Team, roles & two-factor auth

One login per human, least privilege per login. Shared passwords are how audit trails die.

Inviting your team

Settings → Team → Invite. Each member gets their own login with a role:

• Admin — everything, including billing and team management.
• Editor — build and send: campaigns, journeys, templates, audiences.
• Viewer — read-only: analytics and content, no sending, no exports of PII.

Invites expire after 7 days and can be re-sent. Changing someone's role applies on their next request; removing a member kills their sessions immediately (session-epoch revocation — no "still logged in on the old laptop" problem).

Two-factor authentication

TOTP-based MFA (Google Authenticator, 1Password, etc.): Account → Security → Enable MFA shows a QR code; confirming one code activates it (POST /v1/auth/mfa/setup → /confirm). Admins can require MFA for the whole account — with it on, no member can sign in without a second factor.

API keys are not people

Machines use API keys, humans use logins. Keys can be rotated with a 24-hour grace window (POST /v1/account/keys/:id/rotate) — the new key works immediately, the old one keeps working for a day while you roll deployments, then dies. Rotate on any suspicion and on every offboarding of someone who had production access.

Audit trail

Account changes — role edits, key creation, pricing changes, GDPR actions — are logged with actor and timestamp. When something changed and nobody remembers changing it, the answer is in Settings → Audit log.