Obelisk vs Stytch, honestly
Stytch, acquired by Twilio in November 2025, is an API-first auth platform with strong passwordless primitives (magic links, OTP, passkeys) and a growing fraud/device-fingerprinting offering. Obelisk is a passkey-first identity and security plane built around one idea: security you can prove, not just promise. This page compares the two fairly — Stytch is a genuinely good product for teams who want composable, API-first passwordless building blocks and fraud signals, and we say so plainly below.
The short version: if your priority is sign-in security you can check — passkey-first by default, tamper-evident receipts and a live, public security score for the Gate itself — Obelisk is built for exactly that. See the full field →
Where Stytch shines
Stytch is genuinely strong on passwordless and on the developer-API model: flexible, composable primitives for magic links, one-time passcodes, passkeys, and increasingly device fingerprinting and fraud prevention. If you want to assemble your own auth flows from well-designed API building blocks, Stytch is a capable, modern choice.
Side-by-side: Obelisk vs Stytch
Obelisk's column says what Obelisk does today, including what it does not do. Each Stytch cell that links a source is drawn from that page, checked on the date shown; the other Stytch cells reflect its public positioning as of October 2026. Vendor capabilities and pricing change, so verify the latest from their docs.
| Dimension | Obelisk | Stytch |
|---|---|---|
| Model | Hosted, opinionated identity plane (with standards APIs) | Composable, API-first auth building blocks |
| Default auth method | Passkey-first / passwordless by default | Passwordless primitives (magic link, OTP, passkeys), as of October 2026 |
| Public security score for the provider itself | Yes — the Obelisk Rating, a live 0–100 score the Gate computes about itself and shows on its homepage. It rates the Gate, not your app. | We found no live public security score for Stytch itself, as of October 2026 |
| Verifiable login seal embed | Yes — a drop-in seal bound to its registered addresses, with a public verification page | We found no verifiable login seal from Stytch, as of October 2026 |
| Tamper-evident receipts | Hash-chained receipts for sign-ins, tokens and grants, under a signed ledger head | We found no tamper-evident record from Stytch that a third party could check, as of October 2026 |
| Risk engine | No adaptive risk score decides a sign-in today. What is enforced: sensitive changes need a passkey sign-in — remembered, authenticator-code and email-link sessions are refused. The risk score on your account page is advisory. | Device fingerprinting / fraud product, based on public docs |
| OIDC provider + SAML 2.0 IdP | An OpenID Connect provider today. The SAML 2.0 identity provider is built but not yet connectable on the hosted Gate. | API-first; B2B SSO/SAML supported, as of October 2026 |
| Pricing model | Pay per audited passage | Per monthly-active-user / per-feature, based on public pricing |
| Agent identity and tokens | Each agent is its own record in Agent Studio: its own key, held by the agent's runtime (Obelisk never receives the private key), a passkey-holding owner, and an opt-in public Proof Link that is opaque and revocable. No OAuth grant issues an access token to an agent on its own: the token endpoint grants only authorization_code and refresh_token. There is no client-credentials, token-exchange or ID-JAG grant. | Connected Apps authorizes AI agents over OAuth 2.1, with dynamic client registration and client ID metadata documents for remote MCP. (source, checked 2026-10-02) |
| Third-party check of agent authorization | Registering, approving, transferring or revoking an agent writes a receipt to Obelisk's hash-chained ledger. Anyone holding a receipt's hash can fetch its position in the chain and a Merkle inclusion proof at /api/proof/<hash>, with no account. | Audit-ready observability: a central, real-time view of connected apps and authorized scopes. The cited page describes no proof a third party could check without Stytch. (source, checked 2026-10-02) |
| Root of trust | Self-operated root-of-trust — one accountable studio runs Obelisk on Obelisk | Managed multi-tenant cloud service, based on public positioning |
Why teams choose Obelisk
The differences below aren't cosmetic — they're structural choices that move security from "trust us" to "verify it."
- Passkey-first by default. Passwordless via WebAuthn/FIDO2 is the default path, not an add-on. The secret half of a passkey is never sent to Obelisk or to the site, so there is no password to stuff and no passkey secret in our database to steal, and the browser offers a passkey only to the site it was made for, which is what makes it phishing-resistant. The fallbacks, an emailed link or an authenticator code, can be phished like anywhere else, so they only get a limited session.
- A live public MCP tool server. Obelisk answers trust questions to the software that increasingly does the checking: read-only MCP tools at
POST /mcp, rate-limited and account-free — the same checks a human runs on the website, callable by any assistant. - A live, public security score for the Gate itself. The Obelisk Rating is the Gate's own security, scored 0–100 from hundreds of live signal points and shown on its homepage. It rates the Gate, not your app or your sign-in page.
- The verified seal embed. A drop-in login card (
obeliskgate.com/embed/seal.js) that shows its ✓ only on an address your registration names and links to a verification page at obeliskgate.com listing your registered addresses and what Obelisk Gate measured about your registration, each with when it was measured. - Tamper-evident, hash-chained receipts. Sign-ins, tokens and grants are written as hash-chained receipts, anchored under an ES256-signed ledger head you can check against our published JWKS. Save the head and its anchor count: a later count that went down, or a different head at the same count, shows the record was cut short or replaced. Consistency proofs between heads aren't published yet.
- Sensitive changes need a passkey. What a session may do follows how it was signed in. A remembered 30-day session, an authenticator code or an email link gets you in, but adding another passkey or removing one, changing your authenticator or recovery codes, minting API keys, registering agents, and renaming or deleting the account are all refused from any of them until you sign in with your passkey again. The risk score on your account page is an advisory read: it does not allow, block or step up any sign-in.
Together they make sign-in a part of your stack you can check rather than take on trust. See the full trust case →
Frequently asked questions
Is Obelisk a Stytch alternative?
Yes. Both are modern and passwordless-forward. The difference: Stytch hands you composable API primitives to assemble your own flows; Obelisk gives you a complete, opinionated identity provider with tamper-evident receipts and a live, public security score for the Gate itself, out of the box.
Can I migrate from Stytch to Obelisk?
Yes for your apps: Obelisk is an OpenID Connect provider, so you integrate it like any OIDC identity provider and map the verified subject id to your records. Passwords don't carry over: each of your users creates a passkey the first time they sign in through Obelisk (while new accounts are by invitation, that first sign-in needs one). If you were assembling passwordless flows yourself on Stytch, Obelisk replaces that with a hosted, passkey-first surface plus a verifiable security seal.
Does Obelisk do fraud/risk like Stytch?
Not today. Obelisk does not run a fraud or adaptive-risk engine that decides sign-ins. What it enforces is proof strength: you sign in with a passkey, and sensitive changes — adding another passkey or removing one, your authenticator or recovery codes, API keys, agents, renaming or deleting the account — are refused to a remembered, authenticator-code or email-link session until you sign in with your passkey again. Your account page shows a risk score, but it is advisory and decides nothing. If you need device fingerprinting or fraud scoring, that is the problem Stytch's fraud product addresses, and Obelisk does not.
See it for yourself
Ready to compare in practice? Integrate Obelisk · See the Gate Toll pricing · Add the verified seal · Create your account.
Still weighing options? Head back to the full comparison hub to see Obelisk against every provider at a glance.