Stytchstytch.com
Stytch's API program shows real strengths in agent discoverability and API design, where partners and their agents can already find and parse the surface with confidence. The critical gap is agent understanding: operation descriptions, structured documentation data, and agent-facing instruction files are all missing or inconsistent, meaning AI agents building on Stytch's APIs must guess at intent rather than act with certainty — slowing integrations and increasing support load.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass2 warn1 fail79B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Auth declared & discoverablevia spec | 25/25 | Authentication required (global or on every operation). Investigated: spec 100%, docs 100%. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
| warn | Schema coverage & depthvia sdk | 21.4/25 | 0/41 (0%) enum-like params are realized as constrained types (not bare strings). Investigated: sdk 86%, spec 83%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| warn | Machine-readable, versioned contractvia spec | 18.8/25 | info.version="2.1.1" set but no versioning scheme (URL / header / media type) detected. Investigated: spec 75%, docs 50%. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| pass | Example coveragevia spec | 10/10 | 58% example coverage (target 80%+). Investigated: spec 100%, docs 100%, sdk 100%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
| fail | Security & governance hygienevia spec | 0/15 | 22 credential-shaped strings detected in spec: private-key-pem (×22). Investigated: spec 0%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples3 pass1 warn1 fail67C
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Code samples in docsvia docs | 18/18 | Code samples present on 3/20 pages across 2 language(s); broader multi-language coverage missing. Investigated: docs 100%. | Multi-language samples shorten time-to-first-call. |
| pass | Description completenessvia spec | 15/15 | 83% description completeness (target 90%+). Investigated: spec 100%, sdk 100%. | Complete descriptions are the context humans and agents need to use endpoints. |
| pass | Changelog publishedvia spec | 13/13 | changelog documented in the docs site at https://stytch.com/docs/api-reference/b2b/frontend-sdks/react/changelog. Investigated: spec 100%, docs 100%, sdk 100%. | A published changelog lets partners track changes without surprise. |
| warn | Quickstart presentvia docs | 12.5/25 | Quickstart page reachable (12 variants scanned starting at https://stytch.com/docs/login?redirect=%2Fquickstart) but no runnable code sample detected in HTML or .md variant. Investigated: docs 50%. | A quickstart is the fastest path from landing page to first successful call. |
| fail | Self-service developer portalvia docs | 0/29 | No signup page detected across conventional paths (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free). Investigated: docs 0%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs1 pass3 warn0 fail83A
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (websites/stytch, 6865 snippets). Investigated: docs 100%, sdk 100%, cli 50%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | llms.txt present, valid & comprehensivevia docs | 24.4/30 | llms.txt covers 251/1888 sitemap doc pages (13%); 1637 missing; 8 llms.txt links not in sitemap (may indicate stale links or incomplete sitemap). Investigated: docs 81%, sdk 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| warn | Docs reachable, not hard auth-gatedvia docs | 18.8/30 | 50 of 50 sampled pages return 200 for non-existent URLs (soft 404). Investigated: docs 63%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| warn | Crawlable / AEOvia wellknown | 9/12 | Sitemap present (2 entries) but carries no lastmod values. Investigated: wellknown 75%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass1 warn4 fail55D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | 4 distinct 4xx/5xx response codes documented. Investigated: docs 100%, sdk 100%, spec 50%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| warn | Agent-navigable, token-efficient docsvia docs | 12.1/22 | 2 of 49 pages have substantive content differences between markdown and HTML (avg 4% missing). Investigated: docs 55%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| fail | Operation purpose clarityvia spec | 0/25 | 48% of operations are agent-inferable. Investigated: spec 0%. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/. Investigated: wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| fail | Docs structured datavia docs | 0/8 | Neither JSON-LD nor OpenGraph/meta tags detected across 3 assessed pages (3 JS-rendered). Investigated: docs 0%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| fail | Description consistency across surfaces | 0/7 | Mean pairwise description similarity across 2 surfaces (spec, docs) is 0% (threshold 35% for full credit). | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them3 pass0 warn1 fail90A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Idempotency documentedvia sdk | 27/27 | Built-in retry machinery is present (grep-derived). Investigated: sdk 100%, spec 0%, docs 0%. | Documented idempotency lets agents retry safely. |
| pass | Rate-limit signalingvia spec | 22/22 | rate-limit behavior documented in the docs site at https://stytch.com/blog/stytch-fraud-and-risk-prevention-major-enhancements/. Investigated: spec 100%, docs 100%. | Machine-readable rate-limit headers let agents throttle adaptively. |
| pass | Sandbox separationvia spec | 20/20 | sandbox documented in the docs site at https://stytch.com/blog/guide-to-authentication-for-the-openai-apps-sdk/. Investigated: spec 100%, docs 100%, sdk 100%. | An isolated environment lets agents exercise destructive operations safely. |
| fail | Runnable collection with test scriptsvia platform | 0/9 | No public Postman workspace discovered for the org. Investigated: platform 0%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| na | Pagination documented & consistent | —/22 | No surface produced evidence for this capability in this run. | Consistent, documented pagination lets agents traverse collections. |
Resources Discovered
The public resources we found for Stytch — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (6,865) |
|---|---|
| APIs analyzed | 1 — Stytch API |