}\",\n    hash_type=MigrateRequestHashType.BCRYPT,\n    organization_id=\"${organizationId}\",\n    external_id=\"my-new-external-id\",\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/b2b/passwords/migrate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.passwords.migrate(\n  email_address: \"${email}\",\n  hash: \"${examplePasswordBcryptHash}\",\n  hash_type: \"bcrypt\",\n  organization_id: \"${organizationId}\",\n  external_id: \"my-new-external-id\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/b2b/passwords/migrate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::MigrateRequest;\nuse stytch::b2b::passwords::MigrateRequestHashType;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.passwords.migrate(\n        MigrateRequest{\n            email_address: \"${email}\",\n            hash: \"${examplePasswordBcryptHash}\",\n            hash_type: MigrateRequestHashType::BCRYPT,\n            organization_id: \"${organizationId}\",\n            external_id: Some(String::from(\"my-new-external-id\")),\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/b2b/passwords/migrate\ncurl --request POST \\\n  --url https://test.stytch.com/v1/b2b/passwords/migrate \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"email_address\": \"${email}\",\n    \"hash\": \"${examplePasswordBcryptHash}\",\n    \"hash_type\": \"bcrypt\",\n    \"organization_id\": \"${organizationId}\",\n    \"external_id\": \"my-new-external-id\"\n  }'"
    servers:
    - url: https://api.stytch.com
      description: Production
    - url: https://test.stytch.com
      description: Test
  /v1/b2b/passwords/authenticate:
    post:
      summary: Authenticate
      operationId: api_b2b_password_v1_Authenticate
      tags:
      - Password
      description: 'Authenticate a member with their email address and password. This endpoint verifies that the member has a password currently set, and that the entered password is correct.


        If you have breach detection during authentication enabled in your [password strength policy](https://stytch.com/docs/b2b/guides/passwords/strength-policy) and the member''s credentials have appeared in the HaveIBeenPwned dataset, this endpoint will return a `member_reset_password` error even if the member enters a correct password. We force a password reset in this case to ensure that the member is the legitimate owner of the email address and not a malicious actor abusing the compromised credentials.


        If the Member is required to complete MFA to log in to the Organization, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.

        The `intermediate_session_token` can be passed into the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms) to complete the MFA step and acquire a full member session.

        The `session_duration_minutes` and `session_custom_claims` parameters will be ignored.


        If a valid `session_token` or `session_jwt` is passed in, the Member will not be required to complete an MFA step.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_b2b_password_v1_AuthenticateRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_b2b_password_v1_AuthenticateResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/b2b/passwords/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  organization_id: \"${organizationId}\",\n  email_address: \"${email}\",\n  password: \"${examplePassword}\",\n};\n\nclient.Passwords.Authenticate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/b2b/passwords/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.AuthenticateParams{\n\t\tOrganizationID: \"${organizationId}\",\n\t\tEmailAddress:   \"${email}\",\n\t\tPassword:       \"${examplePassword}\",\n\t}\n\n\tresp, err := client.Passwords.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/b2b/passwords/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n        AuthenticateRequest params = new AuthenticateRequest();\n        params.setOrganizationId(\"${organizationId}\");\n        params.setEmailAddress(\"${email}\");\n        params.setPassword(\"${examplePassword}\");\n\n        Object result = StytchB2BClient.getPasswords().authenticate(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/b2b/passwords/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.AuthenticateRequest\n\nfun main() {\n    StytchB2BClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchB2BClient.passwords.authenticate(\n                AuthenticateRequest(\n                    organizationId = \"${organizationId}\",\n                    emailAddress = \"${email}\",\n                    password = \"${examplePassword}\",\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/b2b/passwords/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  organization_id: \"${organizationId}\",\n  email_address: \"${email}\",\n  password: \"${examplePassword}\",\n};\n\nclient.passwords.authenticate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->passwords->authenticate([\n    'organization_id' => '${organizationId}',\n    'email_address' => '${email}',\n    'password' => '${examplePassword}',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/b2b/passwords/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.passwords.authenticate(\n    organization_id=\"${organizationId}\",\n    email_address=\"${email}\",\n    password=\"${examplePassword}\",\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/b2b/passwords/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.passwords.authenticate(\n  organization_id: \"${organizationId}\",\n  email_address: \"${email}\",\n  password: \"${examplePassword}\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/b2b/passwords/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::AuthenticateRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.passwords.authenticate(\n        AuthenticateRequest{\n            organization_id: \"${organizationId}\",\n            email_address: \"${email}\",\n            password: \"${examplePassword}\",\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/b2b/passwords/authenticate\ncurl --request POST \\\n  --url https://test.stytch.com/v1/b2b/passwords/authenticate \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"organization_id\": \"${organizationId}\",\n    \"email_address\": \"${email}\",\n    \"password\": \"${examplePassword}\"\n  }'"
    servers:
    - url: https://api.stytch.com
      description: Production
    - url: https://test.stytch.com
      description: Test
  /v1/passwords:
    post:
      summary: Create
      operationId: api_password_v1_Create
      tags:
      - Password
      description: 'Create a new user with a password. If `session_duration_minutes` is specified, a new session will be started as well.


        If a user with this email already exists in your Stytch project, this endpoint will return a `duplicate_email` error. To add a password to an existing passwordless user, you''ll need to either call the [Migrate password endpoint](https://stytch.com/docs/api/password-migrate) or prompt the user to complete one of our password reset flows.


        This endpoint will return an error if the password provided does not meet our strength requirements, which you can check beforehand via the [Password strength check endpoint](https://stytch.com/docs/api/password-strength-check).


        When creating new Passwords users, it''s good practice to enforce an email verification flow. We''d recommend checking out our [Email verification guide](https://stytch.com/docs/guides/passwords/email-verification/overview) for more information.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_password_v1_CreateRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_password_v1_CreateResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/passwords\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  email: \"${email}\",\n  password: \"${examplePassword}\",\n  session_duration_minutes: 60,\n};\n\nclient.Passwords.Create(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/passwords\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/passwords\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.CreateParams{\n\t\tEmail:                  \"${email}\",\n\t\tPassword:               \"${examplePassword}\",\n\t\tSessionDurationMinutes: 60,\n\t}\n\n\tresp, err := client.Passwords.Create(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/passwords\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.passwords.CreateRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        CreateRequest params = new CreateRequest();\n        params.setEmail(\"${email}\");\n        params.setPassword(\"${examplePassword}\");\n        params.setSessionDurationMinutes(60);\n\n        Object result = StytchClient.getPasswords().create(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } 

# --- truncated at 32 KB (185 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-password-api-openapi.yml