Skip to main content

​
Endpoints

​
Register

Two values, both from your side:
​
string
required
Your service provider’s unique identifier, exactly as your SP sends it in the AuthnRequest <Issuer>. Case-sensitive, matched as an exact string.
​
string
required
Your Assertion Consumer Service URL — where FaceSign POSTs the signed response. HTTP-POST binding, https only.
Register in the partner portal, or by email to partnerships@facesign.ai.
Sandbox service providers activate immediately. Production activation is reviewed by FaceSign against a verified domain — it is not self-service. Plan for a review step.

​
Request signing

The metadata declares WantAuthnRequestsSigned="false". Signed AuthnRequests are not supported in this release — the IdP rejects them. Send unsigned requests for now. If your service provider signs by default and cannot be configured otherwise, raise it before you begin integration; it changes the scope of the work on our side.

​
What the person actually experiences

Worth being explicit, because the test harness can mislead you here. In production a person never sees a SAML form, a NameID field, or any XML. They:
  1. Attempt some protected action in your application.
  2. Get redirected to FaceSign by your service provider.
  3. Have a short conversation with an avatar, with their camera on.
  4. Get returned to your application automatically.
Everything else — the loopback launcher, the NameID field in a test form, the ACS debug view — is developer tooling. Do not model your production experience on it.

SAML request contract

What FaceSign accepts and what it returns.

Validate responses

Everything your SP must check before trusting a response.