Inviting Users
Users are added to The Vault through an invitation flow. The invitee receives an email with a one-time registration link that lets them set their password and configure MFA before using the platform.
Invitation links are short-lived for security. If a link expires before the invitee uses it, resend the invitation from the Users page.
Inviting a User via the Dashboard
Navigate to Users
Go to Settings → Users.
Add the User
Click Add new user and fill in:
- Email — The invitee’s work email address. This becomes their login identifier.
- First Name / Last Name — Used for display in the dashboard and audit logs.
Send the Invitation
The invitee receives an email with a registration link where they set a password and complete account setup. Logins are protected by a second factor — an email one-time code by default, with optional TOTP enrolment (see MFA).
Assign Roles
A newly created user has no roles yet. From the user’s ⋯ menu, select Assign Roles and choose one or more roles (Admin, Finance Manager, Viewer). Use Show Privileges to review the resulting permission set.
Assign Wallet Groups (optional)
To scope the user to specific wallets, select Assign Wallet Groups and choose the groups they should have access to.
Inviting a User via the API
User management is a dashboard-only operation — inviting users, changing roles, and blocking are governed actions and are not part of the public Client API (see Users & Access in the API reference).
Changing a User’s Roles
Roles can be changed at any time from Settings → Users → Assign Roles. Changes take effect on the user’s next request once their current short-lived session refreshes.
Blocking a User
Users are blocked rather than deleted, preserving their identity in the audit trail. From the user’s ⋯ menu, select Block:
- The account becomes inactive and active sessions are terminated.
- Audit records referencing the user remain intact.
- Blocking a user account does not block that user’s enrolled devices — block those separately from Settings → Mobile devices so the device’s key share can no longer participate in signing.
Unblocking restores access with the same identity and role assignments.