> For the complete documentation index, see [llms.txt](https://help.enterprise.ledger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.enterprise.ledger.com/help-center-v2/start-here/get-started/signing-in.md). # Signing in and out How a PSD user signs in to Ledger Enterprise with a Ledger device or with single sign-on, how to sign out, and when a session ends. This page describes how you sign in to the Ledger Enterprise interface, how you sign out, and when your session ends. **Role: PSD users.** API users do not sign in to the interface. They authenticate over the API. See [**API users**](/help-center-v2/start-here/get-started/api-users.md). ## Before you start * Your Ledger device, registered for your Personal Security Device (PSD) user. Ledger Enterprise uses the Ledger Stax. * The Ledger Vault app on the device, at the version that the platform requires. See [**Device and app requirements**](/help-center-v2/start-here/get-started/your-device.md#device-and-app-requirements). * A cable to connect the device to your computer. ## Sign in with your Ledger device 1. Open the Ledger Enterprise interface. The **Login** page shows. 2. Connect your Ledger device to your computer. 3. Select **Sign in**. 4. If the browser asks you to choose a device, select your Ledger device. 5. When the interface shows **Unlock your device**, unlock the device. 6. When the interface shows **Open the Vault app**, open the Ledger Vault app on the device. 7. If the interface shows **Select workspace**, select the Workspace to sign in to. 8. When the interface shows **Continue on Ledger Stax**, confirm the sign-in on the device. The platform reads your device to find the Workspaces where you are an active user. When it finds one Workspace only, it selects that Workspace, and **Select workspace** does not show. After you confirm, the interface shows **Fetching assets...**, then **Accessing workspace...**. It then opens **Accounts**. If the Workspace that you select uses single sign-on, step 8 does not apply. Continue with the steps in [**Sign in with single sign-on**](#sign-in-with-single-sign-on). ## Sign in with single sign-on Ledger support enables single sign-on (SSO) for a Workspace. In a Workspace with SSO, you always sign in through your organization's identity provider. You use your Ledger device for two things only: * To find your Workspace, on a browser that does not remember it. * To pair the device with your SSO identity, one time. ### The first time 1. Do steps 1 to 7 of [**Sign in with your Ledger device**](#sign-in-with-your-ledger-device). 2. The dialog shows **Sign in to**, followed by the name of your Workspace. Select **Continue**. 3. Sign in on the page of your identity provider. The interface then shows **Completing sign in...**. 4. On **Pair your Ledger device**, select **Start pairing**. 5. When the interface shows **Unlock your device**, unlock the device. 6. When the interface shows **Open the Vault app**, open the Ledger Vault app on the device. 7. When the interface shows **Continue on Ledger Stax**, confirm on the device. The interface then opens **Accounts**. Pairing links your SSO identity to your PSD user. Each SSO identity pairs with one PSD user, and each PSD user with one SSO identity. No action in the interface or the API removes this link. After the pairing, you do not confirm on the device to sign in. To leave the pairing page without pairing, select **Logout**. This also signs you out of your identity provider. To sign in to another Workspace from the **Sign in to** dialog, select **Change workspace**. The **Select workspace** list then shows again. If your device belongs to one Workspace only, **Change workspace** closes the dialog. ### The next times After an SSO sign-in, the browser remembers the Workspace. The **Login** page then opens on **Sign in to**, followed by the name of the Workspace. No device step is necessary. 1. Select **Continue**. 2. Sign in on the page of your identity provider. The interface then opens **Accounts**. To sign in to another Workspace, select **Change workspace**. The browser forgets the remembered Workspace, and the **Login** page shows **Sign in** again. On another browser, or after the browser data is deleted, do steps 1 to 3 of [**The first time**](#the-first-time). The pairing step does not show again. ## Sign out 1. Select your name at the bottom of the navigation. The menu shows your name, your Workspace, [**Data protection**](/help-center-v2/reference/data-protection.md) and **Disconnect**. 2. Select **Disconnect**. **Disconnect** ends your session on the platform. In a Workspace with SSO, it also signs you out of your identity provider. The browser keeps the remembered SSO Workspace after **Disconnect**. To make the browser forget it, select **Change workspace** on the **Login** page. ## When your session ends The platform ends your session 15 minutes after the last request that your browser sent to it. Each new request from your browser starts the 15 minutes again. After the session ends, your next action in the interface opens the **Login** page. After you sign in again, the interface opens the page that you were on. A link to a page of the interface, opened while you are signed out, also opens the **Login** page. After you sign in, the interface opens **Accounts**, not the linked page. Your session also ends when a Master Administrator suspends your user, or when a Request to revoke your user is executed. You then cannot sign in to that Workspace. ## What can go wrong | What you see | Cause | What to do | | --------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | **Stax not recognized** | Your device is not an active user in any Workspace. A suspended or revoked user is not active | Contact an Administrator of your Workspace | | **Login interrupted** | The sign-in was declined or canceled on the device | Select **Retry**, then confirm the sign-in on the device | | **Device is locked** or **No device selected** | The device is locked, or no device was selected in the browser prompt | See [**Sign-in and device messages**](/help-center-v2/reference/statuses-and-errors.md#sign-in-and-device-messages) | | **Update required on your device** | The Ledger Vault app is missing, or its version is not the required version | See [**When an update is required**](/help-center-v2/start-here/get-started/your-device.md#when-an-update-is-required) | | **PSD does not match your SSO session** or **PSD already linked to another user** | The pairing between your SSO identity and your PSD user is refused | Contact your IT service. See [**Sign-in and device messages**](/help-center-v2/reference/statuses-and-errors.md#sign-in-and-device-messages) | | The **Login** page shows again after the identity provider | The identity provider did not complete the sign-in | Select **Continue** again. If the problem continues, contact your IT service | | A page that says the Workspace is under maintenance | Ledger closed the Workspace for maintenance | Select **Try again** later. See [**Workspace maintenance**](/help-center-v2/reference/statuses-and-errors.md#workspace-maintenance) | ## Related * [**Your security device**](/help-center-v2/start-here/get-started/your-device.md) * [**Orientation**](/help-center-v2/start-here/get-started.md) * [**Statuses and errors**](/help-center-v2/reference/statuses-and-errors.md) * [**API users**](/help-center-v2/start-here/get-started/api-users.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.enterprise.ledger.com/help-center-v2/start-here/get-started/signing-in.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.