What identity is

Without a shared service, each product would ask you to make a new account, choose another password and repeat every security step. With identity, you make one account. You prove who you are on identity's own pages, and the same account then works in every TDACorp product that uses it. Your credentials stay with identity, so a product can sign you in without ever holding your password or your passkey.

Identity draws every page a person sees: registration, sign-in, recovery, consent, and the account area. People register where sign-up is open, and the account area is where they look after the account afterwards. Its navigation has Overview, Profile, Security, Devices, Apps and access, Organizations, Notifications and Your data.

• Ways to sign in. A passkey is the recommended method. Every account also has a password (with a second step where your account has one). An email link, and an external OIDC or GitHub account (where an administrator has configured that provider) are also supported. Which methods are offered can depend on your organization, so the sign-in page is the source of truth for a given site. See Passkeys and Authentication methods.
• Ways back in. If you lose access, recovery runs through a link sent to a verified email address, and a notice lets the real owner cancel a recovery they did not start. See If you are locked out.
• Control over what is signed in. You can see your sessions and devices, and the applications and personal access tokens that hold access on your behalf, and end any of them. See Sessions and devices and Apps and access.
• Control over your data. You can read your recent activity, export your data and close your account. See Your data.
• Languages. The pages are written in English, and French and Spanish are shown only where the deployment has switched them on. See Languages.

• A standard OpenID Connect and OAuth provider. Products sign users in with standard protocols, so a product needs no custom integration. The endpoints are listed in the OIDC reference.
• Tokens that say who and for whom. An ID or access token names the person and the application it was issued to. It has no roles claim. See Sessions and tokens.
• An authorization service. A product can ask identity whether a person may perform an action, rather than reading a role from a token. See Authorization.

• It does not put roles in tokens. There is no roles claim.
• It does not give an application your password or your passkey. The application sends you to identity and receives a signed statement.
• It is not everything at once. The introduction to how it works ends with a list of what is built and what is Planned.

If you want an account, go to Create your account. To see how a sign-in runs from the browser to the token, read How identity works, end to end, then the Concepts. To use identity from your own product, go to Build with identity. What identity stores and for how long is in the privacy notice.