Managing Users

OpenBoxes Lift makes it straightforward to control who has access to your account and your OpenBoxes instance. All user management happens from the Users section of the portal at app.openboxes.cloud.

User Limits by Tier#

Each plan includes a set number of users. These limits apply to the total number of active users on your Lift account.

Plan	Included Users	Additional Users
Shared	Up to 10	+5 users add-on, $25/mo ($240/yr) per pack, up to 2 packs (20 users)
Dedicated	Up to 50	+25 users add-on, $100/mo ($960/yr) per pack, up to 2 packs (100 users)
Enterprise	100 included	+$100/mo per 25, added to your agreement (more than 500 per agreement)

You can see your current user count on the dashboard and on the Users page. On Shared and Dedicated, add a user pack from Billing in the portal (the Add-ons card, then Browse add-ons) once your subscription is paid. The extra seats are available once the add-on shows Active on your Billing page (usually within a minute) and is charged pro-rata for the rest of the current period, then with your plan. See Billing & Plans for how add-ons are charged and cancelled.

Inviting Users#

The account owner and Admins can invite people. An Admin can invite Managers, Users and Viewers; only the account owner can invite someone as an Admin. To add someone to your Lift account:

Go to Users in the portal sidebar
Click Invite User
Enter the person's email address
Select a role (see below)
For a Manager, User or Viewer, choose their OpenBoxes locations: All locations (the default) or Only these locations (see Limiting a teammate to some locations)
Click Send Invitation

The invited person receives an email from noreply@openboxes.cloud with the subject "You're invited to OpenBoxes Lift: set up your account" and a link to choose a password. Once set up, they can sign in to the portal and open OpenBoxes with Launch OpenBoxes. Their OpenBoxes user is set up the first time they do, with the OpenBoxes role their portal role gives. They can also sign in on your instance's login page with Continue with Google, Continue with Microsoft or Continue with GitHub, using the same email address as their invitation. If the login page says "Open OpenBoxes from app.openboxes.cloud first.", they open OpenBoxes once with Launch OpenBoxes in the portal. Nothing is created in OpenBoxes for an invitation that is never accepted.

Watch the video: Orders and Your Team (1 min) includes inviting a teammate from the portal.

Invitation Details#

Invitation links expire after 12 hours. The account owner or an Admin can resend an invitation from the Users page at any time while the user is still pending.
If the email doesn't arrive, ask the invitee to check their spam or junk folder, and consider asking your IT team to allow email from noreply@openboxes.cloud.
Invitations count toward your user limit immediately. If you are at your limit, the invitation is refused: remove a user, add a user pack under Billing > Add-ons, or change your plan before sending a new one. (Moving between Shared and Dedicated hosting is arranged with support rather than as a self-serve plan change, with or without an add-on active.)

User Roles#

The person who signed up for the account is the account owner. They have full control over the organization account, billing, and subscription, and they manage the team together with any Admins. Each account has exactly one owner.

Invited team members are assigned one of four roles. The role sets their role inside OpenBoxes and changes a few things in the portal:

Role	Inside OpenBoxes	In the portal
Admin	Admin, at all locations	Can manage the team: invite, change, deactivate and remove Managers, Users and Viewers (see below). Sees stock values, prices and order amounts on the Reports page, in its CSV downloads and in the scheduled export files. Can turn the scheduled export on or off and choose how often it runs. Gets a copy of the email we send when someone asks to remove the account owner's two-step sign-in.
Manager	Manager, at all locations or only the ones you choose	Same portal access as User and Viewer: every quantity and count on the Reports page, but not money values unless the account owner turns on Show stock and order values to all teammates.
User	Assistant: a standard user who can record stock and orders, at all locations or only the ones you choose	Same as Manager.
Viewer	Browser: read-only in OpenBoxes, at all locations or only the ones you choose	Same as Manager. The Viewer role makes OpenBoxes read-only, not the portal.

The account owner is the Superuser inside OpenBoxes, and nothing on the Users page changes the owner's OpenBoxes user.

The Admin role does not give access to billing, the subscription, API keys, staging copies or closing the account; those stay with the account owner.

Who Manages the Team#

The account owner and Admins manage the team from the Users page.

Action	Account owner	Admin
Invite a Manager, User or Viewer	Yes	Yes
Invite someone as an Admin, or make someone an Admin	Yes	No
Change the role of, deactivate, remove or resend the invitation of a Manager, User or Viewer	Yes	Yes
Change, deactivate or remove an Admin	Yes	No
Change, deactivate or remove the account owner	No	No
Change their own role, deactivate or remove themselves	No	No
See Recent team changes	Yes	Yes
Billing, subscription, API keys, staging copies, closing the account	Yes	No

For an Admin, the Admin choice does not appear in the role pickers ("Only the account owner can make someone an Admin."), and the owner's and other Admins' rows have no actions. When several people are selected, anyone who can't be changed is skipped and the message says why, for example "1 skipped: only the account owner can change an Admin." If an Admin reaches the user limit, the invitation is refused with "Ask the account owner to add seats.", because user packs are bought from Billing.

The team list for everyone#

Everyone on the team can open Users. Managers, Users and Viewers see a read-only team list: each person's name, role and status (Active, Invited or Deactivated), with email addresses shown only for active members and never for pending invitations. It has no buttons to change anyone and says "Your team is managed by the account owner and Admins."

Recent team changes#

The account owner and Admins see Recent team changes on the Users page: who did what to whom and when (invitations, role and status changes, removals and resent invitations), for the last 90 days. A change that Lift support made on the owner's behalf is labelled Lift support. Lift support can look at your team during a support session but cannot change it from one.

Opening OpenBoxes#

Everyone on the team opens OpenBoxes with Launch OpenBoxes at the top of the portal. A teammate's OpenBoxes user is set up the first time they open OpenBoxes, once they have finished setting up their account from the invitation email, and gets the OpenBoxes role their portal role gives (see the table above).

Changing a role in the portal changes the teammate's OpenBoxes role too. If OpenBoxes can't be updated right away, the change is retried automatically and is always applied before their next Launch OpenBoxes.
A role changed inside OpenBoxes lasts until the teammate's role is next changed in the portal, or they are turned back on after a deactivation. Then it is set to match the portal role again.
If a teammate already has an OpenBoxes user, the first time they click Launch OpenBoxes the portal asks "Use your existing OpenBoxes user?". If they choose Continue, they open that user from the portal from then on, and its current OpenBoxes password stops working. Google, Microsoft and GitHub sign-in on the OpenBoxes login page still work. Not now leaves the user unchanged and does not open OpenBoxes.
A higher OpenBoxes role is kept at that first link. If the existing user already has a higher role than the portal role gives, it keeps it, and the Users page shows "Has a higher role in OpenBoxes." The next role change in the portal sets it to match.
Superusers are managed inside OpenBoxes. A teammate whose OpenBoxes user is a Superuser is not changed from the portal; the Users page shows "Managed inside OpenBoxes (Superuser). Change it there." Their role is changed inside OpenBoxes. On the Shared plan they still open OpenBoxes with Launch OpenBoxes in the portal, and after that first Launch they can also use Google, Microsoft or GitHub sign-in on the OpenBoxes login page. On a Dedicated plan they sign in on the OpenBoxes login page with their OpenBoxes username and password.
Users you add inside OpenBoxes do not use portal seats and are not members of your portal team. The portal's Users page does not list or manage them.
Teammates cannot open a staging copy from the portal.

Limiting a teammate to some locations#

The account owner and Admins choose which OpenBoxes locations each Manager, User and Viewer works at: All locations (the default) or Only these locations.

When inviting, choose under OpenBoxes locations in the Invite User dialog. For someone already on the team, go to Users, open the row's actions menu, choose View Details, and find OpenBoxes locations
Choose Only these locations, search the list and tick at least one location ("Choose at least one location.")
Click Send Invitation, or Save Changes on the member's page

A limited teammate shows a chip with their number of locations on the Users page, for example "3 locations". What a limit does and when it applies:

In OpenBoxes the teammate is given their role at their locations, and the location chooser lists only theirs. Some shared lists, such as products, stay visible. A location limit organizes who works where. It is not a security boundary between your locations: a teammate can still reach some details of another location, for example a stock movement's page opened from a direct link. On the Shared plan, a Record stock save for another location is refused. On a Dedicated or Enterprise plan, for now, a limited Manager or User can still record stock at another location with a hand-built request, although the OpenBoxes screens never offer it.
Admins always work at all locations. The location choice is hidden for the Admin role, and making a limited teammate an Admin gives them every location (a bulk change to Admin does the same).
Superusers have their locations set inside OpenBoxes. The member's page shows "Managed inside OpenBoxes (Superuser). Their locations are set there."
Timing. For a teammate who already uses OpenBoxes, a change is applied straight away, or within a few minutes if OpenBoxes can't be updated at once ("OpenBoxes will catch up within a few minutes."). For someone who has not opened OpenBoxes yet: "This limit applies when they first open OpenBoxes." For a deactivated teammate: "This limit applies when you turn them back on."
An existing OpenBoxes user not yet confirmed. The limit is saved and applies once they confirm "Use your existing OpenBoxes user?" at their first Launch OpenBoxes; until then their existing OpenBoxes access is unchanged, and the page says so. If you left them on All locations and that existing user was already limited to some locations, confirming keeps those locations as their limit.
An Admin whose existing OpenBoxes user is limited to some locations is not linked, and nothing in OpenBoxes is changed. The Users page shows "This person's existing OpenBoxes user is limited to some locations, and Admins always work at all locations. Change their role or ask support." After the account owner changes their role to Manager, User or Viewer, their next Launch OpenBoxes confirms the user and keeps its locations.
Inactive and deleted locations. A location made inactive in OpenBoxes stays on the teammate's list, marked "inactive in OpenBoxes", and can be unticked but not newly chosen. A deleted location is dropped ("1 location no longer exists in OpenBoxes."). With none of their locations left, a teammate gets no OpenBoxes access at any location, never more, and the Users page shows "No OpenBoxes locations. Choose at least one."
Google, Microsoft or GitHub sign-in. A limited teammate who has never opened OpenBoxes sees "Open OpenBoxes from app.openboxes.cloud first." on the login page; they open OpenBoxes once with Launch OpenBoxes, and then the provider buttons work.
The portal is not narrowed by location. Location limits apply inside OpenBoxes. The portal's Reports page still shows every location, and the scheduled CSV export and stock alerts still cover every location for the teammates who receive them.
If Only these locations is greyed out with "Location limits aren't available for your OpenBoxes yet.", your OpenBoxes needs an update first. Choose All locations for now or contact support.

Managing users inside OpenBoxes#

Inside OpenBoxes itself (Configuration > Users), user management works like this:

Only an OpenBoxes Admin who holds the Admin role for all locations, or the account owner, can create users, change roles or reset another user's password. An Admin can do this only for users below Admin: Managers, Assistants, Browsers and users with no role.
Managers and Assistants cannot create users, change roles or reset anyone else's password, and nobody can edit, deactivate or delete a user at or above their own level.
Nobody except the account owner can change their own role or give themselves access to more locations.
Nobody but the account owner can edit, deactivate, delete or reset the password of the owner's OpenBoxes user.
The user, user location role and person bulk imports and the role editor are for the account owner only. Product and inventory imports are not affected.
Everyone can still edit their own profile and language and change their own password with Change Password. Passwords are never changed from the edit form.
Signing in with Google, Microsoft or GitHub works as before, for the account owner too.

When one of these rules blocks an action, OpenBoxes shows a Change not allowed page ("This change can't be made here.") and nothing is changed. Ask an OpenBoxes Admin or the account owner to make the change.

Changing a User's Role#

The account owner can change any teammate's role. An Admin can change a Manager, User or Viewer to another of those three roles; only the account owner can make someone an Admin or change an Admin's role.

Go to Users in the portal sidebar
Find the user in the list
Click the role dropdown next to their name
Select the new role

Role changes take effect in the portal within about a minute. The teammate's OpenBoxes role follows, and is always applied before their next Launch OpenBoxes. If you change someone from Admin to another role, they stop seeing money values on the Reports page and can no longer change the scheduled export.

Removing Users#

The account owner can remove or deactivate any teammate; an Admin can remove or deactivate Managers, Users and Viewers. Nobody can remove the account owner. To remove a user from your Lift account:

Go to Users in the portal sidebar
Find the user you want to remove and open the actions menu on their row
Choose Remove (or Deactivate, if you may want to turn them back on later)
Confirm

What Happens When a User Is Removed or Deactivated#

They can no longer sign in to the Lift portal.
Their OpenBoxes user is turned off too. Anything they have open in OpenBoxes stops working, and they can no longer get into OpenBoxes with Launch OpenBoxes, with Google, Microsoft or GitHub, or with an OpenBoxes password. Turning a deactivated user back on restores their OpenBoxes access.
Three OpenBoxes users are not turned off this way, so deactivate them inside OpenBoxes (Configuration > Users): a teammate's OpenBoxes user that is a Superuser, and an existing OpenBoxes user the teammate never confirmed with "Use your existing OpenBoxes user?", and an OpenBoxes user a teammate already had before teammate access to OpenBoxes was switched on that the Lift team has not yet linked to their portal account (ask support if you are not sure).
API keys are not revoked automatically. The account owner can see and revoke every key on the account from the API keys page in the portal.
Any data they created in OpenBoxes (purchase orders, shipments, etc.) remains intact.
A removed user's slot is freed up, and you can invite someone new. Removal cannot be undone; a deactivated user can be turned back on from the same menu.

Removing a user does not delete their historical activity. OpenBoxes maintains a complete record of all actions for accountability.

Bulk Operations#

For accounts with many users, the Users page supports:

Search: filter users by name or email
Select several users to change their role or remove them together (anyone you are not allowed to change is skipped, and the message says why)

SSO and External Identity Providers#

Team members can sign in with Google, Microsoft, or GitHub on every plan. That is individual sign-in.

Company sign-in (single sign-on, SSO) is available now, set up with our team: included on Enterprise, a paid add-on on Dedicated ($299/month on the Dedicated Tier monthly plan or $2,900/year on the Dedicated Tier annual plan), and not available on the Shared Tier. It works over SAML 2.0 or OpenID Connect with Microsoft Entra ID, Okta, Google Workspace or any standard provider, for people with an address on a domain your organization has verified. It does not sync users from your identity provider (there is no SCIM). People join your account the first time they sign in with their company account, and removing someone in your identity provider does not remove them here. You still manage removals on this page. Roles can also come from your identity provider's groups, set up with our team: for people who sign in with their company account, a group can raise their role to Viewer, User, Manager or Admin at each company sign-in (by default it never lowers a role, and Admin needs the account owner's agreement), and each change appears in Recent team changes, labelled Company sign-in. See Company Sign-In (SSO).

Best Practices#

Use the User or Viewer role for most team members. Only grant Admin to people who should manage the team, see money values on the Reports page and manage the scheduled export.
Review users periodically. Remove users who have left the organization or no longer need access.
Prefer Google/Microsoft/GitHub sign-in. Fewer passwords to manage, and access follows your existing identity provider account.

Teammate roles overview: the roles, who manages the team, choosing a teammate's OpenBoxes locations and users on each plan, on one page.
Account setup: your organization details and inviting your first teammates.
Billing & Plans: how user packs and other add-ons are charged.