User Management

Key Concepts

Printago uses a role-based access control (RBAC) system combined with individual permissions to give you fine-grained control over what each team member can do inside your organization.

• Roles are pre-built permission bundles (e.g. Admin, Operator, Viewer) that grant a set of related permissions at once. When we update a role — such as adding permissions for a newly released feature — every user assigned to that role automatically gains access. This keeps your team in sync without requiring manual updates.
• Individual permissions let you grant or revoke a single capability for a specific user, independent of any role. This is useful when someone needs access to one extra feature (like exporting parts) without the broader privileges of a higher role.
• Store Owner is a special designation — there is exactly one Store Owner per organization. The Store Owner has unrestricted access to all features and is the only user who can grant Full Access API keys or assign any permission regardless of their own role. Ownership is set when the organization is created and must be explicitly transferred before the owner can be removed.

You can combine both approaches: assign a role for the baseline, then layer on individual permissions where needed. See the Roles & Permissions List page for a full breakdown of what each role and permission provides.

When to use roles vs. individual permissions

Roles are the recommended default — they stay current as Printago evolves and are easier to audit at a glance. Use individual permissions only when a user's needs don't line up with any existing role, or when you want to grant a single extra capability on top of a role.

Privilege escalation prevention

To prevent privilege escalation, you can only grant permissions that you yourself hold. For example, a user with the Viewer role cannot invite someone and assign them the Admin role. Store Owners are the only exception — they can grant any permission to any user.

Inviting Users

Sending an Invitation

1. Navigate to Admin > Team from the sidebar
2. Click Invite User in the top-right
3. Enter the person's email address
4. Optionally select a role and/or individual permissions to pre-assign
5. Click Send Invite

Printago will send an email with a unique invitation link. The invitation expires after 7 days.

What Happens Next

• New to Printago — the recipient creates an account using the invitation link, and is automatically added to your organization with the assigned role and permissions.
• Existing Printago user — the recipient signs in with their existing account to accept the invitation.

In both cases, the invitation email must match the account email (case-insensitive). This prevents someone from accepting an invitation intended for a different person.

Re-sending & Revoking

From the Users list, pending invitations show Resend and Revoke buttons:

• Resend — extends the expiry by 7 days and sends a fresh email. Can only be used once every 24 hours.
• Revoke — permanently invalidates the invitation link so it can no longer be accepted.

Rate limits

Each organization can send up to 10 invitation emails per day (across all invites and resends). This limit resets daily.

Importing Users from a CSV File

If you need to add a whole class, department, or team at once, import them from a spreadsheet instead of inviting people one at a time.

Available on request

Import Users is turned on per organization by the Printago team, who also register your school's email domains. Contact us to have it enabled. Once it is, anyone with the user.invite permission sees Import Users on the Users page.

Printago does not email anyone during an import. Each person on your list is added to your organization straight away, with the role in your file:

• Someone who does not have a Printago account gets one, plus a personal store of their own for their own printers. Accounts are only created for addresses at your school's registered domains, such as school.edu or students.school.edu; the Import Users window lists them.
• Someone who already has a Printago account is added as they are, whatever their email domain. Nothing about their account changes.
• Someone who is already a member is skipped, as is anyone with an address off your domains who has no account.

People land in your organization when they sign in. Their personal store is separate: nothing in it is visible to your organization, and they can switch to it from the organization menu.

Preparing the File

1. Navigate to Admin > Team from the sidebar
2. Click Import Users
3. Click Download the template and open it in Google Sheets, Excel, or any spreadsheet app
4. Replace the example rows with your own people, then save or export the sheet as a CSV file

Column	Required	What to enter
email	Yes	The person's email address. They sign in with this exact address.
role	No	One role per person, such as student, viewer, or operator. Leave it blank for no role.

The Import Users window lists the roles you can use. Role names are not case sensitive, and Part Manager, part manager, and part_manager all work. You can import up to 500 people per file.

Reviewing and Importing

1. Click Choose CSV file and select your file
2. Check the preview. Every row is marked Ready, Check, or Skipped
3. Click Import
4. Download the list or print the cards before you close the window

Status	What it means
Ready	The person will be added exactly as written.
Check	The person will be added, but maybe not as written. The usual reasons: a role that is misspelled or that you are not allowed to assign (no role is assigned; give them one later from their user page), or an address off your school's domains (added only if they already have an account).
Skipped	The person will not be added: the email address is not valid, the row repeats an earlier one, or the person is already a member.

Nothing happens until you click Import, so you can fix the file and choose it again as many times as you like. Importing the same file twice is safe: people who are already members are skipped.

You can only assign roles you could assign by hand

The same rules apply as for a single invitation. If you do not hold the permission.grant permission, or a role includes permissions you do not hold yourself, that role is left off and the row is marked Check.

First Sign-In for New Accounts

A new account has no password that anyone knows. The person sets their own on the first visit: go to the sign-in page, click Forgot password?, enter their email, and follow the emailed link. Put this in the instructions you give out.

Download the list. Click Download list for a CSV file with one row per person, including a link to the password page with their email already filled in. Use it as the data source for a mail merge.

Print QR code cards. Click Print QR code cards for a printable sheet with one card per new account. Each card's QR code opens the password page with that person's email filled in. Print the sheet, or save it as a PDF, then cut the cards apart and hand them out. The QR codes are drawn in your browser, so nothing is sent to another service.

Managing Roles & Permissions

Viewing a User

Click any active user row in the Users list to open their detail page. You'll see:

• User Info — email, display name, status, member since date, and last active timestamp.
• Roles — the roles currently assigned, with the ability to add or remove roles.
• Individual Permissions — a full permission grid organized by category. Permissions inherited from a role are shown as checked and disabled, with a label indicating which role grants them.

Assigning Roles

1. Open the user's detail page
2. In the Roles section, click Add Role
3. Select from the available roles (Store Owner is not assignable — there can only be one per organization)
4. Click Save Changes at the bottom of the page

You can assign multiple roles to a single user. Permissions are additive — if two roles both grant the same permission, removing one role won't revoke that permission as long as the other role still provides it.

Granting & Revoking Individual Permissions

1. Open the user's detail page
2. In the Individual Permissions section, check or uncheck permissions
3. Permissions already provided by a role appear locked with a "via Role Name" label
4. Click Save Changes

important

You can only grant permissions that you yourself hold. Store Owners are exempt from this restriction and can grant any permission.

Changes take up to 10 seconds to apply everywhere

To keep the app fast, Printago reuses each user's permissions and organization membership for up to 10 seconds before checking them again. When you change a user's roles or permissions, or remove them from the organization, it can take up to 10 seconds before every one of their requests uses the change. API keys are not affected: changes to a key apply immediately.

Removing a User

At the bottom of a user's detail page, the Danger Zone section includes a Remove User button. Removing a user:

• Revokes all roles and permissions
• Removes them from the organization
• Does not delete their Printago account — they can still be re-invited later

Access ends within 10 seconds of removal (see the note above).

If the user being removed is the Store Owner, you must transfer ownership to another member before proceeding.

Browse As User

Browse As User lets administrators experience the application exactly as another team member sees it — with that user's roles and permissions applied. This is invaluable for troubleshooting access issues, verifying that a new role assignment works correctly, or auditing what a given user can see and do.

Who Can Use It

Browse As User is available to:

• Store Owners — can browse as any user in the organization
• Users with both Permission Grant and Permission Revoke — can browse as non-owner users

How It Works

1. From the Users list, click the eye icon on any user row — or open a user's detail page and click Browse as User in the header
2. You'll be redirected to the dashboard, now viewing the app through that user's permissions
3. An amber banner appears at the top of every page showing whose perspective you're viewing
4. While browsing, you can open the permissions drawer to adjust the user's roles and permissions in real-time
5. Click Exit & Save to persist any permission changes you made, or Exit to discard them

warning

While browsing as another user, you are subject to their permission restrictions. Pages and actions they cannot access will be hidden or blocked for you as well. This is by design — it gives you an authentic view of their experience.

Related Topics

• Roles & Permissions List — complete reference of all roles and individual permissions
• API Keys — create scoped API keys with specific permission subsets

Need help with user management? Join our Discord community for support and tips from other users!