Skip to content
authreads Docs

Configure your tenant

Before your users can log in, set up what they can access. A user's access is the intersection of three things: their role, their org-type, and their package.

access = role ∩ org-type ∩ package. All three gate a product app. To simply log in (or reach an admin/management surface) a user only needs a role — a package is required only to open product apps, so you can add it later.

Setup order

  1. Applications
    Register the products your tenant offers (e.g. Tracking, HR). Each app belongs to your tenant and shares your tenant's user pool.
  2. Organization types
    Define the kinds of organization in your tenant (e.g. Company). Org-types let you grant different apps to different kinds of org.
  3. Access mapping
    Map which applications each org-type (and role) may reach. This is one of the three gates in role ∩ org-type ∩ package.
  4. Packages — optional to start
    A package (plan) gates which product apps a user can reach. It is required only for end-user product access— not for logging in or reaching admin/management surfaces (those are role-gated). You can sign in and finish setup first, then add a package when you're ready to enable products.
  5. Roles
    Define the end-user roles (e.g. owner, user) — the third gate, deciding what a user can do inside an app. Give each role a stable key: your product should reference roles by that key, not by their internal id, so it keeps working across environments and reseeds (the id changes; the key doesn't). Create or update roles in the admin dashboard or via the Management API — a product that keys its roles to match will resolve them automatically.
  6. Users
    Add your first end-user to the tenant's user pool (admin dashboard or the Management API). On first login their identity mirrors into your product automatically.

Then connect your product

Once a package includes your apps and a user has a role, copy your Tenant credentials into your product's config and have the user log in. The token they receive carries their granted apps, which your product enforces.

If a user logs in but can't reach any app, the usual cause is a missing package(or the app isn't in the assigned package) — check the package gate first.
Default apps belong in every package you provision. If your product has an always-on management or administration app for client teams, include that app in every package you create through the Management API. authreads applies role ∩ org-type ∩ package uniformly and does not special-case default apps. If package apps are edited directly in authreads, re-add required defaults before users rely on that package.