Overview
Use Users and roles to control who can access the Nexudus dashboard and what they can do. A user is an individual staff account. A role is a permission, and a user role is a reusable group of permissions that you assign to users. Go to Settings → Users to manage staff accounts, and Settings → Roles to manage permission groups. You need administrator access or the corresponding user and role permissions.Permissions are additive. A user receives the combined permissions of every user role assigned to them.
Create a user
For administrators specifically — full unrestricted vs role-restricted, notifications, multi-location access, and linking customer profiles — see Creating administrators.1
Open Users
Select Settings → Users and add a user.
2
Enter account details
Add the person’s name, email address, preferred language, and default location.
3
Set sign-in access
Set or generate a password. Enable password reset on first sign-in when appropriate.
4
Set location access
On the access section, select the locations the user can work with.
5
Assign user roles
Assign the permission groups needed for the person’s work, then save the account.
User fields
Build a permission group
1
Open user roles
Go to Settings → Roles → User roles.
2
Create or copy a group
Create a named group, or start from a supplied template such as read-only, billing, or operations.
3
Choose permissions
Select the permissions needed for the job, then save the group.
4
Assign the group
Return to the user record and add the group in its access section.
Permission names
Permissions use an entity and action, such asCustomer-Read or Invoice-Create.
Administrators and API access
An administrator has unrestricted dashboard access. Administrator access overrides assigned user roles, so reserve it for staff who administer the platform. Enable API access only for accounts used by a trusted integration. Use a separate, least-privilege account where possible and review it when the integration changes.Two-factor authentication
Staff accounts can use two-factor authentication (2FA) with an authenticator app. Each user enables or disables it from their own user record:- Open Settings → Users and select the user.
- Click Set up two-factor authentication. A QR code appears — scan it with the user’s authenticator app (or enter the secret manually).
- Enter the 6-digit code from the app to confirm. The account now shows as 2FA-enabled, and the button becomes Disable two-factor authentication.
Enforce 2FA for all staff
Under Settings → Security options, turn on Enforce two-factor authentication and set a From date. From that date, any staff member who hasn’t enabled 2FA can no longer log in to the dashboard, and they see a warning callout on sign-in telling them to configure it before the deadline.Change the account owner
Each location has an account owner — the person with full access rights over that account, who can request upgrades and cancellations and review the terms of service. To change it, go to Settings → Users, select the user you want to make the owner, and use the Set as account owner action. The selected user becomes the owner of the location’s account. Do this deliberately: the previous owner keeps their own user permissions but loses owner-level rights.Best practices
- Give users the smallest set of permissions that lets them complete their work.
- Restrict users to the locations they need.
- Use named user roles instead of manually recreating the same permissions for each user.
- Remove access promptly when a staff member changes role or leaves.