Roles, permissions, two-factor and sessions

Once the fifth person joins, "everybody can do everything" stops being simple and starts being a problem. The person who packs boxes does not need to know what a jar costs you. Your bookkeeper needs the invoices and nothing else. The new starter should be able to look before they touch.

Roles cover the shape of the project. Permissions handle the exceptions.

The five roles

Change somebody's role under Account & Billing → Members → Change access.

Handing the workspace to somebody else

The owner can make any other member the owner: Account & Billing → Members → Make owner, confirmed on the spot. The new owner gets everything, plan and payment method included; the outgoing owner becomes an admin rather than leaving — the person who built the business does not lose the keys in the click that gives them away, and cannot take the role back themselves. Both rows change together, so there is never a moment with two owners or none, and the activity trail records who handed it to whom.

Nothing about the bill moves. The subscription and the card belong to the workspace, not to a person, and every role uses a seat. On the API it is POST /api/v1/members/{id}/transfer-ownership, owner only.

Every role uses a seat

Including the accountant. There used to be a free seat for the bookkeeper; there isn't any more, because seats are the only thing on the OrderDen bill and a role that costs nothing is a hole in a per-seat price. At $5 a month for an extra person, handing the books over at year end is not an upgrade decision. See Plans & billing.

An accountant sees invoices, payments, expenses, purchases and every report, including the cost figures — that is the project. They cannot raise a quote, edit an order, change a price or touch the catalog.

The eight permissions

A member or a viewer can have their access adjusted flag by flag. The other three roles are what their role says — an admin with "create and edit documents" switched off is a project title, not a permission.

A plain member starts with everything except the export. Taking the whole client list out of the building is the one thing worth being asked for by name.

What "costs hidden" actually means

Switch off See costs and margin and those figures are not blanked out or greyed — they are not sent to that person's browser at all. The unit cost and margin columns come off the items list and out of the column picker. The margin card on an order is not rendered. Gross margin and inventory value drop off the dashboard, and out of the widget picker. Cost-bearing reports — profit and loss, project profitability, inventory valuation, materials usage, production summary — are not offered and cannot be reached by typing the URL.

They still see everything they need to do the project: what was sold, how many, for how much, where it goes and when it was promised.

Nobody grants what they do not have

An admin whose own export permission is off cannot switch it on for somebody else. You can only hand out access you hold yourself, and only the owner may change an admin's access or remove one.

Inviting somebody with the right access from the start

The invite form carries the role and the flags. Somebody offered a packer's access lands with a packer's access — no window where they can see the costs because nobody has got round to it yet.

Re-inviting an address that already has an open invitation refreshes it rather than making a second one, so no seat is consumed twice.

Send invite does both halves: it creates the invitation and emails the link straight away. If the email cannot go out — a bounced address, or a self-hosted server with no mail set up — the invitation is still created and the form says so, so you can copy its link from the pending list or press Send email there to try again. The invitation never depends on the mailbox working.

Your sign-in address

Personal Settings → Your profile holds the address you sign in with, and changing it takes two confirmations.

1. We email the address the account already uses. Nothing has changed at this point.
2. Following that link makes us email the new address.
3. Following the second link moves the account. The old address then gets one last message saying it happened, and the change goes on the activity trail of every workspace you belong to.

Why two. The address is where a password-reset link goes, so whoever holds it holds the account. If one click could move it, anybody who found your screen unlocked could point the account at their own inbox and then reset the password — and you would be locked out of your own workspaces with nothing anywhere saying why. Asking the current inbox first means somebody who cannot read your email cannot move it, and the mail you get is how you find out they tried.

Confirm your address first. An address that has never been confirmed cannot be changed, because there is nowhere safe to ask. We send a confirmation link when the account is made; if you missed it, Send it again is on the same card. Nothing else waits for it — you can use OrderDen straight away.

If you cannot reach either address, write to us. That one has to be sorted out by a person, which is the point.

Two-factor authentication

Under Personal Settings → Security, either factor is enough:

An authenticator app. Confirm your password, add the code to any authenticator app, then type the code it shows to finish. Scanning the QR is not the end of it on purpose — a phone that scanned but never produced a code is exactly the phone that cannot produce one when it matters.

Backup codes. Shown once, when you set the app up. Save them. Each one signs you in once if you lose your phone, and they are the difference between a five-minute problem and a support ticket.

Passkeys. Your face, fingerprint or device PIN. Add one per device you actually sign in on; a shared workshop tablet is better off with the code.

At sign-in you enter a code, or click Lost your phone? for a backup code. Ticking "don't ask again on this device" skips the prompt on that browser for sixty days.

Requiring it of everybody

Under Company Settings → Security, an owner or admin can require a second factor of the whole workspace. Before you turn it on, the page lists who has not set one up yet: those people are sent to enrolment on their next page load and can reach nothing else until they finish.

You need your own second factor before you can turn this on. Locking yourself out of your own workspace with a setting is nobody's idea of a good afternoon.

Where you're signed in

Personal Settings → Security lists every browser holding a live session, named from the browser and operating system, with the last time each was used.

Signing one out takes effect immediately. Sign out everywhere else does the lot in one go — the answer to a lost laptop, and the first thing to do after changing a password you think somebody guessed.

Sessions belong to you, not to a workspace: signing out everywhere signs you out of every workspace you belong to.

If OrderDen support has signed in as you, that session is marked. See Your data.

What the trail records

Every change here lands in the activity trail: role and permission changes (naming exactly what changed), two-factor turned on or off, a passkey added or removed, a session signed out, and the workspace-wide requirement toggled.

Through the API

An API key carries the permissions of the person who created it, read fresh on every request — so taking somebody's access away takes away what their keys can do too. A key made by somebody without See costs and margin gets responses with every cost field removed; a key without Create and edit documents gets a 403 on the writes that need it. A key whose creator has left the workspace falls back to read-only.

Call GET /api/v1/me from a new integration before anything else: it reports the workspace, the role and flags the key holds, and the rate it may call at. Members and invitations are at /api/v1/members and /api/v1/invitations. An invitation created through the API emails the invitee exactly as the form does — the same letter, the same sender — unless you pass "send": false, which creates it silently and hands you the link to deliver yourself. Either way the response carries that link. See the API reference.