Giving somebody access

You can let other people look at, or work in, your account without sharing your password. You invite them at their own email address, choose what they may do, and change or withdraw that later.

Never share your own login. An invitation is always better: you can see who has been in, you can take somebody out again, and they use their own password and their own two-factor authentication.

Inviting somebody

1. Go to Access in the menu and open your customer name.
2. Under Give somebody access, fill in the email address.
3. Pick a role (what each one may do is below).
4. Optionally pick an end date: 24 hours, 7 days, 30 days, or none.
5. Click Send invitation.

They get an email with a link. The link is valid for 7 days and can be used once.

You never create a user here yourself. If the address already has a login with us, your account is added to it. If it does not, the person chooses their own password. You are not shown which of the two it was — deliberately: otherwise this screen would be a way of finding out which email addresses are known to us.

The roles

Everybody may always manage their own password and two-factor authentication. You cannot switch that off, and that is on purpose: somebody else's account security should not depend on you.

You can change a role later in the list under Access. It takes effect immediately, even if that person is signed in at the time.

Temporary access

Giving an agency or a contractor access for one job? Set an end date. Once that date has passed the access stops working immediately — on their very next click. There is nothing to clean up and nothing to remember.

The entry is kept, so you can still see later who did what and when. If you want to give somebody longer after all, just pick a new end date; that makes the access live again.

Withdrawing access

Click Withdraw next to the name. That person is out straight away and gets an email saying the access has ended. Their login still exists — only your account has been taken out of it.

Open invitations

Below the list are the invitations that have not been used yet.

• Send again sends the mail once more, with a new link. The old link stops working.
• Withdraw makes the link invalid.

Transferring ownership

There is always exactly one owner. Closing the business, or handing it to a colleague? Then you transfer ownership — in two steps, so it can never happen by accident:

1. You designate somebody who already has access (under Transfer ownership). You confirm with your own password — and with your code if you use two-factor authentication.
2. They get an email and confirm themselves.

Ownership only changes hands after that second step. You then become Full management, or you are removed entirely — you choose that in step 1. As long as the other person has not confirmed, nothing changes.

While a transfer is pending you can withdraw it, and the other person can decline it. After 7 days without an answer the designation lapses on its own.

The same list from the command line

If you run a panel yourself and want to check a customer's access without signing in, the API answers exactly what the screen shows:

curl -sS -H "Authorization: Bearer $CORECP_API_KEY" \
  https://panel1.corecp.dev/api/v1/customers/web1/members | jq '.[] | {email, profile, expires_at}'

{"email":"anna@test100.nl","profile":"owner","expires_at":null}
{"email":"agency@example.com","profile":"technical","expires_at":"2026-09-01T00:00:00Z"}

Open invitations are under /api/v1/customers/web1/invitations.

What gets recorded

Every action is recorded with who did it, from which IP address and when — including the actions that were refused. As the owner you can see that per person, so you can always check what an agency or a colleague has been doing.

Common questions

I invited somebody but they got no mail. Check their spam folder first. If the address is right, click Send again; that sends a fresh link. If it keeps failing, contact your provider — they can see in the system whether the message was sent and what went wrong.

Can somebody with two accounts use one login? Yes. One person, one password, several accounts. Somebody who already signs in with us and gets an invitation only has to confirm; no second account is created.

I was invited at my work address but I sign in with a different one. That is fine. Sign in with the login you have and open the link again; it is attached to that login.

Can I forward the link? Better not. For seven days that link is worth as much as a password: whoever holds it can take the access. Invite the right address instead.