Users and Roles
Go to Settings > Team Members to add, delete, or modify users in your Chargebee account.
You can assign users different roles in your site. These roles define the level of access and job functions each user will have.
In other words, a role allows a user to perform specific tasks within your Chargebee site.
This article is for sites where Multi Business Entity (MBE) is not enabled. For MBE-enabled sites, refer to this section in the MBE overview article.
Creating a New User
You can create and add users to your Chargebee site, depending on your plan.
Note
- For pricing information, see the Plans and Pricing page.
- Chargebee user account passwords must be updated every 90 days, and the new password cannot match any of the last four passwords.
Click Invite Members to invite a user to your site.
Specify the role you want to assign to the new user (which defines their access level) before sending the invite.
The available user roles are:
- Tech Support
- Analyst
- Sales Agent
- Customer Support
- Sales Manager
- Finance Executive
- Developer
- Owner (automatically assigned to the creator of the site)
Each of these roles has specific restrictions. To give a user full access to your Chargebee site, select the Provide Full Access option when sending the invitation. These users are called admins in Chargebee.
Note
You can add custom roles to your Chargebee site. Click here to learn more.
The user will receive an email notification with a link to activate their account (or create one, if they have not signed up for Chargebee yet). Their account will remain in the Pending Invites list until they activate it.
Once you have created users, you can edit their profile at any time to change their role. You can also assign a user more than one role. For example, a user can be both a finance executive and a customer support user, and they will have access to the functionalities available for both roles.
Note
Users invited from the TEST site will not be able to access the LIVE site. You must explicitly invite users from the LIVE site if you want to give them access.
Changing Account Ownership
Chargebee supports transferring site ownership. The current owner can transfer ownership to another user, which is a permanent change that will reflect in both the TEST and LIVE sites (even if the LIVE site has not been enabled yet).
After ownership is changed, the previous owner's role will be restricted to admin in both the TEST and LIVE sites. If the LIVE site has not been enabled, the previous owner becomes the admin for the TEST site only.
Only the current owner can change account ownership, by selecting the Make Owner option next to each user listed on the Settings > Team Members page.
Note
- Account ownership can be changed from both the TEST and LIVE sites.
- Chargebee support is added to the TEST site by default and cannot be made the site owner, even if it appears in the list of users.
Enforce User Authentication Policy
When you have multiple users, enforce a strict authentication policy to secure your site. Chargebee allows you to configure authentication settings for your team.
To configure these settings, log in to your Chargebee site as an admin and go to Settings > Security.
Use the following options to enforce your authentication policy:
-
Mandatory sign-in via Google account: Require every user to log in using Google single sign-on. With this option, users cannot access the site without authenticating with their Google accounts. This is also helpful for secure access when a team member leaves your organization, so you do not have to remember to disable a user manually.
-
Mandatory sign-in via SAML: Require every user to log in using SAML. With this option, users authenticate using your organization's Identity Provider.
-
Mandatory sign-in using a six-digit code (Two-factor authentication): Require every user to log in using 2FA. With this option, users are prompted for a unique six-digit code (valid once) every time they sign in.
-
You can make both sign-in methods mandatory by enabling both options in the settings. In this case, every user must authenticate using both their Google account and a six-digit code to access the site.
For a detailed review of the 2FA feature and the sign-up steps, see our Two-Factor Authentication (2FA) page.
Custom Roles
If the predefined roles in Chargebee don't grant the privileges you want to assign to a user, you can create a custom role. Each custom role can include one or more privileges that let users with that role perform specific tasks as needed.
To add new customized user roles to your Chargebee account, contact support.
You can create custom roles and define actions as per your requirements. You can configure privileges in the following modules:
- Customers
- Subscriptions (Invoices, Credit Notes, Orders, Transactions, Email Logs, Events)
- Product Catalog (Plans, Addons, Coupons)
Note
- Available only in selected plans. To learn more, visit the Plans and Pricing page.
- Chargebee allows a maximum of 18 custom roles.
- You cannot control access to actions in the Settings. This is a work-in-progress item and will be released later.
The new customized user roles will be added along with Chargebee's predefined user roles. For example, in the image below, two custom user roles have been created: Custom Role 1 and Custom Role 2.
To assign a customized user role to a user, go to Settings > Team Members and assign the new role to the user.
You can assign more than one custom role to a user. If a user receives a permission error for an action, see the FAQ below.
FAQ
1. Why is a user blocked from an action when multiple custom roles are assigned?
If a user has multiple custom roles and receives a permission error for an action, it is likely because at least one assigned role explicitly denies that action.
When evaluating permissions across multiple roles, an action marked as not allowed in any role will override the same action being allowed in another role. In short, explicit denials always take precedence.
To resolve this:
- Review all roles assigned to the user.
- Identify any role where the required action is set to not allowed.
- Either remove the denial from that role or unassign the conflicting role from the user.
Ensure that none of the user's assigned roles explicitly restrict the required action.
Was this article helpful?