Invite people
Open People and select Invite people. Enter their email and a role; the invitation works for 48 hours and Resend renews it. Invited people sign up from the link with a password of at least 12 characters.
Owners and admins change roles and remove people. Only owners make someone an owner, and the last owner can’t leave.
Roles
Each person has one role. The picker on People describes each one:
- Owner: everything, including billing, single sign-on and requiring two-factor authentication.
- Admin: everything else. Admins manage pages, people (except owners), alert channels, settings and every API key, and can see billing but not change it.
- Editor: components, monitors, probes, incidents, maintenance, templates and subscribers, and their own API keys. Editors get alerts.
- Incident responder: posts incidents and maintenance and sets a component’s status; reads pages, monitors and subscribers.
- Viewer: reads pages, components, monitors and incidents, and sees subscriber counts but not addresses.
- Billing: the plan, usage, invoices and payment details, nothing else.
- Notify only: gets alerts and reports by email and chooses which ones; can’t open the rest of the admin.
The API follows the same table, and an API key never gets more than the role of the person who made it. Editors’ keys are their own: they see and revoke only those.
Seats
Owners, admins, editors, incident responders and billing members take a seat on your plan. Viewers and notify-only members are free, up to 50 per organization, invitations included.
Turn on two-factor authentication
Open your account menu, then Security. Enter your password, scan the QR code with an authenticator app (1Password, Google Authenticator, Authy…) and enter the 6-digit code it shows. Signing in then asks for a code after your password.
Keep the 10 backup codes somewhere safe: each one signs you in once without your phone. Security shows how many are left, and New backup codes replaces them all.
Sign in with a passkey
In Security, select Add passkey and confirm with your fingerprint, face or device PIN. The passkey can live on this computer, your phone, a password manager or a security key. On the sign-in page, Sign in with a passkey then signs you in without a password or code.
Signing in with a passkey counts as two-factor authentication, on its own or next to an authenticator app; signing in with your password doesn’t, if a passkey is all you have. It only works on your admin’s address, so a look-alike site can’t use it. Add a second one in case you lose the device, and remove any you no longer use.
Require it for everyone
On People, an owner switches on Require two-factor authentication, once they’ve signed in with it: with a passkey, or with an authenticator app’s code. The 2FA column shows who has it on, and how.
Everyone without it sees a reminder for 7 days. After that they can’t use the admin, invite or change anyone until they turn it on; the admin opens Security for them. Someone with only a passkey who signed in with their password is asked to sign in with the passkey. API keys keep working.
Sign-in protection
Sign-in allows 10 password, code or passkey attempts a minute from one address, and 10 password attempts a minute for one account from anywhere. Ten wrong codes in a row lock that account’s codes for 15 minutes.