Which flow should I use?
Pick the right SenseCrypt integration — Authorization Code with PKCE, CIBA, client-credentials (M2M), or SAML — based on whether a human signs in, whether a browser is present, and what protocol your app speaks.
SenseCrypt supports a deliberately small, standards-based set of flows. Choosing between them comes down to three questions: is a human signing in, or is it a machine? — is a browser present at login? — and does your app speak OIDC or SAML? In every human flow, the biometric face proof happens on the user's phone; the flow only decides how your app starts and finishes the exchange.
Decision tree
The rules, in words
- A machine or service calling the Management API — no human, no browser → client-credentials (M2M). You get an access token for a service account with scoped roles. See Machine-to-machine.
- A human, and your app is a SAML service provider — → SAML 2.0 SSO, with SenseCrypt acting as the SAML IdP. See SAML SSO.
- A human, OIDC, with a browser at sign-in (a web app, single-page app, or native app that can open a browser) → Authorization Code flow with PKCE. This is the common case. See Add Login (OIDC) or a framework quickstart.
- A human, OIDC, but no browser on the device initiating the sign-in (a kiosk, a CLI, a call-center agent verifying a caller) → CIBA, where the request is decoupled and the user approves on their own phone. See CIBA back-channel.
Whichever flow you pick, the actual sign-in — the on-device face proof — is identical and happens on the user's phone. The flow only determines how your application initiates the request and receives the result. No biometric data ever leaves the device.
What SenseCrypt does not support
So you don't spend time looking for them: SenseCrypt intentionally does not implement the Implicit flow, the Hybrid flow, the Resource Owner Password Credentials (password) grant, the OAuth Device Authorization grant, or Dynamic Client Registration. response_type is code only, and code_challenge_method is S256 only. These omissions are deliberate — each is either superseded by Authorization Code + PKCE or incompatible with an on-device biometric model.
Learn more
What is SenseCrypt?
SenseCrypt is a passwordless, biometric, multi-tenant identity provider — OIDC/OAuth 2.0, SAML 2.0, SCIM 2.0, and CIBA — where every sign-in is gated by an on-device face proof and no biometric data ever leaves the phone.
Add Login (OIDC)
Add biometric single sign-on to your web app with the OIDC Authorization Code flow and PKCE — discovery, redirect, code exchange, and ES256 id_token validation.