OpenID Connect (OIDC) identity provider

What the OIDC provider is

SenseCrypt is a full identity provider (IdP).

It supports OpenID Connect (OIDC) on top of OAuth 2.0.

Your app federates sign-in to SenseCrypt.

SenseCrypt authenticates the enrolled person by face.

• —OIDC on top of OAuth 2.0.
• —Passwordless sign-in by face.
• —Standard tokens for your app.
• —One IdP for many apps.

How the OIDC flow works

Your app sends the user to SenseCrypt.

The user signs in by face.

Face matching runs on-device.

SenseCrypt returns an authorization code to your app.

Your app exchanges the code for OIDC tokens.

• —OAuth 2.0 with PKCE protects the code.
• —Pushed Authorization Requests (PAR) protect the request.
• —The user signs in by face.
• —Your app receives ID and access tokens.

What you get

You get passwordless sign-in through a standard protocol.

OIDC works with standard client libraries.

SenseCrypt adds RBAC and multi-tenant isolation.

SenseCrypt writes audit logs for each event.

• —Standard OIDC and OAuth 2.0.
• —PKCE and PAR for hardened flows.
• —Role-based access control (RBAC).
• —Multi-tenant isolation and audit logs.

How it fits the standard

SenseCrypt follows OpenID Connect (OIDC).

It uses OAuth 2.0 with PKCE and PAR.

Your OIDC client library connects with standard settings.

SenseCrypt also supports SAML 2.0, SCIM 2.0, and CIBA.

• —OIDC discovery for easy setup.
• —OAuth 2.0 authorization code with PKCE.
• —PAR for request integrity.
• —SAML 2.0, SCIM 2.0, and CIBA also.

How to turn it on

You start with a 30-day free trial.

The trial needs no card.

You register your app as an OIDC client.

Pricing is one dollar per user per month, flat.

• —Start a 30-day free trial, no card.
• —Register your app as an OIDC client.
• —Point your library at SenseCrypt.
• —Pricing is one dollar per user per month.