How to hand accounts to a contractor without the passwords

An account password is not one key but three. It opens the account, for many people it opens the recovery mailbox too, and it keeps working after the work is over.

The platform sees you rather than your contractor, and there is nothing to explain the picture with. Two logins to one account from two cities in a day are exactly the picture that sends an account for review.

1. 1

   The key to the account

   A password opens the whole account, not the part the work needs.

2. 2

   The key to recovery

   The same password often sits on the recovery mailbox, and then getting the account back leaves your hands.

3. 3

   A key with no expiry

   A password you sent lives in the chat until you change it, and the change throws everyone out.

Instead of a password you give the person a seat in your workspace. They make their own account, arrive on an invite code, and sign in with their own email and password.

The owner always holds one seat, so count colleagues from yourself. A plan hands out seats as a bundle, and extra ones are counted one by one. A seat beyond the plan costs $3 a month, an invite code lives 7 days, and you can revoke it before the person joins.

An invite code lives for seven days, and that period comes from one line on the server rather than being typed into the letter by hand. An expired code is refused the same way as an invented one, with one and the same answer.

An accepted code does not work a second time: an invitation carries an acceptance mark, and with it the invitation counts as used. Only an unaccepted invitation can be revoked; an accepted one is undone by removing the person from the team.

One person can belong to several teams and keeps their own workspace. Someone already on your team cannot join it a second time with a code, and the server says so outright.

A role is a rank, not a checklist, and an unknown role word has rank zero, so it passes no door. A higher one opens everything a lower one opens, and a role word the server does not recognise opens nothing.

For three accounts your contractor needs the lowest rank. It works the profiles they were given and stops at billing, the roster and the History screen.

The two lowest roles, operator and member, are equal in rank: both work with the profiles they were given and change nothing shared. A manager on top of that creates, edits and deletes the shared working things, groups and the proxy library, and does not touch money or the team.

An admin adds billing, the team roster, history, other people's profiles and devices. The owner opens everything and is the only one who cannot be removed.

A role covers the whole workspace at once, so by itself it cannot say «this person runs client A only». Groups do that: you tick the ones they may see, and their list shrinks to those.

The limit holds in two places at once, and there is no way around it through a request address. A profile outside their groups is invisible in the list and by its id, and a profile with no group is hidden too.

You share the profile itself, and the machine goes with it: fingerprint, pinned browser version, proxy and settings. The platform sees the same computer whichever side the account is opened from.

The account password is not among it, and a request carrying such fields is refused whole rather than trimmed quietly. A profile on the server has no column for cookies, for a login pair or for a one-time key, and a body carrying such fields is refused whole.

1. 1

   The machine travels

   Fingerprint, browser version, proxy and settings reach whoever you shared the profile with.

2. 2

   The login does not

   There is no login pair and no one-time key on the server at all.

3. 3

   Access comes back

   Revoke the share and the profile leaves their app at the next sync.

Two people opening one profile at once give the platform two live sessions of one account from two places. Your machines cannot see each other, so a profile carries one lock for everyone. The lock lives on the server: until the app is signed in it never asks for it and opens the profile.

Time holds that lock rather than a promise: while the window is open the app renews it every minute, and no admin has to be called. Pull the plug and 3 minutes later the profile opens again.

Every action worth arguing about leaves one row: who, what, when, and in whose workspace. There are 58 kinds of action, 6 of them about the team: invite, withdrawal, joining, role change, group access, departure. The admin and the owner read these rows on the History screen.

A departure cuts access both ways at once. The lock they held is lifted, the seat is freed by the same move, a second invite to the same address stops working, and the work profiles and your proxies stay with you.

There are four roads, and choosing between them is choosing what you risk, and none of the four is free. The table below names the price of each in one line.

For three accounts and one person take rows two and three together: a seat, the lowest role, one group and the profiles they need. Keep the file for when someone needs an account already open.