FAQ

The FAQ gives short answers, each linking to the page that explains it in full. It is grouped by who is asking: people who sign in, developers who build on identity, anyone worried about security and anyone worried about their data. It is the fastest way to find out whether a page you need exists, and a good first stop when you do not know the right word to search for.

An answer here is deliberately brief, and where it says more than a sentence it points to the page with the detail. If an answer here and a full page ever disagree, the full page is the one to trust, and you should tell us.

There are four question pages, and each follows the life of its asker. People ask about signing in, devices, recovery and what applications can see. Developers ask about getting started, tokens, the DPoP key and operations. The security page follows credentials, sessions and tokens, and what is claimed. The privacy page follows what identity holds, who receives it and your rights over it.

People      -> signing in, devices, recovery, apps and dataDevelopers  -> getting started, tokens, DPoP, operationsSecurity    -> credentials, sessions and tokens, assurancePrivacy     -> what is held, who receives it, your rights

I am new and have a quick question.

1. People: whether you need a password and why there is no Create an account button.
2. Getting started: the full walk-through.

I am about to integrate.

1. Developers: which flow, whether there is a client secret, whether there is an SDK.
2. Choosing an integration: the full answer.
3. Troubleshooting: when a call is refused.

I want to know how my data is handled.

1. Privacy: what is stored, who receives it and how to get a copy.
2. Exporting your data: the steps.
3. Retention and deletion: the numbers.

People answers what a TDACorp account is, whether you need a password, why there is no Create an account button, why the page does not say whether an email has an account, why you were asked to confirm a sign-in, why a link stopped working, how to see where you are signed in, what a trusted device is, what to do about a lost authenticator app or a forgotten password, how to change your email, how to stop an application and how to close an account.

Developers answers how to add sign-in to an application, which flow identity uses (authorization code with PKCE and pushed requests), whether there is a client secret (no), where the endpoint addresses are, whether there is an SDK, what is in a token, why there is no roles claim, whether you need DPoP, why you get use_dpop_nonce, where to keep the key, why invalid_grant, why a redirect address was refused, how to handle a 429 and how to call another service.

Security answers how passwords are stored, whether passkeys are safer, whether text message codes are supported (they are not), what assurance level 2 means, whether an extra sign-in step makes an account two-factor (it does not), how a stolen session, refresh token or access token is limited, whether a recovery you did not start can be stopped, and whether identity has been independently audited. Privacy answers what identity stores, whether it sees your password or fingerprint, whether it tracks you or uses your location, which applications see your data, whether it is sold, and how to get a copy, correct it or delete it.

Nothing is needed. If your question is about a screen you are looking at, Troubleshooting may be quicker, because it is indexed by the exact words on the screen.

Do I need a password? Yes. Every account has one, and a passkey is the stronger method alongside it. See Passkeys and passwords.

Does identity support SMS codes? No, because of the risk of SIM swapping. See Security.

Is there a client secret? No. A signed assertion proves who a client is. See Client authentication.

Is my data sold? No. See Privacy.

Has identity been audited by an outside party? No, and the security page says what is not claimed. See Security.

It does not replace the full pages, so for steps use Your account or Build with identity. It does not hold the formal statements about data, which are on the Trust pages. A question that is not here may be answered in the Glossary or in Concepts.