SenseCrypt Documentation

Passwordless, biometric, multi-tenant identity — OIDC, SAML, SCIM, and CIBA over an on-device face proof. Add login in minutes, or explore the protocols, guides, and API reference.

Add passwordless, biometric sign-in to your app over the standard protocols you already use — OIDC, SAML, SCIM, and CIBA — with every login gated by an on-device face proof. Pick a path below, or read What is SenseCrypt? for the full picture.

Each quickstart is copy-paste: install, configure, run, and complete the face proof on your phone.

React SPA

Browser-only public client, PKCE with oidc-client-ts.

Next.js (App Router)

Server-side code exchange with openid-client.

Node.js (Express)

Confidential client with openid-client.

Python (FastAPI)

Confidential client with Authlib.

Any OIDC library

The protocol-level walkthrough every quickstart builds on.

Which flow should I use?

Pick the right integration for your app.

Choose your integration

OIDC & OAuth 2.0

Authorization Code + PKCE, discovery, PAR, tokens, and every endpoint.

SAML 2.0 SSO

Federate an enterprise app — SenseCrypt as the SAML IdP.

SCIM provisioning

Provision users and groups from your directory over SCIM 2.0.

CIBA back-channel

Decoupled, browser-free authentication — approve on the phone.

Machine-to-machine

Client-credentials access to the Management API.

Learn the platform

What is SenseCrypt?

The passwordless, biometric-blind model and when to choose it.

Concepts

Protocols, multi-tenancy, tokens, sessions, and the authorization model.

Guides

Task-focused how-tos — RBAC, claims, groups, key rotation, and more.

Security

The biometric privacy guarantees, anti-enumeration, and hardening.

Self-Hosting

Run SenseCrypt in your own infrastructure.

Reference

Error codes, rate limits, token validation, and the glossary.

New to SenseCrypt?

Read How SenseCrypt works for the passwordless, on-device biometric model (SenseCrypt never sees a face image or template) — built on real FIDO2/WebAuthn passkeys (ES256), with the passkey path phishing-resistant through WebAuthn origin binding — then head to Get Started when you're ready to build. Need a hand? See Support.

Get Started

API Reference

SDKs & apps

Add biometric login to your app