TDACorp Identity documentation

TDACorp Identity is the one place where a TDACorp account is created, proven and managed, and where TDACorp products learn who is signed in. This book explains it twice over: once for the people who own an account and sign in, and once for the developers whose application sends people to identity or accepts its tokens. Each page says what is built and marks anything that is not as In development or Planned.

Two groups of readers should start in different places. If you have an account, or are about to make one, the quickest route is Getting started, then Your account. If you build a product, begin with How identity works, end to end and Build with identity. Anyone who meets an unfamiliar word can look it up in the Glossary.

A person, an application and identity take part in every sign-in. The person never gives a password to the application. The application sends the person to identity, identity checks who they are, and identity sends the application a signed statement.

Person  ->  Application  ->  Identity sign-in pages                                   |  passkey, password, link, second step                                   vApplication  <-  signed tokens  <-  Identity     |     +-> its own API  ->  asks identity: may this person do this?

The book follows that picture. The sign-in pages and the account area are for people, so they are described screen by screen in Signing in and recovery, Your account and Security for users. The tokens, endpoints and checks are for developers, so they live in Build with identity and the Reference. The ideas that both groups share, such as sessions, passkeys, assurance and consent, are in Concepts.

I just heard about this and want an account.

1. Create your account: verify your email address and choose a password.
2. Add a passkey: a passkey is the stronger way in, and you can add one while you choose the password.
3. Your first sign-in and the setup checklist: the checklist shows what is still worth doing.
4. Your account: the rest of the account area.

I lost my phone.

1. If you are locked out: which other methods can stand in.
2. Protecting a lost device: the order in which to cut the device off.
3. Start a recovery: the last resort when no method works.

I am integrating an application.

1. How identity works, end to end: the shape of one sign-in.
2. Choosing an integration: which kind of client fits.
3. Quickstart: register a client and sign in once.
4. Going live: what to confirm before real people sign in.

Introduction explains what identity is, walks through one sign-in from the browser to the token and defines every term. Getting started takes a new account owner from registration to a first sign-in and says what to do if they are locked out. Concepts explains the ideas behind the screens and the tokens, in plain terms, one idea per page.

Your account describes every page of the account area, task by task: profile, security, devices, connected applications, organizations, notifications and your data. Signing in and recovery describes every screen a person can meet on the way in or while recovering, with its exact words. Security for users is advice: how to choose a second step, how to recognise a fake email, what to do after a loss or a suspected takeover.

Build with identity covers registering a client, the sign-in flow, tokens, the endpoints, the SDK and going live. Reference is the lookup material: error codes, claims, lifetimes and status codes. Troubleshooting starts from a symptom, such as a message on a screen or an OAuth error, and leads to its cause. The FAQ gives short answers by audience, each linking to the page with the detail.

Nothing here needs prior knowledge of OAuth or OpenID Connect. People who sign in need only a browser and an email address they can read. Developers should know how an HTTP redirect works and be able to run a small web server. The SDK is written in TypeScript, but every flow is also described in plain HTTP, so another language works too.

Do I need a password? Yes. Every account has one, and a correct password always signs you in. A passkey is the stronger method alongside it. See Passkeys and passwords.

Can I create an account myself? That depends on the deployment you are using, and the page can be closed or limited. When sign-up is closed or limited shows what you would see.

What can an application see about me? Only what you allow on the consent screen. See Connected apps.

Does a token say what a person may do? No. A token says who the person is and which application it is for. A product asks identity whether an action is allowed. See Authorization.

Where do I report a security flaw? Follow Reporting a vulnerability.

It does not describe the administrator console, the private sign-in API behind the pages, exact limits or the signals used to judge a sign-in. What we do not publish and why gives the reasons. What identity stores about you, for how long and who receives it is in the Trust documents, which are separate from this book.