Signing in and recovery

You sign in once with your TDACorp account, and every TDACorp product that uses it recognises you. This section describes each screen you can meet on the way in, and each screen of account recovery, using the exact words the screen shows so you can match one to the other. It is the page to open when a screen has appeared and you want to know what it is asking and what happens if you answer.

It is for people who sign in, not developers. A developer who wants the protocol view of the same journey should read How a sign-in ends in another application for the person's view and Log users in for the code.

A sign-in is a short sequence of steps that identity tracks on its own side, and the browser cannot skip one. Which steps you see depends on what your account has and on what the organization you sign in to requires. A sign-in in progress lasts 10 minutes. Recovery is a different, slower path for when none of your methods works.

identify -> first method -> [second step] -> [choose a password]         -> [choose organization] -> [allow access] -> signed in -> back to the applicationpasskey | password | emailed link or code | external providerrecovery: start -> email -> [wait] -> secure your account -> finish

Steps in brackets appear only where they apply. A correct password always signs you in: the second step is asked of an account that has a passkey or an authenticator app only when the sign-in looks unusual, and you can instead continue with your password only, in a limited session. An account that has no password is asked to choose one after the first method, and a person who lost their only passkey may be offered an emailed code at the second step (If you lost your passkey). A new browser or place can also add a confirmation by email, and a sensitive action can ask you to confirm it is you again.

I am signing in to a product for the first time.

1. Start with your email or username: say who you are.
2. Sign in with a passkey: the stronger method, or a password if you have not added one.
3. Allow access: decide what the application may see.
4. How a sign-in ends in another application: how you get back.

I got a new-browser email.

1. Confirm a new browser or place: confirm in the browser you were using.
2. The sign-in alert email: the message sent after a sign-in from a device the account had not seen.

I cannot sign in at all.

1. Sign-in errors and what they mean: find the message you see.
2. Start a recovery: ask for the recovery message.
3. The recovery email, then The recovery waiting period if one applies.
4. Secure your account, then Finish recovery.

The first step. Start with your email or username is the first screen, which never says whether an account exists. Sign in with a passkey, Sign in with a password, Sign in with an emailed link or code and Sign in with an external provider each describe one method, with its failures. When sign-up is closed or limited shows what the registration page says in each state.

After the first step. The second step covers Confirm it is you with an authenticator app, a recovery code or a passkey, and the emailed code that stands in for a lost passkey. Sign in with a password covers the Choose a password stop for an account that has none. Optional extra steps covers two checks you can choose that do not count as two-factor. Choose an organization appears when you belong to several. Allow access is the consent screen. Add a passkey offer is the screen that can offer a passkey after a password sign-in.

Unfamiliar sign-ins. Confirm a new browser or place explains the email confirmation. The sign-in alert email explains the Was this you page. Confirm it is you explains the fresh confirmation before a sensitive action.

Ending and errors. How a sign-in ends in another application follows the round trip, and Signing out covers both ways to sign out. Sign-in errors and what they mean groups every message by what it means.

Recovery. Start a recovery, The recovery email, The recovery waiting period, Cancel a recovery, Secure your account and Finish recovery take the path in order.

The sign-in screens and the emails have messages in English, French and Spanish. English is always on; French and Spanish are served only where a deployment has switched them on. A signed-in person sees their saved language, a sign-in an application started can ask for one, and otherwise a switcher on the screen and your browser's language decide, with English as the fallback. This book quotes the English wording. See Languages.

You need an account, so see Getting started if you have none. Use the same browser for every step of one sign-in, because an emailed link or code only works in the browser where you asked for it.

Why does the page not say whether my email has an account? So a stranger cannot find out which addresses do. See Start with your email or username.

Why was I sent to another page and back? An application sent you to TDACorp to sign in. See How a sign-in ends in another application.

Does Sign out end all my sessions? No, only this browser. See Signing out.

Why is my recovery on hold? An account with a second factor waits so the real owner can cancel a recovery they did not start. See The recovery waiting period.

Why does a link not work? It works once, in the browser that asked, until it expires. See Link or code expired.

It does not cover choosing which method to use, which is advice in Security for users, or managing methods after you are in, which is in Your account. It does not describe how an unfamiliar sign-in is judged, which this book leaves out on purpose. Developers should use Build with identity and the Reference for the protocol view.