Users & access

Roles

Each user has one or more roles. Roles decide which sections appear in the sidebar and which actions are allowed.

Role	Label	Typical use
ROLE_ADMIN	Admin	Account owners. Everything, including users and the API token.
ROLE_NORMAL_USER	Normal User	Day-to-day operation: transactions, customers, configuration.
ROLE_REPORTS	Reports	Reporting and analytics.

The first user of a new account is created as Admin when the account is activated. The exact menu of each role is configured by CreditCore; contact your account manager to change it.

Manage users

Admins manage users in CreditCore Management → User (/creditcore-management/user). Filter by ID, name or role; Excel exports the list.

Invite a user

1. Click New.
2. Fill in Name, Email and one or more Roles, and set Active.
3. Save. The user receives an email with a link to create their password.

Edit or deactivate a user

Click the pencil to change the name, email, roles or the Active toggle. Inactive users can’t sign in. Users can’t be deleted; deactivate them instead.

API token

The API token authenticates your servers against the Payments API. There is one token per account, shared by all its users. Only admins can generate it.

1. Open the profile menu and choose API Token.
2. Click Generate API Token.
3. Copy the token and store it in your secret manager. It’s shown only once.

If a token already exists, the window tells you so. Generating a new one replaces the previous token immediately: update your servers straight away.

Danger

The API token gives full server-side access to your account (refunds, cancellations and customer data). Never put it in front-end code, mobile apps or source control.