Single Sign-On
Use Hawcx as the identity provider for your applications, via OpenID Connect for apps you own or SAML to federate an existing directory.
Hawcx is an identity provider for single sign-on. One passwordless, device-bound login can serve every application in your organization. There are two integration models depending on what you're connecting:
- OpenID Connect (OIDC): make Hawcx the login for applications you own. Register each app as an OIDC client and users sign in once across all of them. Configure it yourself in the Admin Console.
- SAML 2.0: make Hawcx the identity provider for an existing directory (Microsoft Entra, Google Workspace, Okta). Every SaaS app already federated through that directory becomes passwordless, with no per-app work.
Which model should I use?
| Use OIDC when | Use SAML when |
|---|---|
| You control the application's source or its login integration. | You want to federate a directory / IdP you already run. |
| You're building new apps or web/mobile products. | You want existing SaaS apps (Slack, Salesforce, Jira) to inherit Hawcx passwordless automatically. |
| You want silent SSO across a set of first-party apps. | Your identity estate is centralized in Entra / Workspace / Okta. |
Availability
OIDC clients are self-service in the Admin Console. SAML federation is provisioned by Hawcx; contact [email protected] to enable it for your organization.
OIDC single sign-on
Register multiple OIDC clients under one project to form an identity domain: a user who signs in to one app authorizes silently into the others, and a single logout propagates to all of them via OIDC Back-Channel Logout.
Integrate an application
Authorization Code + PKCE, token exchange, ID token verification.
Single Logout
RP-Initiated and Back-Channel Logout across the identity domain.
OIDC reference
Endpoints, parameters, and claims.
SAML federation
Hawcx acts as a SAML 2.0 identity provider. Your service provider redirects login requests to Hawcx, which authenticates the user and returns a signed assertion to establish the session.
See the SAML federation reference and the Microsoft Entra setup guide.
Supported protocols
| Protocol | Status | Single Logout |
|---|---|---|
| OpenID Connect | Available | RP-Initiated · Back-Channel |
| SAML 2.0 | Available | Not supported |
User provisioning (SCIM)
Hawcx supports SCIM 2.0 for automated user lifecycle management: new users are provisioned on assignment, profile updates propagate, and deactivated users lose access without manual intervention. See SCIM Provisioning.