OIDC Single Sign-On
Use Hawcx as the OpenID Connect provider for your own applications, with one passwordless login shared across every app in a project.
Hawcx is an OpenID Connect (OIDC) provider. Your applications integrate as standard OIDC relying parties (RPs): you redirect the user to Hawcx to sign in, then exchange the returned authorization code for an ID token. Authentication itself is passwordless and device-bound; your app never handles a password, OTP, or the cryptographic proof.
This is the right model when you own the applications and want Hawcx to be their login. If you instead want to make an existing SaaS directory (Microsoft Entra, Google Workspace, Okta) passwordless, federate it with SAML instead.
Identity domains and silent SSO
Every Hawcx project is an identity domain. You can register multiple OIDC clients under one project (one per application) and they share a single sign-on session. When a user signs in to the first app, a second app in the same project authorizes silently: no login screen, no second challenge.
Hawcx maintains the SSO session server-side. Its lifetime is set per project by a session policy (idle timeout, default 30 minutes sliding; absolute lifetime, default 8 hours). See Single Logout.
How sign-in works
Hawcx runs the sign-in UI itself (a hosted, same-origin experience), so your app is only ever responsible for the two standard RP steps: the authorization redirect and the token exchange.
Supported OIDC features
| Capability | Support |
|---|---|
| Flow | Authorization Code + PKCE (S256, required) |
response_type | code |
grant_type | authorization_code |
| Client authentication | none (public client + PKCE) · private_key_jwt (Ed25519 / EdDSA) |
| ID token signing | ES512 (ECDSA) — see id_token_signing_alg_values_supported in discovery |
| Discovery | GET /.well-known/openid-configuration |
| JWKS | GET /.well-known/jwks.json |
| Single Logout | RP-Initiated Logout · OIDC Back-Channel Logout |
These are two different keys and algorithms: ID tokens are signed by Hawcx with ES512
(ECDSA), while private_key_jwt is how a backend client authenticates itself at the token
endpoint using its own EdDSA (Ed25519) key. The EdDSA key is never used to sign ID tokens and
never appears in Hawcx's JWKS.
Discovery
Examples use the production host api.hawcx.com. The issuer is fixed per environment, not per
project: every project in an environment shares the same issuer and discovery document (production
and sandbox use different hosts). Your sandbox issuer host is shown in the Admin Console (see
Environments). Fetch the discovery document to resolve every
endpoint:
curl https://api.hawcx.com/.well-known/openid-configurationSee the Reference for the full endpoint and claim tables, and ID Token Verification for verifying issued tokens with your language's JWT library.