Roles, permissions, two-factor and sessions

Once a few people work in the workspace, not everyone needs to do everything. The person packing boxes doesn't need to know what a jar costs you, and your bookkeeper needs the money, not the catalog. Roles set the broad shape; permissions adjust it for one person.

The 5 roles

There's exactly one owner, and only the owner can hand that on. Change someone's role in Account & Billing → Members & invitations → Change access.

Roles decide what someone can change. Everyone in the workspace can open every list and record.

Handing the workspace to someone else

The owner can make any other member the owner: Members & invitations → Make owner, confirmed on the spot. The new owner gets everything, the plan and the payment method included, and the old owner becomes an admin, so they keep their access but can't take ownership back themselves. Both change together, so there's never a moment with two owners or none, and the activity trail records who handed it to whom.

The bill doesn't move. The subscription and the card belong to the workspace, not a person.

If the owner can't sign in

Maybe the owner left the business or lost their mailbox. Write to us from /support, from an address we can tie to the workspace, such as an admin's sign-in address. Tell us the workspace name and who should own it. We'll ask you to show that you're entitled to ask, such as a note from the business or a way to reach the owner we already have. Once we're satisfied, we make that person the owner. The old owner becomes an admin, the activity trail records that OrderDen support did it, and we email both addresses so neither is surprised.

The new owner has to be someone who's already in the workspace. We can't add a stranger, so invite them first if they aren't there yet.

Every role uses a seat

The accountant included, at $5 a month for an extra person on Unlimited. See Plans & billing.

An accountant sees every list and record, costs and every report included, and can export. They can't raise a quote, edit an order, change a price or touch the catalog.

The 8 permissions

A member or a viewer can have their access adjusted permission by permission. Owners and admins always have all of them, and an accountant's access is set by the role.

A member starts with everything except Export lists and download data.

What "costs hidden" covers

With See costs and margin off, the unit cost and margin columns come off the items list and out of its column picker, the margin card on an order isn't shown, gross margin and inventory value leave the dashboard and its widget picker, and the cost reports (profit and loss, project profitability, inventory valuation, materials usage, production summary, stock by location and stocktake variance) aren't offered.

It doesn't hide everything yet. The item page's Cost tab and the margin on its Pricing tab still show, and CSV exports, including the items export and the report downloads, still carry costs. Don't rely on it to keep costs from someone.

They still see what they need for the work: what was sold, how many, for how much, where it goes and when it was promised.

Nobody grants what they don't have

You can only hand out access you hold yourself, and only the owner can change an admin's access or remove an admin.

Inviting someone with the right access from the start

The invite form sets the role and the permissions, so someone invited as a packer arrives with a packer's access.

Inviting an address that already has an open invitation refreshes it instead of making a second one. Invitations expire after 14 days.

Send invite creates the invitation and emails the link. If the email can't go (a bounced address, or a server with no mail set up), the invitation is still created and the form says so. Copy its link from the pending list, or press Send email there to try again.

Your sign-in address

Personal Settings → Your profile holds the address you sign in with, and changing it takes two confirmations:

1. We email the address the account already uses. Nothing has changed yet.
2. Following that link makes us email the new address.
3. Following the second link moves the account. The old address gets one last email saying so, and the change goes on the activity trail of every workspace you belong to.

Why two. Password reset links go to that address, so whoever holds it holds the account. Asking the current inbox first means someone who can't read your email can't move it, and the email you get is how you find out they tried.

Confirm your address first. An address that has never been confirmed can't be changed. We send a confirmation link when the account is made. Where email is set up, you can't sign in with your password until you've followed it; the sign-in page takes you to a page with Send the link again.

If you can't reach either address, write to us. That one needs a person.

Two-factor authentication

Set it up under Personal Settings → Security. That page holds everything about signing in: your Password first, then two-factor, passkeys and where you're signed in.

An authenticator app. Confirm your password, then scan the QR code with your authenticator app. If you can't scan it, copy the Setup key into the app by hand, or give a password manager the Setup link. Type the code the app shows to finish. Asking for a code before it's on means a phone that never produced one can't lock you out later. Accounts that only sign in with Google have no password, so they can't set up an authenticator app; they can add a passkey.

Backup codes. Shown once, when you set up the app. Save them somewhere other than your phone. Each one signs you in once if you lose your phone. Used most of them, or lost the list? Confirm your password and click New backup codes for a fresh set; the old ones stop working straight away.

Lost your phone and your backup codes? Write to us from /support and tell us the address you sign in with. Once we know it's you, we turn two-factor off for your account, and you get an email saying so. The change also appears in your workspace's activity trail. Sign in with your password and set two-factor up again.

Passkeys. Your face, fingerprint or device PIN. A passkey counts as a second factor when your workspace requires one. OrderDen's sign-in page doesn't offer passkey sign-in yet, so you still sign in with your password or Google.

At sign-in you enter a code, or click Lost your phone? for a backup code. Don't ask again on this device for 30 days is ticked by default. If you came to the sign-in page from a link into the app, the code takes you there.

Signing in with Google asks for the code too. Google proves which Google account you hold; the code is the separate thing you added. You land on the code prompt after Google, and then on the page you were heading for.

Requiring it of everyone

Under Company Settings → Security, an owner or admin can turn on Require two-factor authentication for the whole workspace. Before you turn it on, the page lists who hasn't set it up: they're sent to set it up on their next page load and can't reach anything else until they do.

You need your own second factor before you can turn this on.

Where you're signed in

Personal Settings → Security lists every browser with a live session, named by browser and operating system, with when each was last used.

Signing one out takes effect right away. Sign out everywhere else does them all at once: the thing to do after losing a laptop or changing a password you think someone guessed.

Sessions belong to you, not a workspace, so signing out everywhere signs you out of every workspace you're in.

If OrderDen support has signed in as you, that session is marked. See Your data.

What the trail records

These changes go on the activity trail: role and permission changes (naming what changed), a second factor or passkey added or removed, a session signed out, and the workspace-wide requirement turned on or off.

Through the API

An API key has the permissions of the person who created it, checked on every request, so taking someone's access away takes away what their keys can do. A key made by someone without See costs and margin gets JSON responses with the cost fields removed (CSV responses and the full export still include them). A key without Create and edit documents gets a 403 on the writes that need it. A key whose creator has left the workspace can only read.

Tick Read only when you create a key and it can look things up but not change anything: every write answers a 403 with the code read_only_key. Use one for a dashboard, or for anything that only listens.

Call GET /api/v1/me from a new integration first: it reports the workspace, the role and permissions the key holds, and its rate limit. Members are listed at /api/v1/members and invitations at /api/v1/invitations. Sending an invitation and handing over ownership work in the app only for now: their API endpoints refuse every call. See the API reference.