Skip to main content
People sign in to the consumer dashboards as users. A user gets access to your partner through a Partner Membership, and what the membership may do is the union of the permissions of its groups and the permissions granted to it directly (its effective permissions). API keys do not belong to members: they carry their own scopes (see Permissions and scopes). One person (one email address) is one user across the whole platform and can be a member of several partners, for example of your production partner and of a sister company’s partner. They choose the partner when they sign in.

​
Members and invitations

  • Invite a member with Invite a member or in the dashboard: give an email address and, optionally, groups (groupIds, at most 20) and direct permissions (directPermissions). The member starts as invited and receives an invitation email. The invitation expires after 7 days; resend it to issue a new one (the old link stops working).
  • An email that already has a membership in your partner answers 409 membership-exists.
  • Membership statuses: invited → active (on accepting) → suspended ↔ active → removed. Suspend blocks a member temporarily; Remove is final (also for open invitations). A removed person can be invited again; that creates a new membership.
  • Change a member’s direct permissions replaces directPermissions as a whole. Group memberships are changed on the group.
  • Changes take effect within 60 seconds on the member’s next request.
Guard rails that keep your partner manageable: Managing members needs manage-members and managing groups manage-groups; both are dashboard only (not delegable to API keys), and several of these operations need a recent sign-in. Reading members (view-members) and groups (view-groups) works with API keys too.

​
Groups and permissions

A group has a name, an optional description, a list of permissions and its members (memberIds, at most 500).
  • Create a group and update a group: permissions and memberIds are replaced as a whole. When two admins save the same group at the same time, the later save wins, so read the group again before you edit it.
  • Group names are unique among your active groups (409 group-name-taken).
  • Delete a group removes its member links; a group used as the default group of single sign-on provisioning cannot be deleted (409 group-in-use).
  • List permissions returns the permission catalog with a label, a description, whether a permission is delegable to API keys and whether it is applicable to your partner’s role. For a consumer partner every view-provider-… or manage-provider-… permission is not applicable.
The full list with what each permission allows is in Permissions and scopes.

​
Default groups

Every consumer partner starts with these groups. Default groups cannot be renamed or deleted; except for owners, you can edit their permissions. developers and viewers deliberately cannot read billing data or prices. Put finance staff in billing.

​
Multi-factor authentication and SSO

  • Multi-factor authentication. With the partner setting mfaRequired on, every member must use a second factor to work in your partner; members without one are asked to enrol (403 mfa-required for their requests until they do). Change it with Update security settings (manage-settings, dashboard only). Each member’s mfaEnrolled shows whether they have a second factor. Partner administrators can never change another user’s factors.
  • Single sign-on. Connect your identity provider through SAML or OIDC with the single sign-on operations or in the dashboard. You list your email domains, prove ownership of each with a DNS TXT record, test the connection and then activate it. With enforced on, users of those domains must sign in through your identity provider (403 sso-required otherwise). With automatic provisioning on first sign-in (jitProvisioning) a first SSO sign-in creates an active membership in the group you choose. SSO needs view-sso / manage-sso, which are dashboard only.
API keys are not affected by MFA or SSO; protect them with scopes and the IP allowlist.