01
The decision in brief
Decide which job is urgent. Establishing who a new person is at onboarding is identity proofing, which 1Kosmos covers and SenseCrypt IdP does not. Recognizing a returning person at sign-in, without a password, is the job SenseCrypt IdP was built for.
Choose 1Kosmos when
you need identity proofing and passwordless authentication from one supplier, across the whole identity lifecycle.
Choose SenseCrypt IdP when
accounts are already established and the problem is sign-in: passwords, resets and relayed codes, with the identity provider in the same product.
Side by side
| Dimension | SenseCrypt IdP | 1Kosmos |
|---|---|---|
| What you buy | An identity provider built around a live face check | A platform spanning identity verification and passwordless authentication |
| Identity proofing | Not in scope | Part of the published platform |
| What the server keeps | No face images or templates in the documented phone flow; a quantum-safe, sealed face token | Encrypted identity data on a private distributed ledger |
| Federation | OIDC, SAML 2.0, SCIM 2.0, CIBA | SAML 2.0 identity provider and OIDC, per 1Kosmos documentation |
| List price | $1 per user per month; 20-seat minimum | Varies by plan |
What you buy
- SenseCrypt IdP
- An identity provider built around a live face check
- 1Kosmos
- A platform spanning identity verification and passwordless authentication
Identity proofing
- SenseCrypt IdP
- Not in scope
- 1Kosmos
- Part of the published platform
What the server keeps
- SenseCrypt IdP
- No face images or templates in the documented phone flow; a quantum-safe, sealed face token
Federation
- SenseCrypt IdP
- OIDC, SAML 2.0, SCIM 2.0, CIBA
- 1Kosmos
- SAML 2.0 identity provider and OIDC, per 1Kosmos documentation
List price
- SenseCrypt IdP
- $1 per user per month; 20-seat minimum
- 1Kosmos
- Varies by plan
02
Compare product scope and architecture
Both vendors sign a person in with a biometric, so that fact settles nothing. 1Kosmos runs the length of the identity lifecycle, from establishing who a new person is to recognizing them on later visits, and describes encrypted identity data held in a private, permissioned distributed-ledger architecture. SenseCrypt IdP starts at sign-in and stops there.
That is a scope statement rather than a criticism. A program that has to establish identity from scratch on day one is buying two jobs, and a vendor that covers both can quote for both. Compare the retained artifacts and key custody of the specific products you are evaluating, not the category labels.
Identity proofing is outside our scope
SenseCrypt IdP does not perform document-based identity proofing. Enrollment links a face to an account you already consider legitimate, so whatever established that legitimacy stays your responsibility.
The identity provider is included
Applications integrate over OIDC, OAuth 2.0 or SAML 2.0 with the same service that runs the face check, so there is no separate biometric service to keep in step.
Federation avoids a migration
Registering SenseCrypt IdP as an external identity provider leaves your current provider in place, along with its directory, its policy and every application already integrated with it.
03
Four questions for both vendors
This page cannot settle the decision, and neither can 1Kosmos's. What settles it is putting the same short list of questions to both companies, refusing category words in reply, and reading the two sets of answers in the same sitting. Our short answers follow; the full inventory is in the panel below.
Where does face verification run?
For both phone methods, on the enrolled phone. The licensed enterprise webcam method is the exception: captures are processed inside the customer's deployment, on secure terminals.
What remains after enrollment?
Ask for an itemized inventory, not an adjective. Ours: quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges, plus ordinary identity-provider records. No face images or templates are retained in the documented phone flow.
What can an attacker reuse from a captured sign-in?
Phone sign-in requires a key bound to the enrolled device, and the face token is sealed and tenant-bound. On the passkey method, origin binding means a relayed assertion does not validate against the real domain.
What protects account recovery?
There is no end-user password to reset. A replacement phone is paired through a verified contact and a new device key, and the live face check is still required at sign-in.
04
SenseCrypt IdP at a glance
05
Frequently asked questions
Does SenseCrypt IdP do identity verification as well as authentication?
No. SenseCrypt IdP authenticates returning users and does not perform document-based identity proofing. Enrollment links a face to an account you have already decided is legitimate. If proofing a new person is part of the requirement, price it as a separate capability.
How does SenseCrypt IdP sign a user in?
The user scans an on-screen QR code and completes the face check in the SenseCrypt Authenticator app on their enrolled phone, or uses that app as a FIDO2/WebAuthn passkey. Liveness and matching run on the phone in both cases. Enterprise customers can license a webcam method that runs on secure terminals; it has no phone possession factor.
What does SenseCrypt IdP cost?
$1 per user per month. Workforce seats bill at the period's high-water mark and customer identity deployments bill monthly active users, with a 20-seat minimum. KMS-custody signing keys are $20 per month, and tenants or custom domains beyond the first three are $10 per month each. The thirty-day trial needs no card.