People and permissions
Add people under Settings → People → Add manager, by the Google address they will sign in with. Resellers are added per app on the Resellers page.
| Role | Access |
|---|---|
| Owner | Everything in the account. The only role that can add owners, grant All, force HWID resets past the limit, reset every HWID in an app, and delete apps |
| Manager | A level per feature, on all apps or on selected apps |
| Reseller | One app; generates keys within allowances. See Resellers |
Features and levels
Section titled “Features and levels”Managers get a level for each feature:
| Feature | Covers |
|---|---|
| Apps (App settings) | None / Some / All, see App settings |
| License keys | Generating, listing, revoking, exporting keys |
| Users | Accounts, bans, time tools, blacklist |
| Logins | Sign-in history and sessions |
| Subscriptions | Tiers |
| Variables | Variables |
| Files | Files |
| Resellers | Adding and managing resellers |
| Webhooks | Webhooks |
| Managers | Adding and editing managers |
| Audit log | Reading the audit log |
| Level | Meaning |
|---|---|
| None | Not in their sidebar |
| Own | Their own records |
| Team | Their own and their team’s records |
| All | Everyone’s records in the apps they can reach (owner only to grant) |
Own means: keys they generated, users who redeemed those keys, those users’ sign-ins, resellers they created, managers they added, their own audit entries, files they uploaded, webhooks they added, and the tiers and variables of apps they created.
Every route that loads a record by ID re-checks app access and ownership, and permission changes apply on the next request.
Seller API tokens need App settings: All plus All on each area the token covers, so most managers can’t create them. An owner can make one and hand it over. The token then has All on its areas whatever the manager’s own levels are, and it outlives the manager. See Giving a token to someone.
A manager sees what their resellers do
Section titled “A manager sees what their resellers do”With Resellers: Own, the resellers a manager created count as theirs in License keys, Users, Logins, Webhooks and Audit log, wherever that feature is Own or Team. Both must be granted: Resellers: Own with Audit log: None still shows no audit entries.
Money stays out of it. A manager who sees a reseller’s keys this way gets them without the price and base price.
A manager can give the people they add Team instead of Own, on any feature but App settings. The manager and everyone they added with Team then share their records both ways. It is per feature, so a team can share keys but not users.
A team is one level deep: if a member adds someone with Team, that starts the member’s own team. Only managers give Team; an owner gives Own or All.
Managers who manage managers
Section titled “Managers who manage managers”The Managers permission lets a manager add and edit managers. Every grant is clamped:
- never above their own level, and never All,
- never a feature they don’t have, and never an app they can’t reach,
- never an owner, never themselves, and with Managers: Own only the people they added.
The panel greys out every level you can’t pass on.
Owner addresses stay private
Section titled “Owner addresses stay private”An owner’s email is only shown to other owners. To everyone else, owners are left out of the
people list, and anywhere an address would appear it reads Owner.
Deleting a manager
Section titled “Deleting a manager”Settings → People → Delete…, typing their email. They lose access at once. You choose what goes with them:
| Choice | Options |
|---|---|
| Their keys | Keep, delete unused, or delete all |
| End-user accounts made only with their keys | Keep or delete |
| Resellers they added | Keep or delete |
| Managers they added (all the way down) | Keep or delete; the same choices then apply to them |
A preview shows the exact counts first. Whatever is kept is handed to you. The audit log keeps its record.