OpenID Connect Provider

Biometric authentication.
Standard OIDC.

Entry is an OpenID Connect identity provider that replaces passwords with a face liveness check. Use any standard OIDC library you already know.

Read the DocsBook a Demo

Try it live.

Working integrations built on EntryIdP — click a card to try it end-to-end.

Developer Sample

Not a scenario — the protocol itself. Every stage of the Authorization Code + PKCE flow laid out and inspectable, the decoded token with its biometric claims annotated, and live discovery metadata from this deployment.

Launch demo →

NorthVault Digital Bank

A mock bank that consumes EntryIdP the way a customer would: sign in with a face, land on an account dashboard, and hit a biometric step-up when a transfer crosses a threshold.

Launch demo →

Security Guard Check-in

Checkpoint-based check-in for guards on patrol. Every check-in is its own face scan, filterable by date and checkpoint, exportable as CSV.

Launch demo →

Hotel Check-in

Front-desk check-in without a passport or a form: look up a reservation, verify the guest by face, then room selection, upsells, payment and a mobile room key.

Launch demo →

Field Clock-In

Biometric time & attendance for field staff: sign on to a shift, clock in at a site zone, and build an attendance trail with biometric proof, not a shared PIN.

Launch demo →

Prescription Collection

Collect your own prescription, or authorize someone else to collect it for you — both are face scans, with a signed handover receipt.

Launch demo →

Three steps to go live.

Step 01

Register a client.

Email entryidp@synapser.com with your app name and target platforms. We'll send back a client_id — and a client_secret for server-side apps.

Step 02

Configure your OIDC library.

Point any standard OIDC library at Entry's issuer URL. No proprietary SDK required — use oidc-client-ts, next-auth, AppAuth, or whatever you already know.

Step 03

Go live.

Entry runs the liveness check in its own UI. Your app receives a verified user via standard OIDC callback. No biometric data ever touches your server.

Login vs enrolment.

A standard authorize request matches a returning face. Adding prompt=create enrolls a new user. Entry tells you clearly when a face is unregistered so you can route them accordingly.

entry-flows.ts
// Returning user — face matched against stored enrolment
await auth.signinRedirect();

// New user — first-time face enrolment
await auth.signinRedirect({
  extraQueryParams: { prompt: 'create' },
});

// Unregistered face? Entry tells you clearly.
// error=access_denied, error_description=user_not_registered
// → route into the enrolment flow

Every platform.

Entry uses the standard OIDC library for each platform. If you already use OIDC, you're most of the way there.

Web — SPA

React · Vue · Svelte

oidc-client-ts

Web — Server

Next.js · Express · ASP.NET

next-auth / openid-client

iOS

Native Swift

AppAuth-iOS

Android

Native Kotlin

AppAuth-Android

React Native

Expo or bare

expo-auth-session

Flutter

All targets

flutter_appauth

.NET MAUI

iOS · Android

Duende.IdentityModel.OidcClient

Enterprise-grade security.

Biometric data never leaves Entry. Your app receives a standard OIDC token — no raw facial data, no biometric templates on your servers. Tokens are signed with RS256 via AWS KMS; no key material is ever held on the application server.

AES-256-GCMPKCE S256RS256 via AWS KMS

PKCE is mandatory on every client — only S256 is accepted, never plain.

Redirect URIs are matched exactly. No wildcards, no prefix matching.

Use sub as the stable user key — never match users by email alone.

Tokens are stored per platform: memory for SPAs, OS Keychain/Keystore for mobile, server-side session for backends.

Ready to integrate?

Read the full developer documentation or get in touch to register a client and receive your credentials.

Read the DocsRegister a Client