SenseCrypt Docs
Guides

Guides

Task-focused how-tos for building on SenseCrypt — managing tenants, custom domains, customizing claims, RBAC, group-based access, branding, your own Authenticator app, refresh tokens, key rotation, testing, and security hardening.

Practical, task-focused how-tos. Each guide walks through one job end to end. If you're looking for the why behind a feature, see Concepts; for look-up material, see the Reference.

In this section

Managing tenants

Create and manage tenants — each its own OIDC issuer at its own hostname.

Custom domains

Serve a tenant on a hostname you own — the two DNS records, verification, and the passkey sign-in host.

Customize claims and scopes

Control which profile claims land in your tokens, using typed attributes, scopes, and per-app bindings.

RBAC: roles and permissions

Emit a permissions claim your own API enforces, with resource servers, permissions, and roles.

Groups and access

Open and close sign-in access to an application with the default-closed group-to-app gate.

Branding

Customize the hosted login experience — logo and per-application branding.

Ship your own Authenticator app

Run a tenant on an app you build and distribute — attestation identity, push credentials and app links on the Mobile App page.

Refresh tokens and sessions

Keep users signed in with offline_access, handle rotation, and implement logout.

Back-channel logout

Receive signed logout tokens when a session your app was signed in to ends.

Sender-constrained tokens

Bind access tokens to a key your client holds, with DPoP or mutual TLS.

Signed requests and responses

Sign the authorization request with JAR, and verify a JARM-signed response.

Console sign-in methods

Choose a sign-in method for your console account: a password, or providers such as Google. Learn why a provider account gets no reset email.

Account lifecycle

Understand the account and user lifecycle — creation, verification, and deletion.

Billing and subscriptions

Manage your subscription and trial, payment methods, and invoices for the hosted service.

Signing-key rotation

Rotate OIDC and SAML signing keys with a grace window, without breaking live tokens.

Audit log

Read, filter, stream, export, and verify the tamper-evident audit trail.

Testing your integration

Verify your integration end to end, including without a physical phone.

Security best practices

Harden your integration: redirect-URI hygiene, PKCE, token storage, rotation, sessions, and attestation.

Where to start

Face PKI over CIBA

Ask a user's face-locked post-quantum keys for their public keys, a signature or a shared secret — start a ceremony at the backchannel endpoint, receive the signed result at your own endpoint, and check the receipt in the ID token.

Managing tenants

Onboard in the admin console and manage tenants — the auto-created default tenant, creating, renaming, and deleting tenants, and getting from signup to your first registered application.

On this page

In this sectionWhere to start