How a sign-in ends in another application

What happens from the moment an application sends you to TDACorp to sign in until you are back in that application.

On this page

Most sign-ins do not start on the TDACorp sign-in page. They start in another application, such as a TDACorp product, that sends you to TDACorp to sign in. When the sign-in finishes you are sent back to that application. This page follows that round trip from the person's point of view. For the developer's view, see Log users in.

The round trip#

You choose to sign in inside the application. It sends your browser to TDACorp.
You see the sign-in page and go through the steps your account needs: identify yourself, the first method (or, where your organization requires single sign-on, its own sign-in), and where it applies the second step.
If your account has no password, you are asked to choose one first. Where they apply, you may also see Choose an organization (or Create your workspace, if the application needs an organization and you have none) and Allow access.
A last screen titled Signing you in says Taking you back to the application. It then sends you on by itself. If it does not, its button, Continue, does the same.
You are back in the application, signed in.

You stay on one address throughout, and each step replaces the one before it on the page, so there is nothing to bookmark halfway.

What the application receives#

The application does not receive your password or any other secret you typed. It receives a one time authorization code, valid for a very short time, which it exchanges for tokens that say who you are and what you allowed. See Sessions and tokens. When the sign-in is for an application, the address you are sent back to is one the application registered in advance, never one taken from the link.

If you are already signed in#

If you already have a session on this browser, the application can often send you back without showing any sign-in screen. You are asked again when the application requires a more recent sign-in, or a stronger method than the one you used, or when it asks to show the sign-in anyway. The same happens when the session began through one organization's single sign-on connection and the application asks for a different organization, or when the organization requires single sign-on and the session did not come through it. When what it needs is a second factor (a stronger method, or a recent one with it) and you have one enrolled, the page opens on Confirm it is you and asks only for that factor, not for your email or password. When the only thing missing is your consent, the page opens on Allow access in the same way.

When you did not come from an application#

If you open the sign-in page directly, there is no application to go back to. When the sign-in finishes you land in your own account.

If it does not finish#

What you see	What it means
This sign-in has ended, with a reason, and Start a new sign-in	The sign-in took too long, was cancelled, or was finished already. Start again from the application you came from, or use the button.
Sign-in was refused, This sign-in cannot continue. (or a more exact reason, listed in Sign-in errors)	The sign-in was not allowed to go on. Recover your account starts account recovery.
You are sent back with a message that access was denied	You selected Deny on Allow access, or the application asked for an organization that you are not a member of or that it may not enter. The application decides what to show.
A message that the organization requires single sign-on	You signed in another way, and the organization you chose accepts only its own identity provider. Return to the application and sign in through your organization.

When TDACorp cannot send you back#

Sometimes the request from the application is not one TDACorp can answer by sending you back, for example because the application is not recognised. Instead of leaving you on a blank page, TDACorp shows a page of its own with a title and a plain sentence. The page also shows a Request ID with the line Quote this if you contact the owner of the application or TDACorp. Its button, Go to your account, takes you to your account. The titles you may see are:

The error page: the heading This application is not recognised, one sentence on what to do, a request id to quote, and a Go to your account button. — An error page, as an application that was not recognised produces it. Sample data./error

Title	Sentence
The request was not valid	Start again from the application you came from.
This application is not recognised	The application that sent you here is not registered, so sign-in was not started. Go back to it and try again, and tell its owner if this keeps happening.
Sign in to continue	You need to be signed in to see that.
You do not have access	This account is not allowed to open that.
Page not found	The page you asked for does not exist or has moved.
Too many attempts	Wait a little and try again.
That took too long or Temporarily unavailable	Try again in a moment, or in a few minutes.
Something went wrong on our side	Try again in a moment.
Sign-in could not continue	Something stopped this request. Go back to the application you came from and try again.

A sign-in that reaches the end without a password on an account that needs one is not finished: TDACorp answers with a plain line, this account needs a password before it can sign in; please return to the app you came from and sign in again, and no session is opened. Starting again from the application shows the Choose a password step.

None of these pages shows words taken from the link you followed, so a crafted link cannot put its own words on them.