Integrations
Works with what you already run
SenseCrypt speaks OIDC, SAML 2.0, and SCIM 2.0, the standards that carry single sign-on (SSO) and provisioning across identity platforms and business apps. If it's in your stack, there's a path in.
Five standards-based paths in
OIDC federation
Platforms like Okta, Ping, and Auth0 delegate sign-in to SenseCrypt as an external OIDC identity provider. Setup is one discovery URL and a client credential, and a pilot is low-stakes: your current IdP stays in place while one app or one user group moves to face sign-in.
SAML 2.0 SSO
Any SAML 2.0 service provider, from Salesforce to Google Workspace to Slack, federates through a metadata exchange. Paste theirs, download ours. The console pre-fills entity ID, ACS URLs, and certificates, and attribute mapping shapes the assertion your SP expects.
SCIM 2.0 provisioning
Okta, Entra ID, and other directories push users and groups into SenseCrypt over SCIM 2.0; your directory stays the source of truth. New users arrive as pending shells until they enroll, and deactivating a user revokes access immediately.
M2M client credentials
Backend services authenticate with the client-credentials grant, no user in the loop. The access token acts within one tenant and carries only the capabilities its bound roles grant.
CIBA backchannel
When the flow has no browser, your server starts sign-in with a user hint. SenseCrypt emails the user a sign-in QR, a live face check on their phone approves it, and your server collects the tokens.
Setup
What connecting looks like
Each connection comes down to an artifact or two: endpoints your tenant publishes on its own issuer host, plus a credential from the console. These are the real values; swap in your issuer and they resolve.
Delegate sign-in over OIDC
Register the app in the admin console for a client ID and credential, then point any standard OIDC library at the discovery document. Endpoints, signing keys, and scopes resolve from there, and the code flow runs PKCE with S256.
Discovery URL
{issuer}/.well-known/openid-configurationClient credential
client_id · client_secretTrade metadata with your SP
Your tenant publishes its IdP metadata at a stable URL; point your SP at it, or configure the SSO URL and certificate by hand. In the other direction, paste your SP's metadata into the console to pre-fill the entity ID, ACS URLs, and certificates.
IdP metadata
{issuer}/v1/idp/saml/metadataSSO URL
{issuer}/v1/idp/saml/ssoHand your IdP a SCIM token
Mint a bearer token in the admin console; the secret shows once, stays scoped to the tenant, and can be revoked at any time. Your identity provider's connector takes the base URL and the token, and Users, Groups, and memberships flow in from there.
SCIM base URL
{issuer}/v1/idp/scim/v2Bearer token
Authorization: Bearer ssct_...Identity platforms
Okta
Microsoft Entra ID
Ping Identity
Auth0
OneLogin
AWS IAM Identity Center
Business applications
Salesforce
Google Workspace
Slack
Atlassian Cloud
GitHub Enterprise
ServiceNow
Zoom
Zendesk
Dropbox Business
Logos identify third-party services that support the listed open standards; they don't imply partnership or endorsement.
Setup guides
One guide per connection
Each guide covers one connection, from the first setting to a test sign-in.
Add SenseCrypt face login to Okta
Connect SenseCrypt to Okta as an external identity provider through OIDC or SAML 2.0. Users sign in by face login, passwordless. No proprietary connector.
Read the guideSenseCrypt as an external IdP for Microsoft Entra ID
Add SenseCrypt as an external identity provider for Microsoft Entra ID through OIDC or SAML 2.0. Users sign in by face login. No proprietary connector.
Read the guidePasswordless SSO for Salesforce
Give Salesforce passwordless single sign-on with SenseCrypt face login. Federate through SAML 2.0 or OIDC with metadata. No proprietary connector.
Read the guideConnect any OIDC app to SenseCrypt
Connect any OIDC application to SenseCrypt through standard OpenID Connect. Use discovery URLs and metadata for passwordless face login, phishing-resistant on the FIDO2 passkey path.
Read the guideConnect any SAML 2.0 app to SenseCrypt
Connect any SAML 2.0 application to SenseCrypt through standards-based federation. Exchange metadata files for passwordless face login, phishing-resistant on the FIDO2 passkey path.
Read the guideFederate SenseCrypt with Ping Identity
Federate SenseCrypt with Ping Identity through standard OIDC and SAML 2.0. Use metadata and discovery URLs for passwordless face login, phishing-resistant on the FIDO2 passkey path.
Read the guideYour first connection is a metadata file away
One metadata file or discovery URL connects your first app. The guides show every step.