August 2025 Summaries

Episode four of Stytch's agent-ready video series delves into identity, authentication, and consent for AI agents, highlighting the challenges traditional systems face with AI's increasing autonomy. Reed McGinley-Stempel and Max Gerber from Stytch discuss how to adapt trust models, extend OAuth-style delegation, and design secure flows to safely expose app data to AI agents. They emphasize the necessity of modeling trust relationships between users and agents, establishing authentication flows not tightly coupled to UI, and creating auditable consent mechanisms. The video also explores the application of OAuth in the context of the Model Context Protocol (MCP) for AI agents, showcasing its benefits for sharing data across platforms securely and efficiently. Max Gerber demonstrates the process through a live demo, showing how to integrate OAuth into existing systems to make them agent-ready, thus enabling seamless data sharing with AI tools. The session underscores the importance of becoming an OAuth provider to facilitate secure data exchanges between applications and AI agents, promoting a future where delegation and control are at the forefront.

The third episode of the Agent Ready video series, featuring Lizzy Siegle from Cloudflare and Reed McGinley-Stempel from Stytch, explores the deployment of remote Model Context Protocol (MCP) servers at the edge, demonstrating a real-world application with a tennis court booking agent. The episode illustrates how agents can be enhanced with tools built into MCP servers, enabling them to perform tasks like impersonating a user to log in, scrape websites, and complete bookings securely using Cloudflare's browser automation and Stytch's authentication. Through a live demo, viewers learn about designing robust, composable tools that function like APIs with clean inputs and predictable outputs. The session emphasizes the importance of using schemas for validation and clarity, avoiding complex tool "soup," and ensuring tools are simple and deterministic. The discussion also highlights the potential of MCP servers to transform AI agents from mere text predictors to task completers, suggesting a shift in how applications can integrate AI to enhance user functionality and convenience.

In the second episode of Stytch's "Agent Ready" video series, Reed McGinley-Stempel, CEO of Stytch, and Alex Rattray, CEO of Stainless, discuss the process and challenges of building scalable toolsets for AI agents, focusing on the Model Context Protocol (MCP) for server and client authentication. They highlight the limitations of current approaches to MCP server construction, such as the inefficiency of naively generating tools from OpenAPI specifications and the scalability issues of manually creating high-value tools. The conversation delves into the benefits of using MCP servers, particularly for simplifying user interactions with APIs, and the importance of crafting intentionally AI-accessible APIs to facilitate agentic actions. The discussion also emphasizes the need for OAuth in API integration and explores the potential for MCP to streamline processes within various applications, alongside Stainless's role in generating MCP servers tailored to specific use cases.

In the first episode of the Agent Ready video series, Reed McGinley-Stempel, CEO of Stytch, and Carter Rabasa, Head of Developer Relations at Langflow, discuss the evolving landscape of AI-powered agents and their impact on application development. They delve into foundational patterns and best practices for building AI agents, balancing autonomous behaviors with the necessary oversight, and the importance of managing memory, context, and tool orchestration. The session includes practical techniques for debugging agent behavior and improving observability, highlighting the advancements in agent platforms that strive to bridge the reliability gap with traditional SaaS models. With live demos using tools like Langflow and Arize, the video showcases how developers can create and monitor agentic workflows, emphasizing the immense potential of AI in transforming user experiences. Both speakers stress the importance of experimentation and learning in this rapidly changing field, encouraging developers to explore and harness the capabilities of AI agents to redefine the future of software development.

Agent-to-agent OAuth is a method for AI agents to securely authenticate and authorize interactions with applications' APIs, using well-established OAuth 2.0 standards to grant scoped, revocable access tokens. This approach allows AI agents to act on behalf of users without handling sensitive credentials like passwords or API keys, emphasizing user control through explicit consent and organizational policies. The Model Context Protocol (MCP) complements this by providing a standardized framework for AI agents to connect with external applications, akin to a universal "USB-C port" for AI services. Stytch's Connected Apps facilitates this integration by managing the OAuth token lifecycle, including issuance, validation, refresh, and revocation, thereby simplifying the implementation of secure AI agent connectivity. This method not only enhances security by limiting access to precisely defined scopes and enabling easy revocation but also aligns with industry standards, ensuring consistent, reliable, and secure interactions between AI agents and applications.

Passwordless authentication offers a more secure and user-friendly alternative to traditional password-based systems by eliminating passwords, which are susceptible to being guessed, phished, or leaked. This method encompasses various solutions such as magic links, one-time passcodes (OTPs), social logins, and passkeys using FIDO2/WebAuthn standards, which rely on factors like physical devices, biometric data, or system access. These methods are increasingly vital as they protect user accounts and business reputations while enhancing user experience. Developers have options like Stytch, Auth0, Clerk, Supabase, Keycloak, AWS Cognito, and NextAuth.js, each catering to different use cases and offering varying degrees of security, scalability, and developer experience. While some solutions require significant in-house expertise and management, others provide managed services with advanced security features, making them preferable for teams lacking specialized skills. Ultimately, the choice of a passwordless authentication solution depends on factors such as user needs, developer experience, customization requirements, and the desired level of management involvement.

A SCIM API is a standardized REST API that facilitates automated user provisioning and deprovisioning for SaaS applications, allowing seamless integration with identity providers like Okta or Microsoft Entra ID by using uniform endpoints for managing users and groups. This API supports the SCIM protocol, requiring endpoints such as /Users and /Groups, which handle JSON data following specific schemas, ensuring efficient synchronization of user access permissions across connected applications. Implementing SCIM involves creating these endpoints and supporting core resources like Users and Groups, while addressing common implementation pitfalls and adhering to security best practices such as using HTTPS, bearer tokens, and rate limiting. Enterprises often require SCIM compliance for SaaS apps, and providers like Stytch offer solutions that handle the complexities of integrating with various identity providers, allowing companies to focus on their core products while ensuring robust SCIM functionality.

Sam Altman's claim that AI has defeated most authentication methods, except for passwords, is challenged in this discussion, which argues that the real issue lies in the reliance on single-factor authentication systems. The text suggests that a more effective approach to authentication involves using phishing-resistant credentials, such as device-bound passkeys, and incorporating continuous risk assessment and multi-factor authentication. It emphasizes the importance of securing biometrics to trusted devices and leveraging device and network signals to enhance security, particularly against AI-generated impersonations. The text also highlights the growing role of AI agents and the necessity of treating them with the same security rigor as human users, ensuring they have identity verification, least privilege access, and proof-of-possession. Ultimately, the piece advocates for a layered approach to security to better protect against fraud, suggesting that developers focus on implementing stronger, multi-faceted authentication methods rather than relying on outdated single-factor systems.

Device fingerprinting is an advanced cybersecurity method used to detect and prevent fraud by collecting comprehensive information about a user's device, such as browser, hardware, operating system, and network details, to generate a unique identifier. This identifier, stored in a server-side database, allows applications to verify if a user is accessing from a previous device, enhancing security compared to cookies, which are prone to tampering. Device fingerprinting is more robust than browser fingerprinting, as it involves more data points like IP addresses and TLS configurations, making it harder for hackers to spoof. Implementing effective device fingerprinting requires collecting a wide variety of stable data points that are resistant to tampering, which can be augmented with machine learning algorithms to detect suspicious behavior. While primarily used for fraud prevention, device fingerprinting is subject to privacy regulations such as the GDPR, requiring transparency and user consent. Stytch offers a device fingerprinting solution that integrates with its authentication platform, providing enhanced security and adaptability against emerging threats.

The System for Cross-domain Identity Management (SCIM) protocol is an open standard that automates the management of user identities across multiple platforms, significantly simplifying processes such as user provisioning, deprovisioning, and synchronization. SCIM enables identity providers like Okta and Microsoft Entra ID to automatically manage user accounts and group memberships in downstream SaaS applications, ensuring data consistency and security while eliminating the need for custom scripts. Developed initially by companies like Salesforce and Google, SCIM has evolved to version 2.0 under the Internet Engineering Task Force (IETF) to include features like CRUD operations, querying capabilities, and secure authentication methods such as OAuth 2.0. Despite its standardized nature, implementing SCIM can be complex, prompting many companies to use managed services like Stytch, which offer pre-validated schemas, bulk operations support, and integration with other protocols like SAML and LDAP. These managed solutions streamline SCIM implementation, handling intricacies like idempotency, concurrency, and schema mapping, thus allowing organizations to focus on business value rather than technical maintenance.

SAML Shield, launched by the Stytch Team, offers an open-source solution to enhance security for SAML-based services by providing immediate protection against Common Vulnerabilities and Exposures (CVEs) without relying on upstream maintainers for patches. It integrates seamlessly with proxies like Nginx, Envoy, or Istio and supports a variety of configurations, including API and self-hosted options, to ensure comprehensive protection against typical SAML vulnerabilities such as Signature Wrapping Attacks, XML External Entity vulnerabilities, and Replay Attacks. Designed to operate alongside existing SAML implementations, SAML Shield inspects and blocks malicious SAML responses at runtime, ensuring zero-day protection even for unpatched services, and offers a permanent free tier with additional paid options for higher usage. This tool addresses the fragile nature of SAML security, which is often due to the complexities of its XML foundation and the slow patch cycle of many SAML libraries, helping teams to shield against known attack patterns efficiently and with minimal integration effort.

IsAgent, a new tool introduced by Stytch, helps websites identify and manage agentic and programmatic traffic, allowing for tailored experiences for AI agents and "good bots." As AI agents increasingly perform tasks on behalf of users, distinguishing between human and bot traffic becomes crucial, much like the shift seen with the rise of mobile traffic. IsAgent enables websites to embrace AI agents by facilitating agent-first experiences and understanding their unique needs, such as supporting standards like LLMs.txt and OAuth. This marks a significant shift in web traffic, with AI agents like ChatGPT Agent and Browserbase beginning to impact browsing and transactions online. IsAgent offers a straightforward integration to measure and respond to agentic traffic, positioning companies to adapt to the evolving web landscape and ensuring they are not left behind as AI agents become more prevalent.