PKPEEK Docs
Docs/Sign-in & access

Sign in to your agency workspace

Choose an agency-configured sign-in route, complete verification, and land in your approved workspace.

All agency users

/pdcc/signin
Live walkthrough · Sign in to your agency workspace
/pdcc/signin
/pdcc/signin?step=AU02
/pdcc/signin?step=AU06
/pdcc/signin?step=AU05

The sign-in page (AU01) shows only the identity routes your agency has configured. There is no public self-enrollment: a valid identity still needs an approved agency assignment before any operational menu, record or Scout retrieval is available.

Sign-in routes

RouteScreenWhen it is offered
Agency sign inAU02Default. Redirects to the agency identity provider (IdP); the app validates issuer, audience and return destination before access checks.
CAC or PIV sign inAU03When certificate authentication is configured. See CAC/PIV.
Other agency sign in / PasswordAU06Only when the agency configuration enables app-managed passwords. A federated agency password is never collected in a PEEK form.

Sign in with your agency identity

  1. 1

    Open the workspace URL

    Go to /pdcc/signin. The Agency field shows your workspace (e.g. *CBP demonstration workspace*).

  2. 2

    Choose Agency sign in

    You are handed off to the agency identity service (AU02). If it is unavailable, the page explains the outage and offers retry.

  3. 3

    Complete verification

    Finish MFA in the provider (AU05). The method shown follows agency identity policy.

  4. 4

    Land in your workspace

    After authentication the app checks membership and assignments, then opens My Day — or your saved sign-in destination.

What happens after you authenticate

  1. 1. Authenticate

    The IdP proves who you are.

  2. 2. Membership check

    Is this identity bound to an approved agency membership? If not → access pending (AU11).

  3. 3. Assignment check

    Roles, data scopes and personas load; menus derive from them.

  4. 4. Workspace opens

    Every page and API rechecks access on each request.

Note — In the demonstration, expand Demonstration identity (synthetic, non-production) and choose a synthetic identity. It stands in for the agency IdP and MFA challenge — see demonstration personas.

If sign-in fails

Sign in was not completed (AU13)
Invalid credentials. The message never reveals whether an account exists.
Sign in temporarily limited (AU14)
Locked or rate-limited attempts. Wait for the configured interval or contact your agency help desk.
Sign-in blocked or unavailable
Distinguishes provider outage, authentication failure and policy restriction without exposing sensitive diagnostics.

Related guides

Sign in with a CAC or PIV card

Certificate-based sign-in, what the browser and OS prompts mean, and how to recover from card errors.

MFA and password recovery

Multi-factor verification, MFA errors and lost devices, and the non-enumerating password reset flow (AU05–AU10, AU15).

Pending access and expired sessions

Why you can be signed in without workspace access, what you can do while assignments are pending, and how saved drafts survive an expired session.