# Signing in

> How you get an account, what your role lets you do, and what to do when you cannot get in.

Source: /toft-docs/latest/user/start/signing-in/

Sign in with the button on the Toft sign-in page. Your administrator chooses
the provider — usually your organization's single sign-on (OIDC) or GitHub.
There is no self-service sign-up.

The username-and-password form, if shown, is for the built-in administrator
account only.

## Your role

Every account has one system role. It decides whether you can create apps.

| Role | Can |
|---|---|
| **Viewer** | Open apps shared with them. |
| **Publisher** | Everything a viewer can, plus create, deploy and own apps. |
| **Administrator** | Run the install. |

No **New app** button means you are a viewer.
[Ask to become a publisher](/toft-docs/latest/user/account/becoming-a-publisher.md).

## Waiting for activation

Some installs create your account on first sign-in and hold it until an
administrator activates it. Until then, every sign-in shows a message your
administrator wrote. Retrying will not help — wait, or ask them.

## Sessions

A session ends after a period of inactivity, or after a maximum lifetime,
whichever comes first. Your administrator sets both. Sign in again to continue.

## When you cannot get in

There is no password reset: you sign in with your organization's account. A
disabled account, a provider that was switched off, or a pending activation is
for your administrator to fix.

Once you are in, **Your account → Security** shows your sign-in history — useful for
checking whether an attempt reached Toft at all.