openapi: 3.0.3
info:
title: Stytch B2B Authentication Application Password API
version: 2.0.0
description: Stytch's B2B API for multi-tenant authentication. Supports Organizations, Members, SSO (SAML/OIDC), Magic Links, OTP, OAuth, Discovery, Sessions, B2B RBAC, SCIM, TOTP, Recovery Codes, Passwords, Impersonation, and the B2B IDP.
contact:
name: Stytch
url: https://stytch.com/docs
license:
name: Proprietary
servers:
- url: https://api.stytch.com
description: Production
- url: https://test.stytch.com
description: Test
tags:
- name: Password
paths:
/v1/b2b/passwords/strength_check:
post:
summary: Strengthcheck
operationId: api_b2b_password_v1_StrengthCheck
tags:
- Password
description: 'This API allows you to check whether the user’s provided password is valid, and to provide feedback to the user on how to increase the strength of their password.
This endpoint adapts to your Project''s password strength configuration.
If you''re using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the default, your passwords are considered valid if the strength score is >= 3.
If you''re using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), your passwords are considered valid if they meet the requirements that you''ve set with Stytch.
You may update your password strength configuration on the [Passwords Policy page](https://stytch.com/dashboard/password-strength-config) in the Stytch Dashboard.
## Password feedback
The `zxcvbn_feedback` and `luds_feedback` objects contains relevant fields for you to relay feedback to users that failed to create a strong enough password.
If you''re using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain warning and suggestions for any password that does not meet the [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) strength requirements. You can return these strings directly to the user to help them craft a strong password.
If you''re using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain a collection of fields that the user failed or passed. You''ll want to prompt the user to create a password that meets all requirements that they failed.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_StrengthCheckRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_StrengthCheckResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/passwords/strength_check\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n password: \"${examplePassword}\",\n};\n\nclient.Passwords.StrengthCheck(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/passwords/strength_check\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.StrengthCheckParams{\n\t\tPassword: \"${examplePassword}\",\n\t}\n\n\tresp, err := client.Passwords.StrengthCheck(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/passwords/strength_check\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.StrengthCheckRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n StrengthCheckRequest params = new StrengthCheckRequest();\n params.setPassword(\"${examplePassword}\");\n\n Object result = StytchB2BClient.getPasswords().strengthCheck(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/passwords/strength_check\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.StrengthCheckRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.passwords.strengthCheck(\n StrengthCheckRequest(\n password = \"${examplePassword}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/passwords/strength_check\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n password: \"${examplePassword}\",\n};\n\nclient.passwords.strengthCheck(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->passwords->strength_check([\n 'password' => '${examplePassword}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/passwords/strength_check\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.passwords.strength_check(\n password=\"${examplePassword}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/passwords/strength_check\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.passwords.strength_check(\n password: \"${examplePassword}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/passwords/strength_check\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::StrengthCheckRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.passwords.strength_check(\n StrengthCheckRequest{\n password: \"${examplePassword}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/passwords/strength_check\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/passwords/strength_check \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"password\": \"${examplePassword}\"\n }'"
/v1/b2b/passwords/migrate:
post:
summary: Migrate
operationId: api_b2b_password_v1_Migrate
tags:
- Password
description: "\n**Warning:** This endpoint marks the Member's email address as verified. Do **not** use this endpoint unless the user has already verified their email address in your application. \n\nAdds an existing password to a Member's email that doesn't have a password yet.\n\nWe support migrating members from passwords stored with bcrypt, scrypt, argon2, MD-5, SHA-1, SHA-512, and PBKDF2. This endpoint has a rate limit of 100 requests per second.\n\nThe Member's email will be marked as verified when you use this endpoint.\n\nIf you are using **cross-organization passwords**, i.e. allowing an end user to share the same password across all of their Organizations, call this method separately for each `organization_id` associated with the given `email_address` to ensure the password is set across all of their Organizations."
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_MigrateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_MigrateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/passwords/migrate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n email_address: \"${email}\",\n hash: \"${examplePasswordBcryptHash}\",\n hash_type: \"bcrypt\",\n organization_id: \"${organizationId}\",\n external_id: \"my-new-external-id\",\n};\n\nclient.Passwords.Migrate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/passwords/migrate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.MigrateParams{\n\t\tEmailAddress: \"${email}\",\n\t\tHash: \"${examplePasswordBcryptHash}\",\n\t\tHashType: passwords.MigrateRequestHashTypeBcrypt,\n\t\tOrganizationID: \"${organizationId}\",\n\t\tExternalID: \"my-new-external-id\",\n\t}\n\n\tresp, err := client.Passwords.Migrate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/passwords/migrate\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.MigrateRequest;\nimport com.stytch.java.b2b.models.passwords.MigrateRequestHashType;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n MigrateRequest params = new MigrateRequest();\n params.setEmailAddress(\"${email}\");\n params.setHash(\"${examplePasswordBcryptHash}\");\n params.setHashType(MigrateRequestHashType.BCRYPT);\n params.setOrganizationId(\"${organizationId}\");\n params.setExternalId(\"my-new-external-id\");\n\n Object result = StytchB2BClient.getPasswords().migrate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/passwords/migrate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.MigrateRequest\nimport com.stytch.java.b2b.models.passwords.MigrateRequestHashType\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.passwords.migrate(\n MigrateRequest(\n emailAddress = \"${email}\",\n hash = \"${examplePasswordBcryptHash}\",\n hashType = MigrateRequestHashType.BCRYPT,\n organizationId = \"${organizationId}\",\n externalId = \"my-new-external-id\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/passwords/migrate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n email_address: \"${email}\",\n hash: \"${examplePasswordBcryptHash}\",\n hash_type: \"bcrypt\",\n organization_id: \"${organizationId}\",\n external_id: \"my-new-external-id\",\n};\n\nclient.passwords.migrate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->passwords->migrate([\n 'email_address' => '${email}',\n 'hash' => '${examplePasswordBcryptHash}',\n 'hash_type' => 'bcrypt',\n 'organization_id' => '${organizationId}',\n 'external_id' => 'my-new-external-id',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/passwords/migrate\nfrom stytch import B2BClient\nfrom stytch.b2b.models.passwords import MigrateRequestHashType\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.passwords.migrate(\n email_address=\"${email}\",\n hash=\"${examplePasswordBcryptHash}\",\n hash_type=MigrateRequestHashType.BCRYPT,\n organization_id=\"${organizationId}\",\n external_id=\"my-new-external-id\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/passwords/migrate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.passwords.migrate(\n email_address: \"${email}\",\n hash: \"${examplePasswordBcryptHash}\",\n hash_type: \"bcrypt\",\n organization_id: \"${organizationId}\",\n external_id: \"my-new-external-id\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/passwords/migrate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::MigrateRequest;\nuse stytch::b2b::passwords::MigrateRequestHashType;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.passwords.migrate(\n MigrateRequest{\n email_address: \"${email}\",\n hash: \"${examplePasswordBcryptHash}\",\n hash_type: MigrateRequestHashType::BCRYPT,\n organization_id: \"${organizationId}\",\n external_id: Some(String::from(\"my-new-external-id\")),\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/passwords/migrate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/passwords/migrate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"email_address\": \"${email}\",\n \"hash\": \"${examplePasswordBcryptHash}\",\n \"hash_type\": \"bcrypt\",\n \"organization_id\": \"${organizationId}\",\n \"external_id\": \"my-new-external-id\"\n }'"
/v1/b2b/passwords/authenticate:
post:
summary: Authenticate
operationId: api_b2b_password_v1_Authenticate
tags:
- Password
description: 'Authenticate a member with their email address and password. This endpoint verifies that the member has a password currently set, and that the entered password is correct.
If you have breach detection during authentication enabled in your [password strength policy](https://stytch.com/docs/b2b/guides/passwords/strength-policy) and the member''s credentials have appeared in the HaveIBeenPwned dataset, this endpoint will return a `member_reset_password` error even if the member enters a correct password. We force a password reset in this case to ensure that the member is the legitimate owner of the email address and not a malicious actor abusing the compromised credentials.
If the Member is required to complete MFA to log in to the Organization, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.
The `intermediate_session_token` can be passed into the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms) to complete the MFA step and acquire a full member session.
The `session_duration_minutes` and `session_custom_claims` parameters will be ignored.
If a valid `session_token` or `session_jwt` is passed in, the Member will not be required to complete an MFA step.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_password_v1_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/passwords/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n email_address: \"${email}\",\n password: \"${examplePassword}\",\n};\n\nclient.Passwords.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/passwords/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/passwords\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.AuthenticateParams{\n\t\tOrganizationID: \"${organizationId}\",\n\t\tEmailAddress: \"${email}\",\n\t\tPassword: \"${examplePassword}\",\n\t}\n\n\tresp, err := client.Passwords.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/passwords/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.passwords.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setOrganizationId(\"${organizationId}\");\n params.setEmailAddress(\"${email}\");\n params.setPassword(\"${examplePassword}\");\n\n Object result = StytchB2BClient.getPasswords().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/passwords/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.passwords.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.passwords.authenticate(\n AuthenticateRequest(\n organizationId = \"${organizationId}\",\n emailAddress = \"${email}\",\n password = \"${examplePassword}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/passwords/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n email_address: \"${email}\",\n password: \"${examplePassword}\",\n};\n\nclient.passwords.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->passwords->authenticate([\n 'organization_id' => '${organizationId}',\n 'email_address' => '${email}',\n 'password' => '${examplePassword}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/passwords/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.passwords.authenticate(\n organization_id=\"${organizationId}\",\n email_address=\"${email}\",\n password=\"${examplePassword}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/passwords/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.passwords.authenticate(\n organization_id: \"${organizationId}\",\n email_address: \"${email}\",\n password: \"${examplePassword}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/passwords/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::passwords::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.passwords.authenticate(\n AuthenticateRequest{\n organization_id: \"${organizationId}\",\n email_address: \"${email}\",\n password: \"${examplePassword}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/passwords/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/passwords/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"organization_id\": \"${organizationId}\",\n \"email_address\": \"${email}\",\n \"password\": \"${examplePassword}\"\n }'"
/v1/passwords:
post:
summary: Create
operationId: api_password_v1_Create
tags:
- Password
description: 'Create a new user with a password. If `session_duration_minutes` is specified, a new session will be started as well.
If a user with this email already exists in your Stytch project, this endpoint will return a `duplicate_email` error. To add a password to an existing passwordless user, you''ll need to either call the [Migrate password endpoint](https://stytch.com/docs/api/password-migrate) or prompt the user to complete one of our password reset flows.
This endpoint will return an error if the password provided does not meet our strength requirements, which you can check beforehand via the [Password strength check endpoint](https://stytch.com/docs/api/password-strength-check).
When creating new Passwords users, it''s good practice to enforce an email verification flow. We''d recommend checking out our [Email verification guide](https://stytch.com/docs/guides/passwords/email-verification/overview) for more information.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_password_v1_CreateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_password_v1_CreateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/passwords\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n email: \"${email}\",\n password: \"${examplePassword}\",\n session_duration_minutes: 60,\n};\n\nclient.Passwords.Create(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/passwords\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/passwords\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &passwords.CreateParams{\n\t\tEmail: \"${email}\",\n\t\tPassword: \"${examplePassword}\",\n\t\tSessionDurationMinutes: 60,\n\t}\n\n\tresp, err := client.Passwords.Create(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/passwords\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.passwords.CreateRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n public static void main(String[] args) {\n StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n CreateRequest params = new CreateRequest();\n params.setEmail(\"${email}\");\n params.setPassword(\"${examplePassword}\");\n params.setSessionDurationMinutes(60);\n\n Object result = StytchClient.getPasswords().create(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/passwords\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.passwords.CreateRequest\n\nfun main() {\n StytchClient.configure
# --- truncated at 32 KB (184 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-password-api-openapi.yml