What is SenseCrypt?

SenseCrypt is a passwordless, multi-tenant identity provider (IdP) you drop in front of your apps. Your users sign in with a face scan on their phone instead of a password, and your app talks to SenseCrypt over the same standard protocols you already use with any other IdP — OIDC / OAuth 2.0, SAML 2.0, SCIM 2.0, and CIBA. The one thing that's different is invisible to your code: the login ceremony is gated by an on-device biometric proof, and no face image or template ever reaches your servers or ours.

If you've integrated Auth0, Okta, or Entra, SenseCrypt will feel familiar. You register an application, point a standards-compliant library at your tenant's issuer, and receive signed tokens back. The biometric step happens behind the standard authorize/token exchange.

The problem it solves

Passwords and shared secrets are the root of most account-takeover incidents — they get phished, reused, and leaked. Bolt-on MFA helps but adds friction and is itself phishable. SenseCrypt removes the password entirely: authentication is a face match performed on the user's own device, bound to a hardware-backed device key. That gives you strong, phishing-resistant sign-in without your application ever handling — or being able to handle — biometric data.

That last point is a hard architectural guarantee, not a policy: SenseCrypt is biometric-blind. Face matching runs on the phone; the service only verifies a cryptographic proof (a PKCE-style hash comparison). There is deliberately no code path anywhere in the service that receives or decrypts biometric material. See How SenseCrypt works and Security.

What you get

• Passwordless, phishing-resistant sign-in — an on-device face proof plus a hardware-bound device key, with nothing to phish, reset, or leak.
• Standard protocols in and out — plain OIDC, SAML, and SCIM libraries work unchanged; the biometric ceremony sits behind the standard exchange.
• Multi-tenant by design — each tenant is its own issuer on its own hostname, with its own signing keys and a hard isolation boundary.
• A full admin console + Management API — register apps, manage users and groups, gate access, customize claims, and provision over SCIM.

Protocol support at a glance

When to choose SenseCrypt

SenseCrypt is a good fit when you want:

• Passwordless authentication that is genuinely phishing-resistant, without building device attestation and biometric plumbing yourself.
• A privacy-preserving posture where biometric data provably never touches your infrastructure — useful for regulated or high-assurance workloads.
• A standards-based multi-tenant IdP you can integrate with existing OIDC/SAML libraries, whether you run one app or many isolated customer environments.
• The option to self-host the IdP in your own infrastructure alongside the hosted service.

It is not a password manager or a social-login aggregator, and it does not store passwords — there are none.

Next steps

• Add Login (OIDC) — the fastest path: wire SenseCrypt into a web app end to end.
• Get Started — framework quickstarts (Next.js, React SPA, Node, Python) plus SAML, SCIM, M2M, and CIBA integration guides.
• Concepts — the mental model: protocols, multi-tenancy, tokens, and authorization.
• API Reference — the full REST surface across OIDC, SAML, SCIM, and the admin/Management API.
• Self-Hosting — run SenseCrypt in your own environment.