Users & Accounts

Accounts organize your data; Users control who can access it.

Accounts

An Account groups related data — Security Groups, API Keys, Forms — into a logical unit: a project, a department, a client, or any other boundary that makes sense for how you run Sentinel.

Creating an account. Admins create new accounts, then assign Users to them (see below).

Configuration:

• Default Accounts — automatically assign newly created users (added manually or via SSO) to one or more accounts.
• Status — setting an account to inactive suspends all of its API Keys and Forms.
• Features — selectively disable Alerts, Logs, Forms, Redirects, or Training Data per account; disabled features return 403 on any attempt to use them.

Users

Sentinel is a multi-user application built for team collaboration. Each user has a role, assigned per account:

• Admin — full access to that account's data.
• Member — read and limited write access, but only to Forms, Redirects, and Training Data.
• Read-only — view-only access to Forms, Redirects, and Training Data.

Role permissions

	Admin	Member	Read-only
Security Groups	Full access	No access	No access
API Keys	Full access	No access	No access
Alerts	Full access	No access	No access
Logs	Full access	No access	No access
Dashboard	Full access	Limited*	Limited*
Forms	Full access	Full access	Read-only
Redirects	Full access	Full access	Read-only
Training Data	Full access	Full access	Read-only
Users, Accounts, Threat Intelligence	No access	No access	No access

* Limited dashboard access restricts filtering options, such as which API key's data you can view.

Adding a user

1. Go to Admin → Users → Create User.
2. Enter a unique username.
3. Optionally enable Root privileges.
4. Set a password.
5. Select which accounts the user should access, and assign their role for each.
6. Confirm to create the user.

Multi-factor authentication (MFA)

Each user can enable MFA independently:

1. Log in and open the user menu (top-right).
2. Select Enable MFA.
3. Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, and Okta Verify are all supported.
4. Verify with a one-time code, then confirm.

Enabling MFA logs the user out for the change to take effect. If a user loses access to their authenticator device, an administrator can disable MFA for them from User Management.

JWT tokens

Users authenticate with a JWT stored in a secure cookie. If a user's device is compromised, invalidate their existing sessions from the Users admin panel: open the user's More menu and select Invalidate JWT. This regenerates the user's jwtVersion value, which immediately invalidates every JWT issued to them so far — they'll need to log in again.

SSO

For centralizing login through your identity provider instead of managing passwords in Sentinel directly, see SSO.