--- source_url: "https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/methods/oauth/authenticate" title: Authenticate - Stytch Docs mirrored_at: 2026-08-07T01:08:47.846Z host: stytch.com cited_in_42a: true mirror_canonical: "https://index.42a.ai/stytch.com/docs/api-reference/consumer/frontend-sdks/react/methods/oauth/authenticate" --- > **Original source:** https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/methods/oauth/authenticate The authenticate method wraps the [authenticate](https://stytch.com/docs/api-reference/consumer/api/oauth/authenticate) OAuth API endpoint which validates the OAuth token passed in. If this method succeeds, the user will be logged in, granted an active session, and the [session cookies](https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/resources/cookies-and-session-management) will be minted and stored in the browser. ## Parameters string required The token to authenticate. object required Additional configuration. Show properties int required Set the session lifetime to be this many minutes from now. This will return both an opaque session\_token and session\_jwt for this session, which will automatically be stored either in the browser cookies if you’re using our JavaScript SDK, or in the iOS Keychain/ Android SharedPreferences if you’re using one of our mobile SDKs. The `session_jwt` will have a fixed lifetime of five minutes regardless of the underlying session duration, and will be automatically refreshed by the SDK in the background over time. This value must be a minimum of 5 and may not exceed the maximum session duration minutes value set in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration) of the Stytch Dashboard. A successful authentication will continue to extend the session this many minutes. ## Response string The unique identifier for the User within a given OAuth provider. Also commonly called the “sub” or “Subject field” in OAuth protocols. string Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc. string required If available, the `profile_picture_url` is a url of the user’s profile picture set in OAuth identity the provider that the user has authenticated with, e.g. Facebook profile picture. string required If available, the `locale` is the user’s locale set in the OAuth identity provider that the user has authenticated with. object required The provider values object. Show properties string required The access token that you may use to access the user’s data in the provider’s API. string required The ID token returned by the OAuth provider. ID Tokens are JWTs that contain structured information about a user. The exact content of each ID Token varies from provider to provider. ID Tokens are returned from OAuth providers that conform to the \[OpenID Connect\]([https://openid.net/foundation/](https://openid.net/foundation/) OpenID Connect) specification, which is based on OAuth. string required The refresh token that you may use to refresh a user’s session within the provider’s API. array\[string\] required The OAuth scopes included for a given provider. See each provider’s section above to see which scopes are included by default and how to add custom scopes. string required The timestamp when the access token expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string The unique ID of the affected User. object The user object affected by call. See the [User object](https://stytch.com/docs/api-reference/consumer/api/users/user-object) for complete response field details. Show properties string The timestamp of the User’s creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. array\[objects\] An array contains a list of all crypto wallets for a given User in the Stytch API. Show properties string The unique ID for a crypto wallet string The actual blockchain address of the User’s crypto wallet. string The blockchain that the User’s crypto wallet operates on, e.g. Ethereum, Solana, etc. boolean If this method has been successfully authenticated by the User. array\[objects\] An array of email objects for the User. Show properties string The unique ID of a specific email address. string The email address. boolean If this method has been successfully authenticated by the User. object The name of the User. Each field in the name object is optional. Show properties string The first name of the user. string The middle name(s) of the user. string The last name of the user. object The trusted\_metadata field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api-reference/consumer/api/resources/metadata) reference for complete field behavior details. object The untrusted\_metadata field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](https://stytch.com/docs/api-reference/consumer/api/resources/metadata) reference for complete field behavior details. array\[objects\] An array of phone number objects linked to the User. Show properties string The unique ID for the phone number. string The phone number. boolean If this method has been successfully authenticated by the User. array\[objects\] An array of OAuth provider objects linked to the User. Show properties string The unique ID for an OAuth registration. string The unique identifier for the User within a given OAuth provider. Also commonly called the “sub” or “Subject field” in OAuth protocols. string Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc. string If available, the profile\_picture\_url is a url of the User’s profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture. string If available, the locale is the User’s locale set in the OAuth identity provider that the user has authenticated with. object The password object is returned for users with a password. Show properties string The unique ID of a specific password boolean Indicates whether this password requires a password reset string The status of the User. The possible values are `pending` and `active`. array\[objects\] An array containing a list of all TOTP instances for a given User in the Stytch API. Show properties string The unique ID for a TOTP instance. boolean If this method has been successfully authenticated by the User. string The unique ID of the affected User. array\[objects\] An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API. Show properties string The unique ID for the Passkey or WebAuthn registration. string The domain on which Passkey or WebAuthn registration was started. This will be the domain of your app. string The user agent of the User. string The authenticator\_type string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are “platform” and “cross-platform”. If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference. boolean If this method has been successfully authenticated by the User. string The name of the Passkey or WebAuthn registration. array\[objects\] An array that contains a list of all biometric registrations for a given User in the Stytch API. Show properties string The unique ID for a biometric registration. boolean If this method has been successfully authenticated by the User. array\[strings\] Roles assigned to this User. See the [RBAC guide](https://stytch.com/docs/consumer-auth/authorization/assigning-roles-to-users) for more information about role assignment. string A secret token for a given Stytch Session. string The JSON Web Token (JWT) for a given Stytch Session. object If you initiate a Session, by including session\_duration\_minutes in your authenticate call, you’ll receive a full Session object in the response. See [Session object](https://stytch.com/docs/api-reference/consumer/api/sessions/session-object) for complete response fields. Show properties string A unique identifier for a specific Session. string The unique ID of the affected User. array\[objects\] An array of different authentication factors that comprise a Session. string The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. object Provided attributes help with fraud detection. Show properties string The IP address of the user. string The user agent of the User. map The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call. array\[string\] A list of the roles associated with the session. object If [Protected Auth](https://stytch.com/docs/fraud-risk/device-fingerprinting/protected-auth) is enabled and returned fingerprinting results, the user\_device response field will contain information about the user’s device attributes. Show properties string The IP address of the user’s device. object Information about the ip\_address. Show properties boolean Whether this ip\_address has been seen before for this user. string When this ip\_address was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string When this ip\_address was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string The country code where the IP address is located. object Information about the ip\_geo\_country. Show properties boolean Whether this ip\_geo\_country has been seen before for this user. string When this ip\_geo\_country was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string When this ip\_geo\_country was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z. string The city where the IP address is located. string The region where the IP address is located. string Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. number The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.