Staff and access
Add team members, choose between Administrator and Staff, assign support departments, and handle password resets and departures.
People who sign in to the admin area are listed under Staff in the admin menu (the System group). Only administrators can see and use this page.
Two roles#
| Staff | Administrator | |
|---|---|---|
| Clients, invoices, quotes, services, payments | Yes | Yes |
| Products and servers | Add and edit (not delete) | Add, edit and delete |
| Tax rates | Add, edit and delete | Add, edit and delete |
| Support tickets | Those in their departments and those assigned to them | Every ticket |
| Settings, plugins, API tokens and webhooks | No | Yes |
| Staff accounts, support departments and ticket fields | No | Yes |
The role form describes it in the same terms. Staff "cannot change settings, plugins, API tokens or other staff", and an administrator can do everything staff can, plus those.
Customers are a separate kind of account with no access to the admin area. See Managing clients.
Adding a person#
- Open Staff and press Add staff.
- Enter their Name and Email. They sign in with this address.
- Choose a Role: Staff or Administrator.
- Tick the Support departments they work in. This list appears under Support departments once departments exist.
- Under Password, choose how they get one: Email them a link to choose one, or I will set one now and type a password of at least 8 characters.
- Press Add staff user. They can sign in as soon as they are added.
The emailed link uses your outgoing email settings, so set those up first. See Email.
Support departments#
Departments route support tickets. Administrators create them under Departments, which appears once you enable support tickets in Settings → Support. A staff member sees tickets in the departments they are ticked for, plus any ticket assigned to them. Administrators see every ticket regardless. See Departments and email in.
Role and department changes take effect the next time the person loads a page.
The staff list#
The list has tabs for All, Active, Inactive, Administrators and No 2FA, a search box, and a table showing each person's role, departments, last sign-in, 2FA status and whether the account is active. Select Edit to open a person, or More for quick actions.
Password help and two-factor#
On a person's page, under Sign-in security:
- Send reset link emails them a link to choose a new password.
- Reset 2FA removes their second factor if they lost their phone. Tick Also revoke their API tokens if the account may be compromised. Until they set it up again they can sign in with only a password.
To require two-factor sign-in from everyone on the team, turn on Require two-factor authentication for staff in Settings → Security. Staff and administrators without it are then sent to set it up before they can use the admin area. See Two-factor sign-in.
When someone leaves#
Press Deactivate on the person's page, or choose it from More on the list. Deactivating:
- stops them signing in,
- revokes their API tokens,
- ends their sessions where possible,
- removes their remembered ("trusted") devices, so a code is asked for again.
Their history stays in the activity log, and Activate brings the account back with their existing password.
Two safeguards apply:
- You cannot deactivate your own account.
- The last active administrator can be neither demoted to Staff nor deactivated. Make someone else an administrator first.