Skip to content
Browse documentation

Users & roles

Invite team members, choose their role, and understand exactly what owner, admin, manager and analyst may do.

Last updated 4 min read

On this page

Team members are managed under Settings → Users (https://app.trackcrown.com/app/settings/users). Only admins and owners see this page. Partner and advertiser logins are separate: they are managed on the affiliate's and advertiser's own pages and sign in to their portals, never to the network panel.

Roles#

RoleIn short
OwnerEverything, including ownership and other owners.
AdminSettings, users, API keys, postback tokens, billing, domains, integrations, webhooks, audit log.
ManagerOffers, partners, advertisers, conversions, postbacks, smart links, Google Ads, automation; billing read-only; workspace settings read-only.
AnalystRead-only access to dashboards, reports, offers, partners, advertisers, conversions and domains. Can save reports.

Each role includes everything of the roles below it.

Permission reference#

PermissionAnalystManagerAdminOwner
Dashboard, reports, offers, advertisers, affiliates, conversions, smart links, postbacks, domains, Google Ads, integrations (read)✓✓✓✓
Save reports; read automation✓✓✓✓
Edit offers, advertisers, affiliates, conversions, smart links, postbacks, Google Ads✓✓✓
Read billing and workspace settings; manage notifications and automation✓✓✓
Edit integrations, webhooks, billing, workspace settings✓✓
Manage users, domains, API keys, postback tokens; read the audit log✓✓
Transfer ownership✓

Invite a team member#

  1. Go to Settings → Users and click Invite member to open Invite a team member.
  2. Enter Email, optional Name, and choose the Role. You can only assign roles up to your own; only owners can make someone an owner.
  3. Submit. People who already have an account are added right away. Others get an Invitation link (valid 7 days) to set their name and password.
  4. If e-mail (SMTP) is configured, the link is e-mailed. Otherwise the page shows "Email is not configured" and you copy the link and send it yourself.

Manage members#

Open the ⋯ menu on a member's row:

ActionEffect
Change rolePick a new role (up to your own).
Resend invitationNew link valid 7 days; earlier invitation links stop working.
Send password resetLink valid 1 hour; older reset links of this user stop working.
Disable accountSigns them out everywhere; they cannot sign in until enabled. Not available for users who also belong to another workspace or for platform administrators.
Enable accountThey can sign in again with their existing password.
Remove from workspace / Cancel invitationThey lose access to this workspace immediately; their account and other workspaces are not affected.

When an account belongs to another workspace too, invitation and reset links are e-mailed but not shown in the panel.

Two-factor status#

The Users page warns when active members have no two-factor authentication ("N active members have no two-factor authentication"). Ask them to turn it on under Profile → Two-factor authentication, or require it for everyone with Require two-factor authentication for staff in Workspace settings.

Sign-in protection#

  • Passwords need at least 10 characters.
  • After 5 failed sign-ins within 10 minutes the e-mail address is locked for 10 minutes. Platform administrators can unlock it earlier.
  • New-device sign-ins trigger one alert — in-app and by e-mail unless the user changed New-device sign-ins under My notifications; each user sees their sign-in history on their profile page.
  • Sessions last 30 days and are extended while used. Users can sign out other sessions from their profile.

Your profile#

Every user manages their own account under Profile & security (user menu → Profile, https://app.trackcrown.com/app/profile; partners and advertisers use /partner/profile and /advertiser/profile):

CardWhat you can do
ProfileName (shown in the audit log and to your team) and Display time zone. Leave the time zone empty to use the workspace zone; when set, dates and report days in the panel are shown in your zone.
Sign-in e-mailChange the address you sign in with (New e-mail, confirmed with your Current password).
PasswordCurrent password, New password (at least 10 characters), Confirm new password.
Two-factor authentication and recovery codesSee Two-factor authentication & SSO.
Sign-in historyYour last 20 sign-ins.
Active sessionsEvery device signed in to your account; Sign out one session or Sign out other sessions.

Partner and advertiser users#

  • Partners: create a portal login when you create the affiliate (Create a partner portal login) or from the affiliate's Users tab. Partners only see their own offers, clicks, conversions and payouts — never revenue.
  • Advertisers: add users on the advertiser's Portal users tab. Advertisers see their own offers and conversions and revenue as their cost — never partner payouts or partner identity beyond the partner ID/code.

View as partner#

Staff can open a partner's portal read-only to see exactly what the partner sees. Every write is refused in this mode, the session is audited, and an Exit banner returns you to the panel. See View as partner.

Audit log#

Admins and owners find every change (offers, settings, users, domains, money) under Settings → Audit log.

Something unclear or missing in this article?Tell us