Integrations

Works with what you already run

SenseCrypt speaks OIDC, SAML 2.0, and SCIM 2.0, the standards that carry single sign-on (SSO) and provisioning across identity platforms and business apps. If it's in your stack, there's a path in.

Five standards-based paths in

OIDC federation

Platforms like Okta, Ping, and Auth0 delegate sign-in to SenseCrypt as an external OIDC identity provider. Setup is one discovery URL and a client credential, and a pilot is low-stakes: your current IdP stays in place while one app or one user group moves to face sign-in.

SAML 2.0 SSO

Any SAML 2.0 service provider, from Salesforce to Google Workspace to Slack, federates through a metadata exchange. Paste theirs, download ours. The console pre-fills entity ID, ACS URLs, and certificates, and attribute mapping shapes the assertion your SP expects.

SCIM 2.0 provisioning

Okta, Entra ID, and other directories push users and groups into SenseCrypt over SCIM 2.0; your directory stays the source of truth. New users arrive as pending shells until they enroll, and deactivating a user revokes access immediately.

M2M client credentials

Backend services authenticate with the client-credentials grant, no user in the loop. The access token acts within one tenant and carries only the capabilities its bound roles grant.

CIBA backchannel

When the flow has no browser, your server starts sign-in with a user hint. SenseCrypt emails the user a sign-in QR, a live face check on their phone approves it, and your server collects the tokens.

Setup

What connecting looks like

Each connection comes down to an artifact or two: endpoints your tenant publishes on its own issuer host, plus a credential from the console. These are the real values; swap in your issuer and they resolve.

Delegate sign-in over OIDC

Register the app in the admin console for a client ID and credential, then point any standard OIDC library at the discovery document. Endpoints, signing keys, and scopes resolve from there, and the code flow runs PKCE with S256.

Discovery URL

{issuer}/.well-known/openid-configuration

Client credential

client_id · client_secret

Trade metadata with your SP

Your tenant publishes its IdP metadata at a stable URL; point your SP at it, or configure the SSO URL and certificate by hand. In the other direction, paste your SP's metadata into the console to pre-fill the entity ID, ACS URLs, and certificates.

IdP metadata

{issuer}/v1/idp/saml/metadata

SSO URL

{issuer}/v1/idp/saml/sso

Hand your IdP a SCIM token

Mint a bearer token in the admin console; the secret shows once, stays scoped to the tenant, and can be revoked at any time. Your identity provider's connector takes the base URL and the token, and Users, Groups, and memberships flow in from there.

SCIM base URL

{issuer}/v1/idp/scim/v2

Bearer token

Authorization: Bearer ssct_...