Sign in with an external provider
How the Google and GitHub buttons work, what happens when you return from the provider, and what the messages on return mean.
On this page
An external provider lets you sign in with an account you already have somewhere else, such as Google or GitHub, instead of a password. Which providers the sign-in page shows depends on what your organization allows, so you may see both, one, or none. Each button carries the provider's name, for example Google or GitHub, with its icon.
How it works#
- On the sign-in page, select the provider's button, for example Google.
- You leave TDACorp and land on the provider's own site, which asks you to sign in or confirm there. TDACorp does not see your password for that provider.
- The provider sends you back to TDACorp. You land on the sign-in page, and the sign-in carries on from there.
Because you proved who you are with the provider, this way of signing in does not ask for your TDACorp password. Your account's own second step can still follow. See The second step. If the account has no password yet, which can be true of an account made with a provider, the sign-in then stops on Choose a password before it goes on. If you have chosen the optional extra step for linked accounts, the page then asks for your password; see Optional extra steps.
Creating an account with a provider#
The Create your account page shows the same provider buttons under a line reading or, when the sign-in offers them. Selecting one starts the same round trip. If no TDACorp account is linked to that provider account yet, and the provider vouches for a verified email address that no TDACorp account has, a new account is created for that address, provided registration is open (see When sign-up is closed or limited). The account takes the provider's name and picture where it shares them. A provider sign-in cannot create an account from an address the provider has not verified, and it never links to an existing account on its own: if the verified address already belongs to a TDACorp account you get Sign in with your existing method first, then link that provider from your account.
A new account made this way has no password yet, so the sign-in then stops on Choose a password before it carries on.
Linking a provider to your account#
A provider is linked to a TDACorp account from the account's own security area, under Linked accounts. There you select the provider, leave the page to sign in with it, and come back to the Security overview. The same page shows what is already linked. See Security and passkeys.
Messages when you come back#
When a provider sign-in does not finish, you return to the sign-in page with a notice above the form.
| Notice | What to do |
|---|---|
| You cancelled the sign-in with that provider. | Nothing is wrong. Select the button again, or use another method. |
| The provider could not complete the sign-in. Try again. | Try again in a moment. |
| That sign-in attempt expired. Start again. | The attempt stayed open too long. Select the provider button again. |
| The provider did not share a verified email address. Verify your email with the provider (for GitHub, set a public or primary verified email) and try again. | The provider does not vouch for an address on its account, so it cannot be used to sign in or to create an account. Verify the address with the provider (on GitHub, make a verified address public or primary), or use another method. |
| That email domain cannot sign in here. | The organization does not allow this domain with this provider. Use another method. |
| That account cannot sign in right now. | The account is not able to sign in at the moment. |
| Creating an account with that sign-in needs a verified email address from the provider, and registration must be open. | This provider sign-in cannot start a new account, either because the provider shared no verified address or because registration is closed or limited. See When sign-up is closed or limited. |
| Sign in with your existing method first, then link that provider from your account. | Sign in another way, then link the provider under Linked accounts. |
| That sign-in method is not strong enough for this application. | The application asks for more than this provider sign-in gives. Use a method it accepts, such as a passkey. |
| Too many attempts. Wait a little and try again. | Wait, then try again. |
If the provider cannot be reached, a message reads We could not reach that provider. Try again in a moment.