01
The decision in brief
Write down whether the incident you are trying to prevent happens at account opening or at sign-in. The answer usually names the vendor.
Choose authID when
the hard problem is establishing who a person is at onboarding, against a document, as well as recognizing them later.
Choose SenseCrypt IdP when
the hard problem is sign-in, and you want the identity provider and the face check in one standards-based product.
Side by side
| Dimension | SenseCrypt IdP | authID |
|---|---|---|
| What you buy | An identity provider built around a live face check | Biometric identity verification and authentication products |
| Identity proofing | Not in scope | Part of the published portfolio |
| Federation | OIDC, SAML 2.0, SCIM 2.0, CIBA | OpenID Connect, per authID documentation |
| List price | $1 per user per month; 20-seat minimum | Varies by plan |
What you buy
- SenseCrypt IdP
- An identity provider built around a live face check
Identity proofing
- SenseCrypt IdP
- Not in scope
- authID
- Part of the published portfolio
Federation
- SenseCrypt IdP
- OIDC, SAML 2.0, SCIM 2.0, CIBA
- authID
- OpenID Connect, per authID documentation
List price
- SenseCrypt IdP
- $1 per user per month; 20-seat minimum
- authID
- Varies by plan
02
Proofing and sign-in are different jobs
Both companies put a face in front of an authentication event, so that checkbox distinguishes nothing. authID reaches further up the lifecycle, covering the moment a new person has to be proved against a document as well as the moment a returning person has to be recognized. SenseCrypt IdP does only the second job.
The other difference is what surrounds the face. With SenseCrypt IdP, applications receive tokens from the same service that ran the face check, over protocols they already speak. Compare each vendor's deployment history and customer references alongside its proofing and authentication scope; packaging varies, so make a quote name the modules it includes.
SenseCrypt IdP cannot prove a new person
It can enroll a user, but it does not verify anyone against a document. It links a face to an account whose legitimacy you have already established.
Standard identity protocols are included
The service that runs the face check also serves OIDC and OAuth 2.0, SAML 2.0, SCIM 2.0 and CIBA, so there is no seam between a biometric service and an identity provider.
Tokens carry roles. Your application enforces them.
The token carries roles and permissions; deciding what they permit is the receiving application's job. Sign-in itself passes a default-closed group gate.
03
Four questions for your vendor assessment
A feature comparison, this one included, tells a buyer less than four direct questions asked of both companies. Insist on specifics in the replies. Our short answers follow; the full inventory is in the panel below.
Where does face verification run?
On a phone, or on a vendor's servers? For both of our phone methods, the comparison runs on the enrolled phone.
What remains after enrollment?
A sealed face token and its verifier challenge, plus ordinary identity-provider records. Include each retained artifact in your security and privacy review.
What can an attacker reuse from a captured sign-in?
Phone sign-in requires a key bound to the enrolled device. On the passkey method, origin binding means an assertion harvested through a lookalike domain does not validate against the real one.
How does account recovery work?
There is no end-user password to reset. A replacement phone is paired through a verified contact and a new device key, and the face check is still required.
04
SenseCrypt IdP at a glance
05
Frequently asked questions
How does SenseCrypt IdP differ from authID?
Both use face biometrics. authID covers identity verification as well as authentication. SenseCrypt IdP is an identity provider: one face-based sign-in, with OIDC, OAuth 2.0, SAML 2.0, SCIM 2.0 and CIBA served by the same product that runs the face check.
Is SenseCrypt IdP phishing-resistant?
On the passkey method, yes: FIDO2/WebAuthn origin binding ties the credential to your real site, so a lookalike page cannot use what it captures. The QR method removes password entry but is not origin-bound, so require the passkey method where origin-bound phishing resistance is needed.
Can SenseCrypt IdP onboard a brand new customer?
It can enroll one, but it cannot prove one. Enrollment links a face to an account you have already accepted as legitimate. Document checks and data-source verification are a different category of product, and we would rather say so than let a diagram imply otherwise.