Users & permissions

Roitrack supports multiple logins with different levels of access — for a media buyer who should see their own campaigns, a VA who shouldn’t see payouts, or a partner who needs read access.

Roles

Role	Can do
Owner	Everything, including licence management. Exactly one per install, and it can’t be deleted or demoted.
Admin	Everything except taking ownership: all campaigns, all settings, all users.
Manager	Manages users and campaigns within their groups, but cannot create or edit admins, and cannot promote anyone to admin.
User	Works inside the groups they’re assigned to.

The owner restriction is deliberate: it guarantees the install can’t be locked out by an admin removing everyone else’s access.

Groups

Groups control which campaigns a user can see. Assign a user to one or more groups and their reports, campaign lists, and analytics are filtered to those groups everywhere in the dashboard — not just hidden in the UI, but filtered server-side.

The common patterns:

• One group per buyer, so each sees only their own campaigns
• One group per client, for agency work where clients must never see each other
• One group per vertical, when different people run different offer types

Admins and owners see everything regardless of group.

Changing roles takes effect immediately

When you change someone’s role, permissions, or groups, their existing session is invalidated on the next request — they don’t keep elevated access until their token expires. Revoking access is immediate, which is what you want when someone leaves.

The flip side: a user who is mid-task gets logged out. Warn them, or make the change out of hours.

Recovering a lost admin password

If you can still log in, change it in Settings → Users. That’s the route to prefer — it keeps everything in step.

Locked out completely? Message @roitrack on Telegram and we’ll reset it with you. We’ll ask you to confirm you own the server first, then you set the new password yourself — we never generate one for you or ask you to send us one.

Security notes

• The dashboard should be on its own domain. Separating admin from tracking means a burned tracking domain never costs you access to your own tracker. See Domains & SSL.
• Give the narrowest role that works. Most people who need to look at numbers need user plus a group, not admin.
• Remove leavers rather than sharing logins. Shared credentials make the audit trail useless and can’t be revoked individually.