Account access

Members and roles

Open Members on your tenant page to see everyone who can manage it. Free includes one seat for its primary owner. Inviting more members needs Pro or Vetted status; Enterprise includes more seats. Apps using a configuration's discovery, sign-in or pinned-user page need no membership or seat.

Reader: view configurations, including client secrets, run Test sign-in and read every recorded flow.
Editor: Reader, plus configuration changes and clearing recordings.
Owner: Editor, plus agent tokens and managing Editors and Readers.

Only the primary owner can delete the tenant, activate the offer, manage Owners or transfer the primary role to another Owner. Keep a second Owner so an operator can help restore access if the primary owner's mailbox is lost. Other members can leave; the primary owner must transfer first.

Removing a member, leaving, or changing an Owner to Editor or Reader also revokes the agent tokens that member issued and deletes the invitations it sent. The dialog says how many before you confirm. Agent tokens no member issued, such as the one an AI agent received when it created the tenant, stay until an Owner revokes them.

Invite a member

An Owner enters an expected recipient's email and role in Members. Every member can see client secrets and recorded tokens, so invite only trusted teammates. The invitation uses a seat and expires after 7 days by default. Opening the link changes nothing; the invitee accepts the terms and privacy notice and chooses Join tenant to become a member. An Owner can resend or revoke pending invitations. The primary owner manages invitations for Owners.

Joining signs you in only if the invited email belongs to no other tenant. If it already belongs to one, you join and then sign in with an email link to open the tenant.

An invitation stops working when the member who sent it can no longer send it: they left or were removed, they were changed from Owner to Editor or Reader, or they invited an Owner and then transferred the primary role. The invitee sees that the invitation is no longer valid and asks an Owner for a new one.

Sending is limited to 3 invitations per address, 20 per tenant and 10 per member each day, and 500 a day across HeyIdentity. A resend counts as a send, and revoking an invitation doesn't give it back.

Extra seats and suspension

Pro and Vetted tenants include 3 seats and can have up to 15 with extra seats. Ask support@heyidentity.dev for extra seats with your tenant route id, the count and the end date you need. During the early-adopter offer they are granted at no charge. See pricing and higher limits.

Members shows the included seats, active extra seats and when they stop counting. Extra seats stop counting when they expire or when the plan that allows them ends; a later plan can make an unexpired grant count again. Pending invitations use seats but do not cause suspension by themselves. While members fill the maximum, an invitation shows no free seat; the same link works until it expires once a seat is free.

When members alone exceed the maximum, only the primary owner keeps access. Every other member is marked Suspended on Your tenants and sees a suspended page naming the primary owner. Membership and roles are kept. The primary owner sees a banner with the counts and can remove members, renew the plan or ask for extra seats. Access returns automatically on the next request once members fit. Runtime sign-in through the configurations keeps working.

The primary owner sees a warning from 30 days before a plan or extra seats end if that end would suspend members. Renew the plan or seats, or remove members before the date shown. Transferring the primary role while over the maximum makes the recipient the only member with access and suspends the former primary owner.

A suspended member can still leave from the suspended page or Your tenants. Leaving removes membership and revokes the agent tokens and pending invitations that member created. A Test sign-in started before suspension ends with the suspended page and no token data. Agent tokens issued by a suspended member are refused with HTTP 403 issuer_suspended, without being revoked; they work again when the tenant fits. Tokens issued by the primary owner or without a member issuer keep working.

Management links and old claim URLs are retired

Saved management links and old claim URLs no longer grant access. Sign in with email to open your tenants. If you do not know which address you used, email support@heyidentity.dev with the tenant route id from your application's authority URL.

Sign in with email

Enter your member email on the sign-in page.
Open the newest email and choose Sign in. The link works once and expires after 15 minutes.
Open a tenant from Your tenants. Bookmark its editor page for your next visit.

A session ends after 1 hour idle or 8 hours in all, or when you choose Sign out. When it ends, request another email link. Signup and claim confirmation also sign in the browser that confirms.

Keep a tenant created by an AI agent

Ask the agent for a claim code. Enter the 8 letters at the claim page within 15 minutes. Verify your email, or choose Add to my existing tenants and sign in. You may need to enter the code again after signing in. If it has expired, ask for a new one. A new code replaces the previous code. Claiming keeps the same tenant IDs and configuration; the agent retains access until you revoke its token.

Have the agent's token file? Request a code yourself. An unclaimed agent tenant is deleted 7 days after creation.

Keep a scratchpad

Open it in the browser that created it and choose Claim this scratchpad. Confirm the email before the scratchpad expires. This needs no claim code and signs in the confirming browser.