User management

Vaultigen is invite-only. There is no public registration. Super Admins manage accounts under System → Users and teams under System → Teams.

Inviting users

1. Open System → Users and choose Invite user.
2. Enter the email address and, optionally, platform roles.
3. Vaultigen emails a single-use link that expires after 24 hours.

The recipient opens the link, verifies the email address, chooses a password and enrolls an allowed second factor before they can open a vault. Inviting the same address again replaces the previous pending invitation.

The Recent invitations list shows each invitation’s status (pending, accepted, expired, cancelled) and delivery state. From there you can:

• Resend: emails a fresh link; the previous link stops working immediately.
• Cancel: the link stops working immediately and the invitation no longer occupies a seat.

If an invitation was created but the email could not be sent, check the mail configuration and use Resend.

Seats and the user limit

Every active user and every open invitation occupies a seat. The free edition allows 10 seats; your license may allow more or unlimited users. The Users page shows how many seats are in use.

When no seat is free, Vaultigen refuses to add another user: new invitations, accepting an older invitation and reactivating an account are blocked, and the refusal appears in Activity as “User limit reached”. Existing users are never restricted. To free a seat, deactivate a user or cancel an open invitation. See Licensing.

Teams

A team is a group of users that can receive vault, folder or entry grants as a whole. Adding someone to a team gives them exactly the access the team already has, immediately. Removing them takes that access away, immediately. Access granted directly to the user is unaffected.

Create teams under System → Teams, then use Manage team to rename it and add or remove members.

Platform roles

Platform roles are installation-wide and never grant access to secrets:

Role	Can
Super Admin	Manage users, teams, settings, backups, keys, imports and vault shells. Reads no secrets without a vault grant or the audited emergency access.
Auditor	Read the audit log and authorized metadata.
Vault creator	Create new vaults, nothing else.

Assign roles when you invite a user or later from the user’s actions. Vault access is managed separately, inside each vault. See Roles and permissions.

Resetting a user’s second factor

When a user loses their phone or can no longer receive codes, a Super Admin uses Reset authentication in the user’s actions. The reset:

• requires the admin’s own password and a fresh second-factor code,
• requires a written reason (never put a password in it),
• revokes all of the user’s sessions, remembered devices and recovery codes,
• notifies the user, and forces them to enroll a factor again before they can open a vault.

Users with the authenticator app should try one of their recovery codes first. Email-only accounts have no recovery codes, so they always need an admin reset.

Deactivating and reactivating

Deactivate signs the user out everywhere: sessions and remember tokens are revoked, and every further request is refused. Deactivated users do not occupy a seat. Reactivating needs a free seat.

When someone leaves the organization, use Offboarding instead of a plain deactivation. It also decides what happens to their vaults and lists the credentials they revealed.

Administrators cannot deactivate themselves or remove their own Super Admin role; another administrator has to do it.

Adding administrators from the command line

On the server, vaultigen:bootstrap creates an additional Super Admin:

php artisan vaultigen:bootstrap [email protected] --name="Second Admin"

On Docker Compose, run it inside the web container: docker compose exec web php artisan vaultigen:bootstrap [email protected] --name="Second Admin".

Keep at least two administrators so that one lost factor never locks you out of administration.