Skip to main content
Three steps. The first two are configuration in your own service provider and the FaceSign partner portal. The third proves the round-trip works before you wire it to anything real.
1

Import the live IdP metadata

The metadata carries the entityID, the X.509 signing certificate, and both SSO bindings.

Open the raw XML

Opens in a new tab. This page stays where it is.
The metadata declares WantAuthnRequestsSigned="false". Request signing is not supported in this release — send unsigned AuthnRequests.
2

Register your service provider

Two values register an SP: your entityID and your ACS URL (POST binding, https only).Register them in the partner portal. Sandbox service providers activate immediately. Production activation is reviewed by FaceSign against a verified domain — it is not self-service today.You can also register by email: partnerships@facesign.ai.
3

Run the round-trip

Before you point production traffic at anything, exercise the flow end to end against FaceSign’s own loopback service provider. You need a device with a camera.See Test the live sandbox.

​
What you get back

On a pass, a signed SAML Response containing a signed Assertion with the released facesign.* attributes. On any other outcome, a signed status-only failure with no assertion at all. Your service provider validates both signatures, InResponseTo, and the audience before trusting either. Validate responses is the checklist.