Managing Users and Access Passes

This article covers giving people access to Qik: inviting dashboard users, creating app users, and controlling what each one can do with access passes and permission sets. For the difference between a profile, an account and a login, see People, Users and Logins.

Users vs profiles

A profile is a data record about a person. A user (login) is what lets someone sign in. Creating a profile does not give anyone access. To do that, you create a login and give it access passes.

Two kinds of user

• Dashboard users can sign in to the Qik admin dashboard to manage your data and settings.
• App users can sign in to the apps and websites you build, but not to the Qik dashboard.

Finding users

Both People and Access Control have a Users panel with these lists:

• <Your organisation> App Users: everyone who signs in to your apps.
• Dashboard Users: everyone who can sign in to the admin dashboard.
• Pending Invitations: people who haven't accepted their invitation yet.
• Blocked / Banned Users: logins that have been deleted or banned.

Inviting a dashboard user

1. Go to People or Access Control and click Invite user.
2. Enter their First Name, Last Name and Email Address.
3. Choose the Access Passes they should hold.
4. Choose the scope to store the login in.
5. Confirm. An invitation is sent to their email address.

The invitee appears under Pending Invitations until they accept and set up their account. If they need a new link, use the Send Invitation Link action on their login.

If you're an account administrator, the invite dialog also shows Account Administrator. Account administrators have full access to everything in the organisation and bypass access passes and scopes, so only tick it for people who truly need it.

You can also start from someone's profile: the Invite as user action fills in their name and email for you.

Creating an app user

1. Open the App Users list and create a new one. The dialog is titled Create new App User.
2. Enter their name, Email Address and a password, plus any access passes.

To invite existing profiles to one of your apps by email, select them and use Send App Invitation, then choose the application.

Access passes and permission sets

An access pass is a reusable bundle of roles paired with scopes. When you change an access pass, everyone who holds it is updated. To set access passes up, see Roles and Permissions.

To change what an existing user can do:

1. Open their login from one of the user lists.
2. Add or remove Access Passes.
3. To give this one person something extra without making a new pass, add a Permission Set. Choose the Roles to grant and the Scopes where they apply.
4. Save. People who are signed in are told that their access has changed.

Everything is additive: a user gets the combined permissions of all their access passes, their own permission sets and any group positions they hold. Some access also comes from built-in rules rather than roles; see Access Beyond Roles. To let people update their own details, see Self-Service Profile Editing.

Reducing or removing access

• Remove access passes to reduce someone's permissions while keeping their login.
• Delete the login to stop them signing in at all. It moves to Blocked / Banned Users. Their profile and the content they created are not affected.

Application access

Each application (website or app) has its own permission settings. These include Application Permission Sets, which control what the app itself can access, including for anonymous visitors, and User Permission Sets, which every signed-in user of that app gets. When a user signs in to an application, their session combines:

• the application's own permissions
• the user permissions configured for that application
• the user's own access passes and permission sets

This layering lets you decide what a public website shows to anonymous visitors, what any signed-in user can see, and what specific people can do.

Tips

• Prefer access passes over individual permission sets, because a pass is easier to review and update for many people at once.
• You can only grant permissions that you hold yourself.
• To check what someone can see, impersonate their login.
• For sign-in, passwords and one-time codes, see Signing In and Account Security.

FAQs