Get Started
Choose your path to integrate SenseCrypt — a framework Add Login quickstart, the protocol-level OIDC walkthrough, or an enterprise integration (SAML, SCIM, M2M, CIBA).
SenseCrypt gives your app passwordless, on-device biometric sign-in over standard protocols. Pick the path that matches what you're building — every path assumes you have a SenseCrypt tenant (its own issuer at https://<your-tenant>.<domain> — see Multi-tenancy) and an application registered in the admin console.
Add Login to a web app
The most common task: let users Sign in with SenseCrypt. Start with your framework — each quickstart is copy-paste: install, configure, run, verify.
- Next.js (App Router) — server-side code exchange with
openid-client. - React SPA (PKCE) — browser-only, public client, PKCE with
oidc-client-ts. - Node.js (Express) — confidential client with
openid-client. - Python (FastAPI + Authlib) — confidential client with Authlib.
Not on this list? The Add Login (OIDC) guide is the protocol-level walkthrough (discovery → redirect → code exchange → ES256 id_token validation) that every framework quickstart is built on. Any standards-compliant OIDC library works — SenseCrypt requires PKCE S256, uses response_type=code, and signs id_tokens with ES256.
Connect an enterprise or backend system
Integrating a SaaS product, a directory, or a service instead of adding a login button? See the protocol-focused Integrations guides:
- SAML SSO — federate an enterprise app: metadata, ACS, NameID, and attribute mapping.
- SCIM provisioning — provision users and groups from your IdP over SCIM 2.0.
- Machine-to-machine — client-credentials access to the Management API.
- CIBA backchannel — decoupled, no-browser authentication.
New to SenseCrypt?
Read How SenseCrypt works for the passwordless, on-device biometric model (SenseCrypt never sees a face image or template), then browse Concepts for the protocols, tokens, and authorization model. When you're ready to build, the framework quickstarts above are the fastest path.
What every integration shares
- Per-tenant issuer. Your tenant is
https://<your-tenant>.<domain>; resolve endpoints from{issuer}/.well-known/openid-configuration(OIDC) or{issuer}/v1/idp/saml/metadata(SAML) rather than hard-coding paths. - On-device biometrics. The face match happens on the user's phone; the sign-in ceremony is invisible to your integration code.
- The access gate. Group-based authorization decides who may sign in, and re-runs on every token refresh.