What this integration does
SenseCrypt acts as your OpenID Connect provider. Your OIDC application acts as the relying party. The application sends users to SenseCrypt to sign in. SenseCrypt returns a signed ID token. The token confirms the enrolled user.
- SenseCrypt is the identity provider (IdP).
- Your application is the OIDC client.
- The integration uses open standards, not a proprietary connector.
- Users sign in with face login.
How the standards flow works
SenseCrypt publishes a discovery document for OpenID Connect. The document lives at a well-known discovery URL. Your application reads the URL to find every endpoint. SenseCrypt supports OAuth 2.0 with PKCE and PAR. These features protect the authorization request.
- The discovery URL lists the authorization and token endpoints.
- PKCE binds the authorization code to your client.
- PAR sends the request through a secure back channel.
- SenseCrypt signs each ID token with a published key.
Setup steps
You register your application in the SenseCrypt console. You set the redirect URI. You copy the discovery URL into your application. The face match runs on-device during sign in. SenseCrypt stores no biometric data on the server.
- Create an OIDC client in the SenseCrypt console.
- Enter your redirect URI.
- Add the SenseCrypt discovery URL to your application.
- Map the standard claims to your user profile.
- Test the sign in flow.
What you get
Your users get passwordless sign in. Face login uses no password and no shared code at sign in. Each sign in binds to the device. This binding makes the flow phishing-resistant. You keep your existing OIDC application. You add strong authentication through open standards.
- Passwordless sign in for every user.
- Phishing-resistant authentication with no password or shared code to enter at sign in.
- On-device face match keeps biometric data off the server.
- Standard OIDC claims for your application.
Frequently asked questions
Does SenseCrypt need a proprietary connector?
No. SenseCrypt uses standard OpenID Connect. Your application reads the discovery URL and metadata. This is standards-based federation.
Where does the face match run?
The face match runs on-device. SenseCrypt stores no biometric data on the server. It uses patent-pending face tokenization.
Which OAuth features does SenseCrypt support?
SenseCrypt supports OAuth 2.0 with PKCE and PAR. It also supports OIDC, SAML 2.0, SCIM 2.0, and CIBA.
What does my application receive after sign in?
Your application receives a signed ID token. The token carries standard OIDC claims about the enrolled user.
Related