Stytch security review cost: $2,400 once, you own it

Stytch security review cost is $2,400 once for one app whose customers sign in as members of a Stytch organization. $1,200 starts the work. The report is due 48 hours after a test member can sign in. You own the PDF. There is no subscription.

Stytch issues the session for one organization. Your API decides whether it believes that organization.

Short answer: Stytch security review cost is $2,400 once, with $1,200 to start, for one app that signs customers in with Stytch. I check the organization on the B2B session and the API those pages already call, then write the report 48 hours after access works. You own it. The Stytch usage bill and a multi-week pentest are different products. The offer is the web application security review.

What does a Stytch security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying Stytch usage, a scanner seat, or a stamp I do not hold.

Stytch’s B2B pricing lists pay as you go at a $0 base. External organizations are unlimited. 10,000 external active members and agents are included, plus 1,000 machine-to-machine tokens and 5 SSO or SCIM connections. Each connection past those five is $125. The custom login brand is a $99 fixed fee. The table does not print a per-member overage, so I will not invent one.

What you are buying	2026 price	What you actually get
Stytch B2B, inside the included tier	$0 for 24 months and for 36	Sessions and organizations. Not a test of your API
Extra SSO or SCIM connection	$125 per connection, after 5	The IdP link. Not whether the API trusts the organization
Custom login brand	$99 once	Their logo off the login screen. Still their product
This Stytch review	$2,400 once, $1,200 to start	One app, organization on the session, the API the UI calls, report in 48 hours, one retest
Web app test, market	$5,000–$30,000	Longer calendar, often packaged for a compliance conversation

Synack’s 2026 pricing guide puts a typical web application test in that $5,000 to $30,000 band.

Stay inside 10,000 members and five connections and Stytch’s base is $0 at 24 months and at 36. That $0 still does not read your API. Three passes of this review are $7,200.

The same $2,400 is on pricing. A WorkOS connection is a different vendor and a different session, covered in WorkOS security review cost.

What does the $2,400 check on a B2B session?#

I sign in as the organizations you already sell and record which records those sessions can reach. Stytch issues the member session. Your API has to match the organization on it to the route. Your Stytch secret stays off the browser and off this engagement.

Stytch’s session overview and JWT guide are the bar I write against:

• A session is one member’s login to one organization. The default lifetime is 60 minutes. The session JWT used for local checks expires in five minutes, so a revoke can lag until that JWT expires. I record which routes trust the short JWT and which call Stytch before a sensitive read. I do not ship a recipe.
• An intermediate session token lasts 10 minutes and is not a member session. It has to be exchanged for one organization. I record whether an API route treats that token as a finished login.
• Session exchange can move a member to another organization. If that organization still wants MFA, Stytch returns an intermediate token, not a full session. I record whether your API still serves organization A after the UI is on organization B.
• An authorization check is supposed to require that the organization id you pass matches the organization on the member session. A custom claim is not a substitute. Stytch reserves the https://stytch.com/ claim namespace.

The document shape is the sample pentest report. No client names.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a Stytch dashboard audit, an SSO connection setup, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

I do not configure the customer’s Okta or Entra connection, and I do not test Stytch’s own infrastructure.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not read organization ids.

How does the review run from access to the PDF?#

You authorize one URL, I use the test members you send, and the clock starts when that login works. Stytch issues the session. Your API decides whether it believes the organization. I do not patch production inside this price.

Step	What happens
Trigger	Customer organizations are live, or a buyer asked whether one organization can read another
Action	I walk the live UI as each test organization and compare that session to the API those pages already call
System of record	The app, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if I cannot legally open the app, or if a buyer named a certificate this offer does not include. Get a URL and two organizations first. A pass with no member login is a homepage skim.

Wait if nobody can sign in as a member today. Hire the firm that holds CREST if the questionnaire requires that name. If the login is not Stytch, the same web application security review covers auth and the API.

What should be true before I start?#

Bring the URL, two organizations, and one sentence on what is public. I can start without a tour of the Stytch dashboard. I cannot start without a member login that behaves like production, or a public page becomes a false finding.

Before you pay, confirm these:

• The production or staging URL I am allowed to open, in writing.
• One test member in organization A and one in organization B, or a single org if you truly have no tenants.
• Which records organization A must never see.
• That the Stytch secret is server-only, and which organization switch should stop at MFA.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.