Guides
Guides
Task-focused how-tos for building on SenseCrypt — managing tenants, customizing claims, RBAC, group-based access, branding, refresh tokens, key rotation, testing, and security hardening.
Practical, task-focused how-tos. Each guide walks through one job end to end. If you're looking for the why behind a feature, see Concepts; for look-up material, see the Reference.
In this section
Managing tenants
Create and manage tenants — each its own OIDC issuer at its own hostname.
Customize claims and scopes
Control which profile claims land in your tokens, using typed attributes, scopes, and per-app bindings.
RBAC: roles and permissions
Emit a
permissions claim your own API enforces, with resource servers, permissions, and roles.Groups and access
Open and close sign-in access to an application with the default-closed group-to-app gate.
Branding
Customize the hosted login experience — logo and per-application branding.
Refresh tokens and sessions
Keep users signed in with
offline_access, handle rotation, and implement logout.Back-channel logout
Receive signed logout tokens when a session your app was signed in to ends.
Sender-constrained tokens
Bind access tokens to a key your client holds, with DPoP or mutual TLS.
Signed requests and responses
Sign the authorization request with JAR, and verify a JARM-signed response.
Account lifecycle
Understand the account and user lifecycle — creation, verification, and deletion.
Billing and subscriptions
Manage your subscription and trial, payment methods, and invoices for the hosted service.
Signing-key rotation
Rotate OIDC and SAML signing keys with a grace window, without breaking live tokens.
Audit log
Read, filter, stream, export, and verify the tamper-evident audit trail.
Testing your integration
Verify your integration end to end, including without a physical phone.
Security best practices
Harden your integration: redirect-URI hygiene, PKCE, token storage, rotation, sessions, and attestation.
Where to start
- Wiring up sign-in for the first time? Start with Get started, then Groups and access to let users in.
- Authorizing your own API? Read RBAC: roles and permissions.
- Integrating against a FAPI 2.0/CIBA tenant? Start with Security profiles, then Sender-constrained tokens and Signed requests and responses.
- Shipping to production? Work through Security best practices.
CIBA backchannel
Start a decoupled, no-browser sign-in with CIBA — call the backchannel authentication endpoint, then poll the token endpoint until the user approves on their phone.
Managing tenants
Onboard in the admin console and manage tenants — the auto-created default tenant, creating, renaming, and deleting tenants, and getting from signup to your first registered application.