Help

Short answers to the questions that come up most.

Getting access

There is no sign-up. Your organization's administrator invites you by email, and that invitation is your account. If you were expecting one and it has not arrived, ask your administrator to send it again — they can also see whether it was already used (see A colleague can't sign in).

Your account

Your account page is where you look after your own account. From there you can:

• Give yourself a name, shown to your administrators and in invitations you send.
• Change your email address. A code goes to the new address, and nothing changes until you enter it. Your old address is told.
• See where you're signed in and sign any browser or desktop app out, or sign out of everything else at once.
• Leave an organization, or switch between the ones you belong to.
• Choose your email notices: new sign-ins from an unfamiliar network, and activity in organizations you run.
• Download your data, or delete your account.

In the app, open the account menu and choose Manage your account….

Signing in

The invitation email carries two ways in: a link that signs you in with one click, and a six-digit code you can type in instead — useful on a different device, or if the link has expired. Neither one requires a password, and neither is reused: once you have signed in with one, that invitation is spent.

If your organization has set up company sign-in, typing your work address on the sign-in page offers Continue with company sign-in. That takes you to your organization's own sign-in page (Okta, for example) and straight back into Pages. Unless your organization requires company sign-in (see below), a code by email still works too.

Setting up company sign-in (single sign-on)

An owner can let people sign in through the organization's identity provider: Okta, Microsoft Entra ID, Google Workspace, or any provider that speaks OpenID Connect. People are offered it only at your organization's verified email domains; ask your Pages contact to verify yours first.

1. On the Organization page, find Single sign-on. It shows a sign-in redirect URI and an initiate login URI, each with a Copy button.
2. In your provider, create an OpenID Connect web application. In Okta: Applications → Create App Integration → OIDC – OpenID Connect → Web Application.
3. Set its sign-in redirect URI to the first address. In Okta, also set Initiate login URI to the second, and choose "Redirect to app to initiate login (OIDC Compliant)", so the Pages tile in your Okta dashboard works.
4. Give it the openid, email and profile scopes, and assign the people or groups who use Pages.
5. Back on the Organization page, paste the issuer URL (in Okta, your org's address, such as https://your-company.okta.com), the client ID and the client secret, then press Save. Pages checks it can read your provider's settings before keeping them.
6. Press Test sign-in and sign in as yourself. Pages says whether it worked, and why not if it didn't.

Admins can see these settings and run the test; only an owner can change or remove them, because whoever controls them decides who your provider can sign in as. The client secret is stored encrypted and is never shown again. Someone your provider signs in still needs a seat: they join as a member while seats last, or with the role of an invitation you've already sent them.

Requiring company sign-in

Once a test sign-in has worked, an owner or an admin can turn on Require company sign-in on the Organization page. After that, people at your verified email domains sign in to your organization through your provider and not with an email code.

• People signed in with a code are signed out and sign in again through your provider. If someone asks for a code, they are sent an email with a link to company sign-in instead.
• Owners can still use an email code. That way a problem with your provider can't lock you out of your own settings. Admins are asked to use company sign-in like everyone else.
• Ask for a fresh sign-in every so often by entering a number of days (1 to 365) in the box under the switch. Leave it empty to ask only when a sign-in expires on its own.
• People who must use company sign-in can't change their email address from the account page; they ask an administrator instead.
• Turning it off is the same switch, or ask your Pages contact. People signed in to the website are let back in at once; the desktop app asks them to sign in again, and an email code works for that. Saving new provider settings also turns it off, and Pages tells you.

This decides who can sign in to Pages. It doesn't lock copies of the app that are already open or working offline.

Adding and removing people from your directory (SCIM)

Directory sync lets your identity provider add people to Pages and suspend them when they leave your company. It is for organizations that already use company sign-in, and an owner turns it on from the Directory sync (SCIM) card on the Organization page. The steps below are for Okta; other providers that speak SCIM 2.0 use the same three values: the base URL, the token, and userName as the unique identifier.

Okta needs two apps, because its OpenID Connect apps can't push people. Set up company sign-in first (above), then:

1. On the Organization page, choose Generate token and copy the token at once. Pages shows it only this one time.
2. In Okta, choose Create App Integration and pick SWA - Secure Web Authentication. Name it "Pages (provisioning)". Set the login URL to https://usepages.app/signin.html, and tick Do not display application icon to users, so nobody sees a second Pages tile.
3. On the app's General tab, edit App Settings, set Provisioning to SCIM and save. A Provisioning tab appears; open it and choose Integration, then Edit.
4. Paste the SCIM base URL from the Organization page into SCIM connector base URL. Set Unique identifier field for users to userName. Tick Push New Users and Push Profile Updates.
5. Set Authentication Mode to HTTP Header and paste the token into the Authorization field. Choose Test Connector Configuration, then save.
6. Under Provisioning, To App, turn on Create Users, Update User Attributes and Deactivate Users.
7. On the Sign On tab, set Application username format to Email. Pages needs each person's email address at one of your verified domains.
8. Assign the same people (or the same groups) to both apps: the company sign-in app and "Pages (provisioning)".

What it does and doesn't do

• Adding a person gives them a seat in your organization as a member, the same as their first company sign-in would. If every seat is in use, Okta's push fails and Pages emails your owners to say so, at most once a day. Free a seat on the Organization page or ask your Pages contact for more.
• Removing a person in Okta suspends them in Pages and ends their Pages sessions in your organization. Nothing is deleted: their account, your audit history and their seat stay, and adding them again brings the same membership back.
• Owners are never suspended by your directory, and their email address isn't changed by it. Okta is told no, and Pages records the refusal. An owner signs in with an email code when company sign-in isn't working, so the address stays theirs to change, on their account page. Change the person's role in Pages first if your directory should manage them. Their name still follows your directory.
• Roles and groups stay in Pages. Nothing about a role, a group or an entitlement is read from your directory.
• Each side undoes only its own suspension. If an administrator suspends someone in Pages, your directory marking them active doesn't lift it, even though Okta re-sends that with every profile push. An administrator's suspension stays even if your directory removes the person and adds them again. A person your directory itself removed or deactivated is brought back when your directory adds or re-activates them, and an administrator can also restore them in Pages.
• Name and email changes in your directory change the person's name and address in Pages only when the account belongs to your organization alone. If the person is also in another organization, Pages refuses the new address and keeps the old one; they can change it themselves on their account page.
• Rotating the token stops the old one at once, so paste the new token into Okta straight away. Turn off stops your directory adding or suspending anyone; the people it already added keep their access.
• Limit: Pages accepts 600 requests from your directory in any 5 minutes, which is far more than an import of a few hundred people uses. Okta backs off by itself if it is ever reached.
• This decides who can sign in to Pages and ends their sessions. It doesn't lock a copy of the app that is already open or working offline.

Belonging to several organizations

One email address can belong to more than one organization. If you do, Pages asks which one to sign in to the first time it matters, and remembers your choice on that device after that. To work in a different one, sign out and sign in again, or use the switch organization option where it appears in the app.

Running your organization

If you're an owner or an admin, your organization has a Manage button on the account page, and the same option in the app's account panel. That opens the Organization page, where you can:

• Invite people by email, as a member, an admin, or (owners only) another owner, and see who hasn't accepted yet.
• Change somebody's role between member and admin, or, if you're an owner, promote somebody to owner.
• Transfer ownership to somebody else. You type the organization's name to confirm; you and every other owner become admins.
• Suspend, restore, or remove a member or admin, and sign any of them out everywhere. Owners can do the same to another owner.
• Set your organization's name and logo, and its policies for the app.

An open invitation holds a seat until it's used or canceled, the same as a person who has accepted. Only an owner can make somebody else an owner or transfer ownership — and transferring makes the owners who had it before into admins, not members. Adding seats, verifying a domain, and deleting the organization are arranged with your Pages contact.

A colleague can't sign in

If they have already joined, find them in the member list on the Organization page, open Actions and choose Unlock sign-in. Then ask them to request a new code on the sign-in page and use the newest email. If they haven't accepted their invitation yet, it is under the open invitations: its row says link opened once the link has been opened, and Resend sends it again.

The usual cause is a mail security scanner, such as Microsoft Defender Safe Links, that opens the link in an email before the person does. That can spend the link and the six-digit code in the same email, so neither works. Don't reuse that email's code; a new one fixes it.

See who is using Pages

The Usage card on the Organization page shows each person's last sign-in, the days they were active, the files they opened and saved, and the tools they used most. Use the Period selector to change the dates, and Download people as CSV to save the table. It counts actions only, never a file name or its contents.

Working offline

Once signed in, Pages keeps working with no network connection at all — that is the whole point of a PDF editor that never uploads your documents. An installed copy checks that your access is still valid whenever it can reach the sign-in service: at startup, when its window comes back into focus, and about once an hour. If it cannot reach that service, it keeps working for up to 14 days from the last time it checked in successfully. After 14 days offline, it asks you to reconnect and sign in again before it will keep going.

"Remember my work on this device"

Your organization can turn this off, for example for shared computers. If it has, the setting is shown turned off and anything already kept on the device is cleared.

Turn this on and Pages saves your open documents and everything you have done to them — reordering, marks, rotations — in your browser's own storage on your machine, so they are back the next time you open the app on that device. This never leaves your device, nothing is uploaded, and you can turn it off and clear it at any time from the same setting.

Saving your work

How you keep a finished document depends on where you are running Pages:

• Chrome or Edge: File > Save as… (Ctrl+S, or Cmd+S on a Mac) asks where to put the document each time and writes it there. Export… makes a copy as a PDF or as images, and asks where to put it too. There is no separate Save, because the browser never writes over the file you opened without asking.
• Any other browser (Firefox, Safari): use Export…, which downloads the result. The original file is left as it was.
• The desktop application: Save and Save as work exactly as they do in any installed app, writing to the file you opened.

Edit text vs. Redact

Edit text is for correcting or updating what a page says. Where it can, it changes the page's own words in place, in the page's own font. On a scan, or on words it can't edit in place, it covers them and types the new ones on top, and the old words are still in the file underneath, where they can be copied or extracted. Either way, it is not a way to remove something confidential.

Redact selection and Redact an area…, in the Edit menu, remove the text they cover from the exported file. It has known limits: text inside certain embedded page content, or in fonts Pages cannot measure precisely, may occasionally be left in place, or a slightly larger area than you drew may be affected. Because your documents never reach us, we cannot check an export for you — always confirm, in the exported file itself, that anything you meant to redact is really gone before you share it.

Reading scanned pages (OCR)

Your organization can turn this off. If it has, Pages says so when a scanned page would be read.

Making a scanned page searchable requires the text-recognition engine, which Pages downloads the first time you ask it to read a page — this needs an internet connection. Once downloaded, the words it recognized are kept with the document, and no document content is sent anywhere as part of this: only the request for the engine and language files themselves leaves your device.

Installing the app

Pages is available for macOS and Windows from the downloads page, where your organization offers it. If the page lists no downloads, yours uses Pages in the browser. The installed app will not open a document until you sign in with an account your organization's administrator has created.

Lost access to your mailbox

If you are still signed in somewhere, change your address yourself from your account page before you lose the old mailbox: a code goes to the new address, and your history comes with you.

If you can no longer sign in at all, ask your organization's administrator to invite your new address. They can remove the old one at the same time.

Contact support

Can't find what you need here? Ask your organization's administrator.