stytch 6.4.0 → 9.8.0

data/lib/stytch/magic_links.rb

@@ -23,7 +23,11 @@ module Stytch
     #
     # == Parameters:
     # token::
-    #   The token to authenticate.
+    #   The Magic Link `token` from the `?token=` query parameter in the URL.
+    #
+    #       The redirect URL will look like `https://example.com/authenticate?stytch_token_type=magic_links&token=rM_kw42CWBhsHLF62V75jELMbvJ87njMe3tFVj7Qupu7`
+    #
+    #       In the redirect URL, the `stytch_token_type` will be `magic_link`. See [here](https://stytch.com/docs/guides/dashboard/redirect-urls) for more detail.
     #   The type of this field is +String+.
     # attributes::
     #   Provided attributes help with fraud detection.
@@ -99,6 +103,7 @@ module Stytch
       session_custom_claims: nil,
       code_verifier: nil
     )
+      headers = {}
       request = {
         token: token
       }
@@ -110,7 +115,7 @@ module Stytch
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
       request[:code_verifier] = code_verifier unless code_verifier.nil?
 
-      post_request('/v1/magic_links/authenticate', request)
+      post_request('/v1/magic_links/authenticate', request, headers)
     end
 
     # Create an embeddable Magic Link token for a User. Access to this endpoint is restricted. To enable it, please send us a note at support@stytch.com.
@@ -148,13 +153,14 @@ module Stytch
       expiration_minutes: nil,
       attributes: nil
     )
+      headers = {}
       request = {
         user_id: user_id
       }
       request[:expiration_minutes] = expiration_minutes unless expiration_minutes.nil?
       request[:attributes] = attributes unless attributes.nil?
 
-      post_request('/v1/magic_links', request)
+      post_request('/v1/magic_links', request, headers)
     end
 
     class Email
@@ -167,9 +173,7 @@ module Stytch
       # Send a magic link to an existing Stytch user using their email address. If you'd like to create a user and send them a magic link by email with one request, use our [log in or create endpoint](https://stytch.com/docs/api/log-in-or-create-user-by-email).
       #
       # ### Add an email to an existing user
-      # This endpoint also allows you to add a new email to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in the request will add the email to the pre-existing Stytch User upon successful authentication.
-      #
-      # Adding a new email to an existing Stytch User requires the user to be present and validate the email via magic link. This requirement is in place to prevent account takeover attacks.
+      # This endpoint also allows you to add a new email address to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in your Send Magic Link by email request will add the new, unverified email address to the existing Stytch User. If the user successfully authenticates within 5 minutes, the new email address will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that email address will create a new User.
       #
       # ### Next steps
       # The user is emailed a magic link which redirects them to the provided [redirect URL](https://stytch.com/docs/guides/magic-links/email-magic-links/redirect-routing). Collect the `token` from the URL query parameters, and call [Authenticate magic link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
@@ -249,6 +253,7 @@ module Stytch
         locale: nil,
         signup_template_id: nil
       )
+        headers = {}
         request = {
           email: email
         }
@@ -265,13 +270,13 @@ module Stytch
         request[:locale] = locale unless locale.nil?
         request[:signup_template_id] = signup_template_id unless signup_template_id.nil?
 
-        post_request('/v1/magic_links/email/send', request)
+        post_request('/v1/magic_links/email/send', request, headers)
       end
 
       # Send either a login or signup Magic Link to the User based on if the email is associated with a User already. A new or pending User will receive a signup Magic Link. An active User will receive a login Magic Link. For more information on how to control the status your Users are created in see the `create_user_as_pending` flag.
       #
       # ### Next steps
-      # The User is emailed a Magic Link which redirects them to the provided [redirect URL](https://stytch.com/docs/magic-links#email-magic-links_redirect-routing). Collect the `token` from the URL query parameters and call [Authenticate Magic Link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
+      # The User is emailed a Magic Link which redirects them to the provided [redirect URL](https://stytch.com/docs/guides/magic-links/email-magic-links/redirect-routing). Collect the `token` from the URL query parameters and call [Authenticate Magic Link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
       #
       # == Parameters:
       # email::
@@ -347,6 +352,7 @@ module Stytch
         code_challenge: nil,
         locale: nil
       )
+        headers = {}
         request = {
           email: email
         }
@@ -361,13 +367,13 @@ module Stytch
         request[:code_challenge] = code_challenge unless code_challenge.nil?
         request[:locale] = locale unless locale.nil?
 
-        post_request('/v1/magic_links/email/login_or_create', request)
+        post_request('/v1/magic_links/email/login_or_create', request, headers)
       end
 
       # Create a User and send an invite Magic Link to the provided `email`. The User will be created with a `pending` status until they click the Magic Link in the invite email.
       #
       # ### Next steps
-      # The User is emailed a Magic Link which redirects them to the provided [redirect URL](https://stytch.com/docs/magic-links#email-magic-links_redirect-routing). Collect the `token` from the URL query parameters and call [Authenticate Magic Link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
+      # The User is emailed a Magic Link which redirects them to the provided [redirect URL](https://stytch.com/docs/guides/magic-links/email-magic-links/redirect-routing). Collect the `token` from the URL query parameters and call [Authenticate Magic Link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
       #
       # == Parameters:
       # email::
@@ -420,6 +426,7 @@ module Stytch
         invite_expiration_minutes: nil,
         locale: nil
       )
+        headers = {}
         request = {
           email: email
         }
@@ -430,7 +437,7 @@ module Stytch
         request[:invite_expiration_minutes] = invite_expiration_minutes unless invite_expiration_minutes.nil?
         request[:locale] = locale unless locale.nil?
 
-        post_request('/v1/magic_links/email/invite', request)
+        post_request('/v1/magic_links/email/invite', request, headers)
       end
 
       # Revoke a pending invite based on the `email` provided.
@@ -451,11 +458,12 @@ module Stytch
       def revoke_invite(
         email:
       )
+        headers = {}
         request = {
           email: email
         }
 
-        post_request('/v1/magic_links/email/revoke_invite', request)
+        post_request('/v1/magic_links/email/revoke_invite', request, headers)
       end
     end
   end

data/lib/stytch/method_options.rb

@@ -0,0 +1,22 @@
+module Stytch
+  module MethodOptions
+    class Authorization
+      # A secret token for a given Stytch Session.
+      attr_accessor :session_token
+      # The JSON Web Token (JWT) for a given Stytch Session.
+      attr_accessor :session_jwt
+
+      def initialize(session_token: nil, session_jwt: nil)
+        @session_token = session_token
+        @session_jwt = session_jwt
+      end
+
+      def to_headers
+        headers = {}
+        headers['X-Stytch-Member-Session'] = session_token if session_token
+        headers['X-Stytch-Member-SessionJWT'] = session_jwt if session_jwt
+        headers
+      end
+    end
+  end
+end

data/lib/stytch/oauth.rb

@@ -53,6 +53,7 @@ module Stytch
       session_token: nil,
       session_jwt: nil
     )
+      headers = {}
       request = {
         provider: provider
       }
@@ -60,14 +61,18 @@ module Stytch
       request[:session_token] = session_token unless session_token.nil?
       request[:session_jwt] = session_jwt unless session_jwt.nil?
 
-      post_request('/v1/oauth/attach', request)
+      post_request('/v1/oauth/attach', request, headers)
     end
 
     # Authenticate a User given a `token`. This endpoint verifies that the user completed the OAuth flow by verifying that the token is valid and hasn't expired. To initiate a Stytch session for the user while authenticating their OAuth token, include `session_duration_minutes`; a session with the identity provider, e.g. Google or Facebook, will always be initiated upon successful authentication.
     #
     # == Parameters:
     # token::
-    #   The token to authenticate.
+    #   The OAuth `token` from the `?token=` query parameter in the URL.
+    #
+    #       The redirect URL will look like `https://example.com/authenticate?stytch_token_type=oauth&token=rM_kw42CWBhsHLF62V75jELMbvJ87njMe3tFVj7Qupu7`
+    #
+    #       In the redirect URL, the `stytch_token_type` will be `oauth`. See [here](https://stytch.com/docs/guides/dashboard/redirect-urls) for more detail.
     #   The type of this field is +String+.
     # session_token::
     #   Reuse an existing session instead of creating a new one. If you provide us with a `session_token`, then we'll update the session represented by this session token with this OAuth factor. If this `session_token` belongs to a different user than the OAuth token, the session_jwt will be ignored. This endpoint will error if both `session_token` and `session_jwt` are provided.
@@ -118,7 +123,7 @@ module Stytch
     # provider_values::
     #   The `provider_values` object lists relevant identifiers, values, and scopes for a given OAuth provider. For example this object will include a provider's `access_token` that you can use to access the provider's API for a given user.
     #
-    #   Note that these values will vary based on the OAuth provider in question, e.g. `id_token` is only returned by OIDC complaint identity providers.
+    #   Note that these values will vary based on the OAuth provider in question, e.g. `id_token` is only returned by OIDC compliant identity providers.
     #   The type of this field is +ProviderValues+ (+object+).
     # user::
     #   The `user` object affected by this API call. See the [Get user endpoint](https://stytch.com/docs/api/get-user) for complete response field details.
@@ -146,6 +151,7 @@ module Stytch
       session_custom_claims: nil,
       code_verifier: nil
     )
+      headers = {}
       request = {
         token: token
       }
@@ -155,7 +161,7 @@ module Stytch
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
       request[:code_verifier] = code_verifier unless code_verifier.nil?
 
-      post_request('/v1/oauth/authenticate', request)
+      post_request('/v1/oauth/authenticate', request, headers)
     end
   end
 end

data/lib/stytch/otps.rb

@@ -101,6 +101,7 @@ module Stytch
       session_jwt: nil,
       session_custom_claims: nil
     )
+      headers = {}
       request = {
         method_id: method_id,
         code: code
@@ -112,7 +113,7 @@ module Stytch
       request[:session_jwt] = session_jwt unless session_jwt.nil?
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-      post_request('/v1/otps/authenticate', request)
+      post_request('/v1/otps/authenticate', request, headers)
     end
 
     class Sms
@@ -129,11 +130,13 @@ module Stytch
       # ### Cost to send SMS OTP
       # Before configuring SMS or WhatsApp OTPs, please review how Stytch [bills the costs of international OTPs](https://stytch.com/pricing) and understand how to protect your app against [toll fraud](https://stytch.com/docs/guides/passcodes/toll-fraud/overview).
       #
-      # ### Add a phone number to an existing user
+      # __Note:__ SMS to phone numbers outside of the US and Canada is disabled by default for customers who did not use SMS prior to October 2023. If you're interested in sending international SMS, please reach out to [support@stytch.com](mailto:support@stytch.com?subject=Enable%20international%20SMS).
+      #
+      # Even when international SMS is enabled, we do not support sending SMS to countries on our [Unsupported countries list](https://stytch.com/docs/guides/passcodes/unsupported-countries).
       #
-      # This endpoint also allows you to add a new phone number to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in the request will add the phone number to the pre-existing Stytch User upon successful authentication.
+      # ### Add a phone number to an existing user
       #
-      # Adding a new phone number to an existing Stytch User requires the user to be present and validate the phone number via OTP. This requirement is in place to prevent account takeover attacks.
+      # This endpoint also allows you to add a new phone number to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in your Send one-time passcode by SMS request will add the new, unverified phone number to the existing Stytch User. If the user successfully authenticates within 5 minutes, the new phone number will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that phone number will create a new User.
       #
       # ### Next steps
       #
@@ -190,6 +193,7 @@ module Stytch
         session_token: nil,
         session_jwt: nil
       )
+        headers = {}
         request = {
           phone_number: phone_number
         }
@@ -200,13 +204,18 @@ module Stytch
         request[:session_token] = session_token unless session_token.nil?
         request[:session_jwt] = session_jwt unless session_jwt.nil?
 
-        post_request('/v1/otps/sms/send', request)
+        post_request('/v1/otps/sms/send', request, headers)
       end
 
       # Send a One-Time Passcode (OTP) to a User using their phone number. If the phone number is not associated with a user already, a user will be created.
       #
       # ### Cost to send SMS OTP
       # Before configuring SMS or WhatsApp OTPs, please review how Stytch [bills the costs of international OTPs](https://stytch.com/pricing) and understand how to protect your app against [toll fraud](https://stytch.com/docs/guides/passcodes/toll-fraud/overview).
+      #
+      # __Note:__ SMS to phone numbers outside of the US and Canada is disabled by default for customers who did not use SMS prior to October 2023. If you're interested in sending international SMS, please reach out to [support@stytch.com](mailto:support@stytch.com?subject=Enable%20international%20SMS).
+      #
+      # Even when international SMS is enabled, we do not support sending SMS to countries on our [Unsupported countries list](https://stytch.com/docs/guides/passcodes/unsupported-countries).
+      #
       # ### Next steps
       #
       # Collect the OTP which was delivered to the User. Call [Authenticate OTP](https://stytch.com/docs/api/authenticate-otp) using the OTP `code` along with the `phone_id` found in the response as the `method_id`.
@@ -261,6 +270,7 @@ module Stytch
         create_user_as_pending: nil,
         locale: nil
       )
+        headers = {}
         request = {
           phone_number: phone_number
         }
@@ -269,7 +279,7 @@ module Stytch
         request[:create_user_as_pending] = create_user_as_pending unless create_user_as_pending.nil?
         request[:locale] = locale unless locale.nil?
 
-        post_request('/v1/otps/sms/login_or_create', request)
+        post_request('/v1/otps/sms/login_or_create', request, headers)
       end
     end
 
@@ -289,9 +299,7 @@ module Stytch
       #
       # ### Add a phone number to an existing user
       #
-      # This endpoint also allows you to add a new phone number to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in the request will add the phone number to the pre-existing Stytch User upon successful authentication.
-      #
-      # Adding a new phone number to an existing Stytch User requires the user to be present and validate the phone number via OTP. This requirement is in place to prevent account takeover attacks.
+      # This endpoint also allows you to add a new phone number to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in your Send one-time passcode by WhatsApp request will add the new, unverified phone number to the existing Stytch User. If the user successfully authenticates within 5 minutes, the new phone number will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that phone number will create a new User.
       #
       # ### Next steps
       #
@@ -348,6 +356,7 @@ module Stytch
         session_token: nil,
         session_jwt: nil
       )
+        headers = {}
         request = {
           phone_number: phone_number
         }
@@ -358,7 +367,7 @@ module Stytch
         request[:session_token] = session_token unless session_token.nil?
         request[:session_jwt] = session_jwt unless session_jwt.nil?
 
-        post_request('/v1/otps/whatsapp/send', request)
+        post_request('/v1/otps/whatsapp/send', request, headers)
       end
 
       # Send a one-time passcode (OTP) to a User's WhatsApp using their phone number. If the phone number is not associated with a User already, a User will be created.
@@ -420,6 +429,7 @@ module Stytch
         create_user_as_pending: nil,
         locale: nil
       )
+        headers = {}
         request = {
           phone_number: phone_number
         }
@@ -428,7 +438,7 @@ module Stytch
         request[:create_user_as_pending] = create_user_as_pending unless create_user_as_pending.nil?
         request[:locale] = locale unless locale.nil?
 
-        post_request('/v1/otps/whatsapp/login_or_create', request)
+        post_request('/v1/otps/whatsapp/login_or_create', request, headers)
       end
     end
 
@@ -442,12 +452,10 @@ module Stytch
       # Send a One-Time Passcode (OTP) to a User using their email. If you'd like to create a user and send them a passcode with one request, use our [log in or create endpoint](https://stytch.com/docs/api/log-in-or-create-user-by-email-otp).
       #
       # ### Add an email to an existing user
-      # This endpoint also allows you to add a new email to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in the request will add the email to the pre-existing Stytch User upon successful authentication.
-      #
-      # Adding a new email to an existing Stytch User requires the User to be present and validate the email via OTP. This requirement is in place to prevent account takeover attacks.
+      # This endpoint also allows you to add a new email address to an existing Stytch User. Including a `user_id`, `session_token`, or `session_jwt` in your Send one-time passcode by email request will add the new, unverified email address to the existing Stytch User. If the user successfully authenticates within 5 minutes, the new email address will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that email address will create a new User.
       #
       # ### Next steps
-      # Collect the OTP which was delivered to the user. Call [Authenticate OTP](https://stytch.com/docs/api/authenticate-otp) using the OTP `code` along with the `phone_id` found in the response as the `method_id`.
+      # Collect the OTP which was delivered to the user. Call [Authenticate OTP](https://stytch.com/docs/api/authenticate-otp) using the OTP `code` along with the `email_id` found in the response as the `method_id`.
       #
       # == Parameters:
       # email::
@@ -508,6 +516,7 @@ module Stytch
         login_template_id: nil,
         signup_template_id: nil
       )
+        headers = {}
         request = {
           email: email
         }
@@ -520,7 +529,7 @@ module Stytch
         request[:login_template_id] = login_template_id unless login_template_id.nil?
         request[:signup_template_id] = signup_template_id unless signup_template_id.nil?
 
-        post_request('/v1/otps/email/send', request)
+        post_request('/v1/otps/email/send', request, headers)
       end
 
       # Send a one-time passcode (OTP) to a User using their email. If the email is not associated with a User already, a User will be created.
@@ -587,6 +596,7 @@ module Stytch
         login_template_id: nil,
         signup_template_id: nil
       )
+        headers = {}
         request = {
           email: email
         }
@@ -597,7 +607,7 @@ module Stytch
         request[:login_template_id] = login_template_id unless login_template_id.nil?
         request[:signup_template_id] = signup_template_id unless signup_template_id.nil?
 
-        post_request('/v1/otps/email/login_or_create', request)
+        post_request('/v1/otps/email/login_or_create', request, headers)
       end
     end
   end

data/lib/stytch/passwords.rb

@@ -34,7 +34,7 @@ module Stytch
     #   The email address of the end user.
     #   The type of this field is +String+.
     # password::
-    #   The password of the user
+    #   The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characers, etc.
     #   The type of this field is +String+.
     # session_duration_minutes::
     #   Set the session lifetime to be this many minutes from now. This will start a new session if one doesn't already exist,
@@ -100,6 +100,7 @@ module Stytch
       untrusted_metadata: nil,
       name: nil
     )
+      headers = {}
       request = {
         email: email,
         password: password
@@ -110,7 +111,7 @@ module Stytch
       request[:untrusted_metadata] = untrusted_metadata unless untrusted_metadata.nil?
       request[:name] = name unless name.nil?
 
-      post_request('/v1/passwords', request)
+      post_request('/v1/passwords', request, headers)
     end
 
     # Authenticate a user with their email address and password. This endpoint verifies that the user has a password currently set, and that the entered password is correct. There are two instances where the endpoint will return a `reset_password` error even if they enter their previous password:
@@ -126,7 +127,7 @@ module Stytch
     #   The email address of the end user.
     #   The type of this field is +String+.
     # password::
-    #   The password of the user
+    #   The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characers, etc.
     #   The type of this field is +String+.
     # session_token::
     #   The `session_token` associated with a User's existing Session.
@@ -185,6 +186,7 @@ module Stytch
       session_jwt: nil,
       session_custom_claims: nil
     )
+      headers = {}
       request = {
         email: email,
         password: password
@@ -194,7 +196,7 @@ module Stytch
       request[:session_jwt] = session_jwt unless session_jwt.nil?
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-      post_request('/v1/passwords/authenticate', request)
+      post_request('/v1/passwords/authenticate', request, headers)
     end
 
     # This API allows you to check whether or not the user’s provided password is valid, and to provide feedback to the user on how to increase the strength of their password.
@@ -212,7 +214,7 @@ module Stytch
     #
     # == Parameters:
     # password::
-    #   The password of the user
+    #   The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characers, etc.
     #   The type of this field is +String+.
     # email::
     #   The email address of the end user.
@@ -248,12 +250,13 @@ module Stytch
       password:,
       email: nil
     )
+      headers = {}
       request = {
         password: password
       }
       request[:email] = email unless email.nil?
 
-      post_request('/v1/passwords/strength_check', request)
+      post_request('/v1/passwords/strength_check', request, headers)
     end
 
     # Adds an existing password to a User's email that doesn't have a password yet. We support migrating users from passwords stored with `bcrypt`, `scrypt`, `argon2`, `MD-5`, `SHA-1`, or `PBKDF2`. This endpoint has a rate limit of 100 requests per second.
@@ -289,6 +292,11 @@ module Stytch
     # untrusted_metadata::
     #   The `untrusted_metadata` field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details.
     #   The type of this field is nilable +object+.
+    # set_email_verified::
+    #   Whether to set the user's email as verified. This is a dangerous field. Incorrect use may lead to users getting erroneously
+    #                 deduplicated into one user object. This flag should only be set if you can attest that the user owns the email address in question.
+    #                 Access to this field is restricted. To enable it, please send us a note at support@stytch.com.
+    #   The type of this field is nilable +Boolean+.
     # name::
     #   The name of the user. Each field in the name object is optional.
     #   The type of this field is nilable +Name+ (+object+).
@@ -324,8 +332,10 @@ module Stytch
       pbkdf_2_config: nil,
       trusted_metadata: nil,
       untrusted_metadata: nil,
+      set_email_verified: nil,
       name: nil
     )
+      headers = {}
       request = {
         email: email,
         hash: hash,
@@ -338,9 +348,10 @@ module Stytch
       request[:pbkdf_2_config] = pbkdf_2_config unless pbkdf_2_config.nil?
       request[:trusted_metadata] = trusted_metadata unless trusted_metadata.nil?
       request[:untrusted_metadata] = untrusted_metadata unless untrusted_metadata.nil?
+      request[:set_email_verified] = set_email_verified unless set_email_verified.nil?
       request[:name] = name unless name.nil?
 
-      post_request('/v1/passwords/migrate', request)
+      post_request('/v1/passwords/migrate', request, headers)
     end
 
     class Email
@@ -415,33 +426,37 @@ module Stytch
         locale: nil,
         reset_password_template_id: nil
       )
+        headers = {}
         request = {
           email: email
         }
         request[:reset_password_redirect_url] = reset_password_redirect_url unless reset_password_redirect_url.nil?
-        unless reset_password_expiration_minutes.nil?
-          request[:reset_password_expiration_minutes] =
-            reset_password_expiration_minutes
-        end
+        request[:reset_password_expiration_minutes] = reset_password_expiration_minutes unless reset_password_expiration_minutes.nil?
         request[:code_challenge] = code_challenge unless code_challenge.nil?
         request[:attributes] = attributes unless attributes.nil?
         request[:login_redirect_url] = login_redirect_url unless login_redirect_url.nil?
         request[:locale] = locale unless locale.nil?
         request[:reset_password_template_id] = reset_password_template_id unless reset_password_template_id.nil?
 
-        post_request('/v1/passwords/email/reset/start', request)
+        post_request('/v1/passwords/email/reset/start', request, headers)
       end
 
       # Reset the user’s password and authenticate them. This endpoint checks that the magic link `token` is valid, hasn’t expired, or already been used – and can optionally require additional security settings, such as the IP address and user agent matching the initial reset request.
       #
       # The provided password needs to meet our password strength requirements, which can be checked in advance with the password strength endpoint. If the token and password are accepted, the password is securely stored for future authentication and the user is authenticated.
       #
+      # Note that a successful password reset by email will revoke all active sessions for the `user_id`.
+      #
       # == Parameters:
       # token::
-      #   The token to authenticate.
+      #   The Passwords `token` from the `?token=` query parameter in the URL.
+      #
+      #       In the redirect URL, the `stytch_token_type` will be `login` or `reset_password`.
+      #
+      #       See examples and read more about redirect URLs [here](https://stytch.com/docs/guides/dashboard/redirect-urls).
       #   The type of this field is +String+.
       # password::
-      #   The password of the user
+      #   The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characers, etc.
       #   The type of this field is +String+.
       # session_token::
       #   The `session_token` associated with a User's existing Session.
@@ -512,6 +527,7 @@ module Stytch
         attributes: nil,
         options: nil
       )
+        headers = {}
         request = {
           token: token,
           password: password
@@ -524,7 +540,7 @@ module Stytch
         request[:attributes] = attributes unless attributes.nil?
         request[:options] = options unless options.nil?
 
-        post_request('/v1/passwords/email/reset', request)
+        post_request('/v1/passwords/email/reset', request, headers)
       end
     end
 
@@ -537,6 +553,8 @@ module Stytch
 
       # Reset the User’s password using their existing password.
       #
+      # Note that a successful password reset via an existing password will revoke all active sessions for the `user_id`.
+      #
       # == Parameters:
       # email::
       #   The email address of the end user.
@@ -605,6 +623,7 @@ module Stytch
         session_jwt: nil,
         session_custom_claims: nil
       )
+        headers = {}
         request = {
           email: email,
           existing_password: existing_password,
@@ -615,7 +634,7 @@ module Stytch
         request[:session_jwt] = session_jwt unless session_jwt.nil?
         request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-        post_request('/v1/passwords/existing_password/reset', request)
+        post_request('/v1/passwords/existing_password/reset', request, headers)
       end
     end
 
@@ -628,9 +647,11 @@ module Stytch
 
       # Reset the user’s password using their existing session. The endpoint will error if the session does not have a password, email magic link, or email OTP authentication factor that has been issued within the last 5 minutes. This endpoint requires either a `session_jwt` or `session_token` be included in the request.
       #
+      # Note that a successful password reset via an existing session will revoke all active sessions for the `user_id`, except for the one used during the reset flow.
+      #
       # == Parameters:
       # password::
-      #   The password of the user
+      #   The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characers, etc.
       #   The type of this field is +String+.
       # session_token::
       #   The `session_token` associated with a User's existing Session.
@@ -638,6 +659,22 @@ module Stytch
       # session_jwt::
       #   The `session_jwt` associated with a User's existing Session.
       #   The type of this field is nilable +String+.
+      # session_duration_minutes::
+      #   Set the session lifetime to be this many minutes from now. This will start a new session if one doesn't already exist,
+      #   returning both an opaque `session_token` and `session_jwt` for this session. Remember that the `session_jwt` will have a fixed lifetime of
+      #   five minutes regardless of the underlying session duration, and will need to be refreshed over time.
+      #
+      #   This value must be a minimum of 5 and a maximum of 527040 minutes (366 days).
+      #
+      #   If a `session_token` or `session_jwt` is provided then a successful authentication will continue to extend the session this many minutes.
+      #
+      #   If the `session_duration_minutes` parameter is not specified, a Stytch session will not be created.
+      #   The type of this field is nilable +Integer+.
+      # session_custom_claims::
+      #   Add a custom claims map to the Session being authenticated. Claims are only created if a Session is initialized by providing a value in `session_duration_minutes`. Claims will be included on the Session object and in the JWT. To update a key in an existing Session, supply a new value. To delete a key, supply a null value.
+      #
+      #   Custom claims made with reserved claims ("iss", "sub", "aud", "exp", "nbf", "iat", "jti") will be ignored. Total custom claims size cannot exceed four kilobytes.
+      #   The type of this field is nilable +object+.
       #
       # == Returns:
       # An object with the following fields:
@@ -650,6 +687,12 @@ module Stytch
       # user::
       #   The `user` object affected by this API call. See the [Get user endpoint](https://stytch.com/docs/api/get-user) for complete response field details.
       #   The type of this field is +User+ (+object+).
+      # session_token::
+      #   A secret token for a given Stytch Session.
+      #   The type of this field is +String+.
+      # session_jwt::
+      #   The JSON Web Token (JWT) for a given Stytch Session.
+      #   The type of this field is +String+.
       # status_code::
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
@@ -662,15 +705,20 @@ module Stytch
       def reset(
         password:,
         session_token: nil,
-        session_jwt: nil
+        session_jwt: nil,
+        session_duration_minutes: nil,
+        session_custom_claims: nil
       )
+        headers = {}
         request = {
           password: password
         }
         request[:session_token] = session_token unless session_token.nil?
         request[:session_jwt] = session_jwt unless session_jwt.nil?
+        request[:session_duration_minutes] = session_duration_minutes unless session_duration_minutes.nil?
+        request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-        post_request('/v1/passwords/session/reset', request)
+        post_request('/v1/passwords/session/reset', request, headers)
       end
     end
   end