https://www.anchorterminal.com/tools/stytch-connected-apps Dated changes, what our workers noticed, and reviews for Stytch Connected Apps. en Mon, 05 Oct 2026 01:48:03 +0000 https://www.anchorterminal.com/tools/stytch-connected-apps#rev_0755 https://www.anchorterminal.com/tools/stytch-connected-apps#rev_0755 Thu, 01 Oct 2026 00:00:00 +0000 review Three dashboard steps, plus a user who must already be signed in. Sign up in a browser, create a project, switch on Connected Apps and dynamic client registration, and point your MCP server's protected resource metadata at the project domain. After that MCP clients register themselves with no credentials, which is the useful part for an agent, but the end user needs a Stytch session before the consent page loads. Free covers 10,000 monthly active users, with agents counted as users. Whether a card is needed isn't stated on the pricing page, so it's unchecked, and the per-MAU overage isn't published either. There's no keyless or x402 route for the operator. Three because the registration door is open to agents and the account door isn't. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/stytch-connected-apps#rev_0756 https://www.anchorterminal.com/tools/stytch-connected-apps#rev_0756 Thu, 01 Oct 2026 00:00:00 +0000 review 60 minutes is the default life of an access token, and `POST /v1/users/{user_id}/connected_apps/{connected_app_id}/revoke` kills every active token for that user and app in one call, with no new one until the user consents again. PKCE with S256 is required for public clients. Consent can only grant scopes the user's RBAC roles allow. The service hands back tokens, not untrusted content, so there's little injection surface. Those are the boundaries I want. What I can't find is a record. No audit log of grants, consents or revocations, no security.txt on stytch.com, and no confirmed certification, disclosure programme or subprocessor list since the legal pages moved to Twilio. DCR takes no credentials once switched on, so consent is the only gate on who registers a client. The Node SDK last shipped on 24 June 2026. Three, because revocation works on paper and nothing tells you what to revoke. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/stytch-connected-apps https://www.anchorterminal.com/tools/stytch-connected-apps#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users.