Nametag Docs
Get help Launch Nametag
Integrations Stytch

Nametag Integration for Stytch

High-assurance self-service MFA and password recovery for your Stytch-powered app.

Overview

The Nametag Integration for Stytch adds high-assurance, self-service account recovery to your Stytch-powered app. When a user is locked out — a lost MFA device or phone — Nametag verifies they are the real account holder, then automatically resets their MFA (and optionally starts a password reset) through Stytch. No help-desk ticket, no manual dashboard action.

Nametag handles:

  • Running the identity verification (government-ID scan + liveness selfie)
  • Resolving the locked-out user to their Stytch Member
  • Performing the permitted resets against Stytch’s B2B API

Stytch receives only the reset action — never any personal data. Nametag holds the verified identity.

Note: This integration ships behind a per-tenant feature flag and is off until you activate it. If you don’t see Stytch in the console, contact Nametag support to enable it for your account.

How it works

  1. A locked-out user lands on the Nametag hosted recovery experience (or is prompted).
  2. Nametag runs the verification. The requestor proves their identity to Nametag.
  3. On a pass, the connector resolves the Stytch Member from the verified email.
  4. The connector runs the tenant-configured resets, each gated by your self-service permission rules:
    • Delete the Member’s MFA TOTP (authenticator app) registration
    • Delete the Member’s MFA SMS phone factor
    • Optionally start a password reset
  5. The outcome is recorded against the binding organization_id:member_id and surfaced in the Nametag console. No personal data is written to Stytch.

Trust relationships

The integration keeps three credentials strictly separate:

Relationship Credential
Requestor → Nametag The Nametag identity verification
Connector → Stytch HTTP Basic project_id + secret (your Stytch credential — stored encrypted)
Stytch → Nametag (webhooks) Svix signing secret (whsec_…)

You are never asked to paste a Nametag API key into the Nametag console — the credential you provide is your own Stytch project credential.

Before you start

  1. Admin access to your Nametag console. You’re already signed in to Nametag.
  2. A Stytch project credential. From your Stytch dashboard, copy the target project’s project_id and a secret (Management/Backend API credential). Use a least-privilege secret scoped to Member/MFA management if your plan allows.
  3. Your product line: Stytch B2B (Organizations & Members). B2B is supported in v1.
  4. Your policy: which resets to allow (MFA only, or MFA + password) and which organizations/members are in scope.

Setup steps

The Nametag console walks you through a guided wizard.

  1. Add the integration. In the Nametag console, open Add Integration and select Stytch from the catalog.
  2. Connect Stytch. Paste your Stytch project_id and secret, choose the environment (Live or Test), and optionally add a webhook signing secret (whsec_…). Nametag validates the credential immediately and stores it encrypted.
  3. Set coverage & reset rules. Choose which Stytch Organizations/Members are in scope and which self-service resets are allowed (MFA TOTP, MFA SMS, password).
  4. Review & activate. Confirm the summary. The integration activates for your tenant.

After setup

You land on the connected detail view, where you can:

  • Test the connection to confirm the stored credential still works
  • See the project ID, environment, and coverage & reset rules
  • Disconnect, which removes the stored (encrypted) credential for your tenant

Recovery activity and verification results appear in the Nametag console audit log.

Notes & good to know

  • No personal data is stored in Stytch. Nametag holds the verified identity; Stytch only receives the reset action.
  • Session behavior: deleting an MFA factor in Stytch does not, by itself, end the user’s existing sessions; MFA is re-enforced at next sign-in. If you need immediate enforcement, enable that option in the reset rules — the connector then clears the Member’s MFA enrollment so they must re-enroll.
  • Idempotent resets: deleting a factor a Member no longer has is treated as a no-op, so recovery still succeeds.
  • Least privilege: scope the Stytch secret to only what’s needed, and rotate it periodically from the detail view.

Troubleshooting

  • “Credential invalid” at Connect: re-check project_id/secret and that the environment (Live vs Test) matches the key.
  • User verified but not reset: confirm the reset type is permitted in your rules and the user’s email matches a Member in the in-scope Organization.
  • Integration not visible: it’s enabled per-tenant; if you don’t see it, contact Nametag support to confirm it’s turned on for your account.