Integration pattern · Illustrative scenarios and policy values. Confirm supported signals, processing location, and application enforcement for your deployment.
Your identity provider keeps owning identity. BioTone adds a verification surface — multi-signal capture on the user's phone — that the IdP (or any app downstream of it) can require for a specific session, action, or recovery flow.
The integration is the brokered authentication pattern: a web app or kiosk starts a session, a QR or deep link opens BioTone on the user's enrolled handset, capture runs on the phone, and processing follows the selected deployment mode. Your backend validates the signed assertion and applies your configured IdP policy before granting access.
Same broker primitive, four common moments to require it.
When a user signs in to a sensitive app, the IdP routes them through a BioTone broker session before issuing the access token. Their existing passkey or hardware-key options stay in place; BioTone is one more option you can require for high-risk apps.
Employees enroll on a supported managed phone. Establish their identity through your onboarding process first, then record enrollment and configure recovery. Biometric enrollment alone does not establish a legal identity.
Promote a domain admin, change a payment account, export a customer list — your IdP or app calls the BioTone broker for a fresh, action-bound assertion before the operation is allowed.
Require a fresh check on the enrolled handset before a help-desk reset. Define a separate reviewed recovery path for lost devices, inaccessible signals, and suspected compromise.
Reference integration paths to evaluate with your identity team.
Reference demo
Evaluate the broker handoff with your Entra tenant. External MFA and production sign-in acceptance require separate validation.
Reference flow shipped
Evaluate an OIDC broker flow against your Okta configuration.
Reference flow shipped
Evaluate an OIDC broker flow against your Ping configuration.
Integration review
If your IdP speaks standard OIDC, the broker pattern lines up. Bring the discovery URL and your client registration.
BioTone is not a replacement for FIDO2, passkeys, or hardware tokens — it is a complementary signal. A common configuration:
Choose policy around your assurance requirements, current MFA methods, sensitive applications, and recovery procedures.
Bring your IdP details (tenant, redirect URI, client registration) and a target app. We will run the broker handoff live and walk through MFA enrollment and step-up flows.