Vendor, ranked 14 of 15
Stytch IsAgent
In short
Stytch IsAgent flags agent traffic at a site's front end, and earns partial grades for agent verification and reporting only, for 2 of 10 points. IsAgent calls are free up to 10,000 a month, and device fingerprints beyond 10,000 cost half a cent each. Stytch's guidance is that IsAgent informs a decision but is not itself a security control.
Identity platform whose free IsAgent front-end component flags likely AI agents for analytics and agent-friendly flows, and whose fingerprinting product checks Web Bot Auth signatures; IsAgent is explicitly not a security control.
Alternatives to Stytch IsAgent ยท stytch.com
- Type
- Verification provider
- Operator
- Twilio
- Based in
- United States
- Homepage
- stytch.com
- Last read
- 2026-11-05
The rubric, with evidence
| Question | Grade | What the vendor documents |
|---|---|---|
| Tells a verified agent from a spoof | Partial | Web Bot Auth signatures plus heuristic detection (user agent, TLS fingerprint, network traits) |
| Per-purpose policy (train, search, answer, act) | Not published | per-purpose policy (checked 2026-11-04) |
| Charging for access | Not published | support (checked 2026-11-04) |
| Lets signed commerce agents through | Not published | Visa TAP or Mastercard Agent Pay support (checked 2026-11-04) |
| Cost | published: IsAgent free to 10,000 calls/month; fingerprints USD 0.005 each beyond 10,000 | |
| Reporting | Partial | client hint with agent flag and identity, meant for analytics |
| Where it runs | app: client-side SDK calling Stytch's API, plus backend Lookup API for fingerprinting |
Cost
IsAgent free up to 10,000 calls/month (contact Stytch above that); Device Fingerprinting USD 0.005 per fingerprint beyond 10,000 included; free tier 10,000 MAUs and AI agents. Source, read 2026-11-04.
What Stytch IsAgent does not do
- IsAgent is not a security control; its client-side result can be tampered with (Stytch changelog, 2025-08-01).
- Detection is heuristic and not 100% accurate (IsAgent FAQ).
- No crawler monetization or per-purpose crawler policy (pages read 2026-11-04).
- Stytch does not run a crawler licensing or pay-per-crawl product; its agent work covers detection, signature checks and OAuth for agents.
- Stytch's Device Fingerprinting docs for agents sit behind a login, so the per-agent rule names a customer sees are not public (checked 2026-11-05).
Documented facts
- Primary source Stytch launched isAgent on 1 Aug 2025 as a lightweight front-end component to detect agentic and programmatic traffic and steer it to agent-friendly experiences. Source, read 2026-11-04, dated 2025-08-01.
- Primary source Stytch says isAgent should not be used as a security measure because attackers can modify the response in their browsers. Source, read 2026-11-04, dated 2025-08-01.
- Primary source IsAgent is free up to 10,000 calls a month; higher volumes go through Stytch directly. Source, read 2026-11-04.
- Primary source IsAgent weighs the user agent string, TLS fingerprint and network traits, and Stytch states detection is not 100% accurate. Source, read 2026-11-04.
- Primary source Stytch added Web Bot Auth support on 19 Sep 2025, and agents sending Web Bot Auth headers need no registration with Stytch. Source, read 2026-11-04, dated 2025-09-19.
- Primary source Stytch Device Fingerprinting is the product meant for blocking bad bots, with a frontend script and a backend Lookup API. Source, read 2026-11-04.
- Primary source Stytch's free tier covers 10,000 monthly active users and AI agents plus 1,000 M2M tokens. Source, read 2026-11-04.
- Primary source Device fingerprints beyond the 10,000 included cost USD 0.005 each. Source, read 2026-11-04.
- Secondary source Stytch announced it has joined Twilio to build an identity layer that tells humans, trusted agents and rogue agents apart. Source, read 2026-11-04.
Compared with
- Skyfire vs Stytch IsAgent: Skyfire issues signed KYA and pay tokens that sellers verify against its JWKS; Stytch IsAgent is a front-end flag that Stytch says must not be used as a security control.
- Stytch IsAgent vs Auth0 for AI Agents: Stytch IsAgent flags inbound agent traffic on a site; Auth0 for AI Agents gives identities and scoped tokens to agents a company builds, and does not police inbound bots.
What Stytch IsAgent does for this layer
From the vendor's own pages
Stytch's Web Bot Auth announcement of 23 Sep 2025 named Browserbase, Anchor Browser, Cloudflare and Akamai as launch partners. (stytch.com, dated 2025-09-23) Stytch reads the Signature-Agent header to find an agent's public key directory, so an agent that sends a valid directory URL can be verified without any account at Stytch. (stytch.com, dated 2025-09-23) Customers already running IsAgent or Device Fingerprinting received Web Bot Auth verification metadata in their existing API responses, with no integration change. (changelog.stytch.com, dated 2025-09-19) Stytch's signing guide for agent operators generates an Ed25519 key pair with the jose library, serves it at /.well-known/http-message-signatures-directory with the content type application/http-message-signatures-directory+json, and signs requests with tag="web-bot-auth" plus created and expires timestamps. (stytch.com, dated 2025-09-23)
Stytch publishes the signing walkthrough as runnable code in the GitHub repository stytchauth/web-bot-auth-example. (stytch.com, dated 2025-09-23) Twilio agreed to acquire Stytch on 30 Oct 2025 and completed the deal on 14 Nov 2025; Stytch, Inc. stays the contracted service provider and Twilio Inc. is the parent company. (changelog.stytch.com, dated 2025-11-14) Twilio describes Stytch as "an identity platform for AI agents that's built for developers" and says it will anchor an identity layer across the Twilio Platform. (twilio.com, dated 2025-11-14) Stytch Connected Apps turns a customer's application into an OAuth 2.0 and OIDC identity provider, so AI agents and MCP clients receive scoped tokens that inherit only the permissions the user already holds. (stytch.com)
Connected Apps lets an organisation define allowlists of the third-party apps and AI agents its members may connect, and revoke any token from the dashboard or the API. (stytch.com)
Claims the vendor makes about itself
Stytch's homepage claims "99.99% bot detection accuracy" for its bot and fraud protection. (stytch.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| IsAgent | Front-end SDK that labels likely agent and programmatic traffic and reports Web Bot Auth verification results. | free tier, then contact sales | USD 0 | 2026-11-05 |
| Device Fingerprinting | Script plus Lookup API that returns a verdict per device, used for blocking bots, now carrying Web Bot Auth metadata. | per fingerprint above the included volume | USD 0.005 | 2026-11-05 |
| Connected Apps | OAuth 2.0 and OIDC provider for AI agents, MCP servers and cross-app logins, with consent and org allowlists. | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | Supports | Verifies Web Bot Auth signatures through IsAgent and Device Fingerprinting since September 2025 and reads Signature-Agent for key discovery. (stytch.com) |
| Published IP list | No statement | Stytch's Web Bot Auth post names reverse DNS and IP tracking only as the old way to identify Googlebot; no IP-list verification product is described. |
| Visa Trusted Agent Protocol | No statement | No Trusted Agent Protocol mention on the Web Bot Auth announcement, changelog or Connected Apps page (checked 2026-11-05). |
| Mastercard Agent Pay | No statement | No Agent Pay mention on the pages read (checked 2026-11-05). |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
Related pages on this site
Sources
- stytch.com: stytch.com
- stytch.com: pricing
- changelog.stytch.com: ann_uSpDBNlbdXL8X
- isagent-web.vercel.app: faq
- changelog.stytch.com: ann_iPdXgiqlNrBk0
- plushcap.com: stytch stytch has joined twilio to build the intelligent identity layer for the internet
- Stytch supports Web Bot Auth for agent and bot verification
- How to implement Web Bot Auth for your AI agent, bot, or crawler
- Stytch changelog: A new chapter begins, Stytch joins Twilio
- Twilio acquired Stytch, an identity platform for AI agents
- Connected Apps | Stytch
- Stytch homepage
Last reviewed 2026-11-05