Documentation

Go to Portal Website

User Management

Overview

User Management lets Team and Enterprise tenants invite team members, assign permissions, manage API tokens, and create automation keys. Use it to give each person or integration the access they need without sharing owner credentials.

Review access regularly, especially before production releases, staffing changes, SSO rollout, or automation-key rotation.

User Limits

PlanMaximum Users
Free1 (owner only)
Team20 users
Enterprise100 users

These limits include the tenant owner. Contact support if you need an increased user limit.

Managing Users

Add A User

  1. Open User Management in the sidebar.
  2. Click Add User.
  3. Enter the user's email address.
  4. The user receives an invitation email and can access the tenant after login.

New users start with no elevated permissions. Assign permissions deliberately after confirming their role.

Remove A User

  1. Find the user in the user list.
  2. Click Remove next to their name.
  3. Confirm the removal.

The user immediately loses tenant access.

Lockout prevention: You cannot remove the last user who has user_and_api_management permission. At least one user must always retain the ability to manage other users to prevent account lockout.

Self-removal: Users cannot remove themselves. Another user with user_and_api_management permission must remove them.

User Permissions

Each user can be assigned granular permissions that control what they can do within the tenant:

PermissionAccess Granted
modify_configurationEdit security controls, toggle detections/preventions, set response actions, save and promote configurations
update_certificatesUpload, delete, and manage certificate pinning entries
build_applicationsUpload apps, trigger builds, download protected binaries, view build logs
manage_custom_messagesEdit custom in-app message templates, toggle message activation
user_and_api_managementAdd/remove users, change permissions, create/delete API tokens
modify_tenant_settingsChange tenant name, subscription, billing settings, deployment settings, privacy controls

Permissions are additive. A user with no elevated permissions can view supported areas in read-only mode but cannot make changes.

Suggested Roles

RoleTypical permissions
Tenant owner or platform adminAll permissions, reviewed periodically.
Security engineermodify_configuration, update_certificates, and log access where plan allows.
Release engineerbuild_applications and automation-key access.
Support or compliance reviewerRead-only access plus logs where appropriate.
CI/CD integration tokenOnly the permissions required by the integration. Use automation keys for build-only workflows.

Update Permissions

  1. Select a user in the list.
  2. Toggle individual permissions on or off.
  3. Click Save to apply changes.

Permission changes take effect immediately or on the user's next page load.

Breakglass Account

Each tenant has an owner account. The owner has full permissions and cannot be removed. Keep the owner account secure and ensure at least one additional trusted user has management permissions on paid tenants.

Enterprise tenants that enforce SAML SSO must also select a SAML breakglass account from users who have user_and_api_management. See SAML SSO Integration.

API Token Management

API tokens allow programmatic access to the AppTego Management API without sharing user credentials. Create separate tokens for separate systems so each one can be scoped, rotated, and revoked independently.

Create An API Token

  1. Open User Management -> API Tokens.
  2. Click Create Token.
  3. Give the token a clear name, such as Compliance Export or Internal Dashboard.
  4. Select only the permissions the integration needs.
  5. Copy the generated token. The secret is shown only once.

Token Format

Bearer <key_id>:<key_secret>

Use API Tokens

Include the token in the Authorization header of Management API requests:

Authorization: Bearer abc123:xyz789

See the Management API Overview for full API documentation.

Delete A Token

  1. Find the token in the list.
  2. Click Delete.
  3. Confirm deletion.

The token is immediately invalidated.

Note: Deleting a token cannot be undone. Any systems using that token will immediately lose access.

Token Best Practices

Automation Keys (Team+)

For the Automation API (CI/CD integration), separate automation keys are available with a simplified format designed for build pipelines.

Manage Automation Keys

  1. Open Automation Keys in the sidebar.
  2. Create a new key, toggle an existing key on or off, or delete a key.
  3. Store each key only in the CI or release system that needs it.

Using Automation Keys

Automation keys are used with:

Automation keys are scoped to application-build automation. They cannot modify configurations, manage users, or access billing.

Audit Trail

All user management actions are recorded in the Audit Log (Enterprise):