Members and roles
A tenant's members are the people who can sign in to the console to manage it, such as your development, operations and support colleagues. Members always join by invitation and set their own password; admins never set passwords for others. Each member has a role in the tenant that decides what they can do.
See the member list under "Members" in the menu; owner and admin also see an "Invitations" tab. Emails and phone numbers in the member list are partly hidden, such as z***@example.com.
Roles and permissions
| Role | Name in the console | Description |
|---|---|---|
owner | Owner | The person responsible for the tenant; each tenant has exactly one. Whoever signed up or created the tenant is the owner, and the role can be transferred |
admin | Admin | Manages apps, credentials, members, policies and IM data, and views bills |
developer | Developer | Views apps and config, manages IM users, groups and chat rooms, and changes most app policy items |
What each role can do:
| Action | owner | admin | developer |
|---|---|---|---|
| View tenant info, the member list, apps, server secrets (not in plain text), the IP allowlist and app policies | ✓ | ✓ | ✓ |
| Create IM users, edit profiles, sign them out, remove friendships | ✓ | ✓ | ✓ |
| Create groups, add and remove members, set group admins, transfer group ownership | ✓ | ✓ | ✓ |
| View chat rooms, online members, mute and ban lists, allowlists, attributes and chat room stats; create chat rooms, edit their profiles, set admins, transfer ownership, set and delete attributes | ✓ | ✓ | ✓ |
| View calls, call stats and audio/video availability | ✓ | ✓ | ✓ |
| View the app's storage usage, upload files (including avatars for IM users) | ✓ | ✓ | ✓ |
| View push credentials (without secrets), notification templates and push stats; edit and restore notification templates; send test pushes | ✓ | ✓ | ✓ |
| View users' push devices, push settings and conversation Do Not Disturb; change users' push settings, lift conversation Do Not Disturb, unbind push devices | ✓ | ✓ | ✓ |
| View callback endpoints, sync callback settings, the event catalog, delivery queue, request log and stats; run URL verification, test sends and sync callback tests; pause and resume callback endpoints, redeliver | ✓ | ✓ | ✓ |
| View content moderation config, word lists and stats, use "Try it" | ✓ | ✓ | ✓ |
| View available plans, and the app's plan, quotas, plan change history and daily usage | ✓ | ✓ | ✓ |
| Change app policies (except the fields in the next row) | ✓ | ✓ | ✓ |
| Change retention days for messages, attachments and group files, erasing messages when deleting users, and token lifetimes in app policies | ✓ | ✓ | |
| Change the tenant name and default region | ✓ | ✓ | |
| Create, edit, disable, enable and delete apps | ✓ | ✓ | |
| Rotate and revoke server secrets, change the IP allowlist | ✓ | ✓ | |
| Add push credentials, replace a credential's secret, edit its public parameters, disable, enable and delete push credentials | ✓ | ✓ | |
| Create, edit and delete callback endpoints, rotate signing secrets, end the old secret's grace period early, turn on, turn off and configure sync callbacks | ✓ | ✓ | |
| Change content moderation config and word lists, manage moderation accounts, handle moderation items and reports, view platform actions, view and clear users' violation records | ✓ | ✓ | |
| Set passwords for IM users, ban, unban and delete users, global mutes | ✓ | ✓ | |
| Ban, unban and dissolve groups, mute everyone and mute members | ✓ | ✓ | |
| View conversations and messages, send messages as a user, recall messages | ✓ | ✓ | |
| Mute everyone in chat rooms, mute, remove and ban users, manage allowlists; ban, unban and dissolve chat rooms | ✓ | ✓ | |
| View recent chat room messages, send messages in chat rooms, recall chat room messages | ✓ | ✓ | |
| End calls, remove members from calls | ✓ | ✓ | |
| View the file list and file info, download message attachments and group files, delete files | ✓ | ✓ | |
| Invite members and manage invitations; disable, enable and remove members; change member roles | ✓ | ✓ | |
| View and submit business verification, upload and view business licenses | ✓ | ✓ | |
| View the account, this month's cost estimate, bills and details, transactions and usage summaries; export details; set billing contacts | ✓ | ✓ | |
| View the operation log | ✓ | ✓ | |
| Transfer ownership, require two-step verification for everyone, close the tenant | ✓ |
Roles are per tenant, so the same person can have different roles in different tenants. To give some people access to only some apps, put those apps in a separate tenant.
Invite members
owner or admin clicks "Invite member" on the "Members" page and fills in:
| Field | Description |
|---|---|
| Email or phone number | The invitee's email, or phone number with country code |
| Name | Optional, up to 128 characters |
| Role | Admin or developer. owner can't be set by invitation, only transferred |
The system sends an invitation link to that email or phone number, valid for 72 hours and usable once. Members plus pending invitations can't exceed the tenant's member limit (20 by default), and each email or phone number can have only one pending invitation at a time.
When the invitee opens the link, the page shows the tenant, role and who invited them:
- No account yet: enter a name and password and click "Create account and join". The invited email or phone number becomes their sign-in.
- Already has an account: sign in first, then open the link and click "Accept as …". The signed-in account must use the invited email or phone number, or it can't accept, so a forwarded link is useless to anyone else.
The "Invitations" tab shows each invitation's status (pending, accepted, expired, revoked), and pending ones can be:
- Resent: sends a new link, the old one stops working, and the 72 hours start again. Expired invitations can't be resent; invite again instead.
- Revoked: the link stops working and the invitee can no longer join.
Manage members
owner and admin can use the "Actions" column of the member list to:
- Change role: switch between admin and developer, which needs identity verification.
- Disable: the member stays in the list but can no longer access this tenant; "Enable" restores them.
- Remove: the member can no longer access this tenant, and can be invited again later.
These changes take effect on the member's next action, and the member isn't notified. You can't change your own role or status, and nobody can disable or remove the owner or change their role.
Apart from the owner, members can click "Leave tenant" on their own row to leave.
Transfer ownership
The owner can transfer ownership to an active admin: click "Transfer ownership" on their row in the member list, confirm, and verify your identity again. They become the owner and you become an admin.
The owner can't be disabled or removed, and can't leave the tenant directly; to leave, transfer ownership to another admin first. If a developer is taking over, change their role to admin first, then transfer.
Require two-step verification for everyone
The owner can turn on "Require two-step verification for all members" under "Security and closure" on the Overview. Before turning it on, the owner must have turned on two-step verification in "Account settings" themselves.
Once on, members without two-step verification are refused when they access the tenant, with the message "This tenant requires two-step verification". Their account itself isn't affected; after turning on two-step verification in "Account settings", they can access it normally.
Verify your identity again
High-impact actions such as deleting an app or rotating a secret require you to have entered your password within the last 10 minutes. When you do one, the console shows a "Verify your identity" dialog: enter your sign-in password, plus a verification code or recovery code if two-step verification is on, and click "Verify and continue", after which the action runs automatically. For 10 minutes after verifying, other sensitive actions don't ask again.
Actions that need identity verification:
| Page | Actions |
|---|---|
| Account settings | Turn on two-step verification, regenerate recovery codes, turn off two-step verification |
| Members | Change a member's role, transfer ownership |
| Overview | Close the tenant |
| Apps | Delete an app |
| Server secret | Rotate secret, revoke |
| Overview | View client_secret, rotate secret |
| App policies | Changes that delete data, such as shortening message, attachment or group file retention; see Runtime policies |
| Messages | View users' conversations and messages, send messages as a user |
| Chat rooms | Send chat room messages as a user |
| File storage | Download message attachments and group files |
| Push | Add credentials, replace a credential's secret, delete credentials |
| Callbacks | Create and delete endpoints, change the URL, subscribe to more events, loosen filters, rotate signing secrets, turn on, turn off and configure sync callbacks; see Callback settings |
| Moderation accounts | Add, edit (including disable and enable) and delete moderation accounts |
Repeated wrong passwords
After 10 failed identity verifications within an hour on the same sign-in, that sign-in stops working and you must sign in to the console again.
Operation log
owner and admin can view management actions in the tenant under "Operation log" in the menu, including members' actions in the console, some management actions servers performed through OpenAPI (such as banning or deleting IM users and ending calls), and actions the platform performed for you (such as changing plans and recording payments).
| Column | Description |
|---|---|
| Time | When the action happened |
| Operator | The operator's type and ID: a console member (account ID), a server (OpenAPI, with the ID of the server secret used for the call), the platform, an IM user or the system |
| Action | The action type, such as app.create (create app), member.update (edit member), policy.update_app (change app policies), message.view (view messages), media.file_view (download file), media.file_delete (delete file), push_credential.create (add push credential), chatroom.history_view (view recent chat room messages), rtc.call_end and rtc.member_remove (end a call, remove a member from a call), moderation.content_view (view a moderation item's content), and billing.contacts_update (set billing contacts) |
| Target | The type and ID of the affected object |
| App | The ID of the app the action belongs to; - for tenant-level actions |
| IP | The operator's IP |
Click the expand button on the left of a row to see what changed before and after. You can filter by action type (enter the full type, such as app.delete) and time range.
- Sensitive content such as passwords, Secrets and verification codes is never recorded.
- Account actions themselves (signing in, changing passwords, two-step verification) aren't in the operation log; see "Sign-in history" in "Account settings".
- The reason you enter when viewing conversations and messages, viewing recent chat room messages, sending messages in chat rooms, or downloading message attachments and group files is recorded in the log; every view of a business license is recorded too.
- Files blocked or unblocked by the platform for violations are also recorded here (
media.file_block,media.file_unblock), with the reason. File logs only record the file ID, purpose, owning user, group and so on, never the file name or content. - The platform changing an app's plan (
billing.subscription_change), recording payments (billing.payment_record), and suspending and resuming an app's audio/video (rtc.suspend,rtc.resume, with the reason) are recorded here too, with the platform as operator. - For push and content moderation action types, see Push settings and Content moderation settings.