How it works
Roles and permissions
Courier has six built-in roles. Each sets read/write access and how much of the message logs a member sees:- No logs: the Logs page is empty.
- Timeline only: the message list and each message’s timeline, with the event details blank.
- Full logs: adds the event details, which hold the request data (including PII) and provider responses. Members can also resend and archive messages.
To give Designers or Analysts log access, create a custom role with the
message scopes below.
Administrators assign roles from Settings → Team. When no built-in role fits, define custom roles from granular scopes (template:WriteItem, message:ReadEventDetails, brand:WriteItem, and so on).
Any role other than Administrator, and any custom role, requires the Enterprise plan.
On the Developer and Business plans, every teammate is an Administrator. An invite or API call that sets any other role is rejected.
On the Developer and Business plans, every teammate is an Administrator. An invite or API call that sets any other role is rejected.
Custom role scopes
A custom role is a set of scopes. Each scope is a resource and an action,template:WriteItem.
A resource:* wildcard grants every action on that resource, so template:* covers listing,
reading, and writing Templates.
Platform scopes cover the notification product itself.
Account-management scopes cover the workspace rather than what it sends.
message:ReadEventDetails is the one to grant deliberately. It exposes the request data
on a message, which includes whatever PII the send carried. message:ListItems and
message:ReadItem alone give a timeline-only view, and adding message:ReadEventDetails fills
in the event details.
Inviting and removing members
Invite teammates from Settings → Team: click Invite User, enter their email, and pick a role. Remove a member from the dropdown next to their email. Okta workspaces can also let members join through workspace discoverability (below). The Developer plan caps pending invites at 10. Accept or revoke one before sending more. Business and Enterprise have no cap.Single sign-on
Google SSO, GitHub SSO, and Okta SSO let your team authenticate through your identity provider. Require SSO to disable password login. SCIM directory provisioning creates, updates, and deactivates users from your directory.- Google and GitHub SSO: available on every plan, including Developer. Require login from your configured domains under Settings → Team.
- Okta SSO and SCIM: connect Courier as an app in Okta for sign-in and directory sync. Both are commercial features. Contact Courier to enable them for your workspace.
Workspace discoverability
A workspace that signs in through Okta can let people with an approved email domain join without an invite. Every other workspace adds people by invitation only. Google and GitHub SSO still work on every plan. On an Okta workspace, confirm your domain is in the approved list under Settings → Team, then choose a level:- Request access: an approved-domain user requests, an admin approves.
- Join directly: an approved-domain user joins without approval.
- IT admin only: members are added manually, used with Okta provisioning.
FAQ
Can I add roles other than Administrator?
Can I add roles other than Administrator?
On the Enterprise plan, yes: assign any of the six built-in roles or define custom roles. On Developer and Business, every member is an Administrator.
Do you support Okta and SCIM?
Do you support Okta and SCIM?
Courier supports Okta SSO and SCIM directory provisioning. Both are enabled commercially rather than by a plan toggle, so contact Courier to turn them on.
What can each role see in logs?
What can each role see in logs?
Each role sees no logs, a timeline-only view, or full logs with event details. Designer and Analyst see no logs. Developer sees the timeline only in Production and full logs in Test. Administrator, Manager, and Support Specialist see full logs.