Introduction

This section is the shortest route to understanding what TDACorp Identity does and why a TDACorp product has no login page of its own. It names the parts that take a step in a sign-in, gives each a plain role, and defines the vocabulary the rest of the book uses.

It is for everyone, and it assumes nothing. A person who only wants to use their account can stop after the first page. A developer who is about to integrate should read all three pages before opening the build section, because the integration guides assume the picture drawn here.

Identity answers three questions for every product: who is this person, are they still signed in, and what may they do here. A product does not keep passwords. It sends the person to identity, identity proves who they are, and identity hands back a signed statement. The same account then works in every product.

1  Application  ->  identity     pushes the sign-in details directly2  Browser      ->  identity     carries only a short reference3  Person       ->  identity     proves who they are, may consent4  Identity     ->  application  returns a one-time code5  Application  ->  identity     trades the code for tokens6  Application  ->  its own API  presents the access token

Two rules hold at every step. The details of the request never travel through the browser, and the application never holds the person's credentials. Access is decided separately from identity: a token does not carry a role, and a product asks identity whether a person may perform an action.

I want to know what this is before I sign up.

1. What identity is: the product in plain words.
2. Create your account: what registration asks for.
3. Your account: what you can manage afterwards.

I am about to integrate an application.

1. How identity works, end to end: the seven steps of one sign-in.
2. Concepts: the ideas the guides rely on.
3. Choosing an integration: which kind of client fits.

I met a word I do not know.

1. Glossary: each term defined once, with its standard where there is one.
2. Concepts: the longer explanation of the larger ideas.

What identity is is a short page. It says that identity is one service every TDACorp product uses and why there is one account, lists what a person gets (the ways to sign in, the ways back in, control over sessions and data, languages) and what a product gets (a standard OpenID Connect and OAuth provider, and an authorization service), and says what it is not: it puts no roles in tokens and gives an application no password.

How identity works, end to end is the long page. It lists who is involved (a person, an application, a service, an administrator), explains how the web application and the identity API run as one origin, and follows one sign-in through seven numbered steps, including the pushed request, the one-time code that lives 60 seconds and the key binding of tokens. It then covers how people prove who they are, how access is decided, and which features are Planned.

Glossary defines the book's terms in one place, so other pages can use a word without stopping to explain it.

Read the pages in the order shown. No setup is needed, and no account. If you want to follow along on a real screen, Create your account is the next step for a person, and Quickstart is the next step for a developer.

Does my product need its own login page? No. The person signs in on identity's pages and your product receives a signed statement. See How identity works.

Why does a sign-in start with a request from the server? Because the browser must not carry the request details. The application pushes them directly and the browser carries only a reference that works once and expires after 60 seconds. See Pushed authorization requests.

Is there a roles claim? No. A product asks identity whether a person may perform an action. See Authorization.

Which sign-in method is recommended? A passkey. See Passkeys.

Is the SDK published? Yes. It is the package @tdacorp/identity-sdk on the public npm registry. See Choosing an integration.

It does not give step-by-step account tasks, which are in Your account, or protocol details and request shapes, which are in Build with identity and the Reference. It also does not say how long identity keeps your data or who receives it. That is in the Trust documents.