Integrations
Task-oriented guides for connecting your application to SenseCrypt — OIDC login, SAML SSO, SCIM provisioning, machine-to-machine, and CIBA.
These guides walk through connecting your application to a SenseCrypt tenant, protocol by protocol. Each one is task-focused: what to register, what to send, and what you get back.
Guides
- Add Login (OIDC) — add biometric sign-in to a web app with the Authorization Code flow and PKCE. (In Get Started.)
- SAML SSO — federate an enterprise app: metadata, ACS, NameID, and attribute mapping.
- SCIM provisioning — provision users and groups from your IdP: base URL, bearer token, filtering.
- Machine-to-machine — client-credentials access for the Management API: the M2M app, scopes, and the token endpoint.
- CIBA backchannel — decoupled, no-browser authentication: start a request and poll for tokens.
Just want a login button?
If your goal is Sign in with SenseCrypt in a web app rather than an enterprise integration, start with a framework quickstart in Get Started: Next.js, React SPA, Node/Express, or Python/FastAPI.
Before you start
- You need a SenseCrypt tenant. Each tenant is its own issuer at
https://<your-tenant>.<domain>— see Multi-tenancy. - Register your application in the admin console (an OIDC client, a SAML SP, or an M2M app, depending on the guide).
- Prefer resolving endpoints from discovery over hard-coding paths. For OIDC that is
{issuer}/.well-known/openid-configuration; for SAML it is{issuer}/v1/idp/saml/metadata.
New to the model? Read Concepts first.
Authorization
How SenseCrypt decides who may sign in (the default-closed group-to-app access gate) and what end users may do downstream (resource servers, permissions, and roles that shape the permissions claim).
SAML SSO
Configure a SAML service provider against a SenseCrypt tenant — exchange metadata, register your ACS, choose a NameID format, map attributes, and test the flow.