> ## Documentation Index
> Fetch the complete documentation index at: https://idp-docs.facesign.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Import the metadata, register your service provider, and run a real round-trip.

Three steps. The first two are configuration in your own service provider and the FaceSign
partner portal. The third proves the round-trip works before you wire it to anything real.

<Steps>
  <Step title="Import the live IdP metadata">
    The metadata carries the entityID, the X.509 signing certificate, and both SSO bindings.

    ```
    https://idp.facesign.dev/api/saml/metadata
    ```

    <Card title="Open the raw XML" icon="external-link" href="https://idp.facesign.dev/api/saml/metadata">
      Opens in a new tab. This page stays where it is.
    </Card>

    <Warning>
      The metadata declares `WantAuthnRequestsSigned="false"`. Request signing is not supported
      in this release — send unsigned AuthnRequests.
    </Warning>
  </Step>

  <Step title="Register your service provider">
    Two values register an SP: your **entityID** and your **ACS URL** (POST binding, `https` only).

    Register them in the [partner portal](https://idp.facesign.dev/portal). Sandbox service
    providers activate immediately. Production activation is reviewed by FaceSign against a
    verified domain — it is not self-service today.

    You can also register by email: [partnerships@facesign.ai](mailto:partnerships@facesign.ai?subject=FaceSign%20SAML%20IdP%20—%20SP%20registration).
  </Step>

  <Step title="Run the round-trip">
    Before you point production traffic at anything, exercise the flow end to end against
    FaceSign's own loopback service provider. You need a device with a camera.

    See [Test the live sandbox](/test-the-live-sandbox).
  </Step>
</Steps>

## What you get back

On a pass, a signed SAML Response containing a signed Assertion with the released
`facesign.*` attributes. On any other outcome, a signed status-only failure with no assertion
at all.

Your service provider validates both signatures, `InResponseTo`, and the audience before
trusting either. [Validate responses](/validate-responses) is the checklist.