Invite people and SSO
Under single sign-on an invitation does not create an account. It grants a role to an email address, and the person signs in with their own AdPix Account. Knowing that difference answers most of the "I invited them and they see nothing" questions.
Identity lives elsewhere, access lives here#
AdPix separates the two deliberately:
- Identity — who you are, your password, your sign-in — is held by the AdPix Account.
- Access — what you can see — is held by this product, as a membership on an organization, an account or a property.
The consequence for you is that "inviting someone" is really granting a role to an email address, not creating a user account for them. If that address never signs in, the grant sits dormant; if they sign in with a different address, the invitation never reaches them.
The mechanics of sign-in and sessions are covered in single sign-on and sessions and are not repeated here.
Two buttons, two different outcomes#
Both access panels — Property access management and Account access management — carry a Member email field, a Role list and two buttons:
| Button | What happens | Sends an email? |
|---|---|---|
| Add | The membership is created immediately and the row appears in the member list at once, even if the person has never signed in to AdPix | No |
| Invite by email | An invitation is recorded and the accept link is sent to that address | Yes |
The end state of both is identical: a membership with that role at that level. The difference is only that Add is silent and Invite by email tells the person.
The panel steps and how to revoke access are in invite people; this page is about the life cycle of the invitation itself.
What an invitation actually is#
Invite by email records a real row, not just an email. That row locks four things together:
| What is recorded | Why it matters |
|---|---|
| The email address | The invitation is bound to it and cannot be transferred to another address |
| The scope (property or account) | Access applies at exactly that level and everything beneath it |
| The role | The one you picked in the list |
| The accept token | Only a hashed form is stored; the token itself is never kept in the database |
An invitation lives for seven days from creation. After that the accept link is no longer valid and you have to invite again.
The grant ceiling applies here too: you cannot invite a role above your own effective rank at that scope. An invitation is not a way around it — see roles and capabilities.
After you select Invite by email, the panel also prints the accept link on screen. That link carries the invitation token; anyone who opens it can activate that role for that email address. If you copy it to send another way, treat it like a password and keep it out of shared channels.
Under SSO, no password is created#
If your organization signs in with an AdPix Account — the default — accepting an invitation mints no local credential. The path is:
Two practical consequences worth knowing:
- Step four does not depend on opening the link. If they never saw the email but signed in to the console with that same address for any other reason, their pending invitations are applied right there.
- Several invitations are applied together. If you sent one address invitations on several properties, all of them become memberships on that single first sign-in.
If local sign-in (the operator break-glass mode) is enabled instead, the same accept page asks for Your name and a password of at least eight characters, then sends the person to the sign-in page. Most organizations do not run in that mode.
An invitation you sent cannot be pulled back from the console#
Know this limit before you send:
- An unaccepted invitation is not a membership, so it does not appear in the member list.
- The console today has neither a list of pending invitations nor a cancel button.
- Its only end is the seven-day expiry.
If you sent one by mistake and are worried it will be accepted, the practical move is to wait, and remove the row from the member list the moment it appears there.
When an invitation does not work#
| Symptom | What happened | What to do |
|---|---|---|
| The page says the invitation is invalid or expired | More than seven days passed, or this invitation was already accepted | Invite again |
| They signed in but see nothing | They signed in with a different email address | Have them sign in with the address you invited, or send a fresh invitation to their real address |
| No email arrived | Email delivery is outside the console's control | Send them the accept link the panel displays, another way |
| It says their account has been disabled | An AdPix platform administrator disabled the account, and accepting an invitation does not undo that | Contact support |
| They are in the member list but see no reports | Their role is below the action, or the feature is tied to that property's plan | Check roles and capabilities |
What removing a member does not do#
Removing a member from one level only takes away their access at that level. Their AdPix Account, their ability to sign in, and their memberships at other levels are untouched, and no data is deleted.
To leave someone with no access anywhere in the organization, remove every membership they hold, at every level. Closing an account entirely at the platform level is an AdPix platform administrator's action.
Anyone added or invited from an access panel, whatever their role, sees no raw events and gets user identifiers masked — unless their role is Property admin or above, in which case they see their own business's identifiers. The full rule is in roles and data restrictions.
Next#
Before inviting a whole team, read roles and capabilities once, so the role you pick is the role you meant — changing it later is easy, but over-granting is not as easy to notice.
Frequently asked questions#
How long is an invitation valid?
Seven days from the moment it is created. After that the accept link stops working and you have to invite again. Until it is accepted the invitee does not appear in the member list.
Can I cancel an invitation I already sent?
Not from the console — an unaccepted invitation is not a membership, so it does not appear in the member list and has no cancel button. It expires by itself after seven days. If the person accepts before it expires, remove their new membership from the access panel.
Does the person need to sign up for AdPix first?
No. If they have an AdPix Account they just sign in; if they do not, they create one on the way in. The only requirement is that they sign in with the same email address you invited.
Why does the accept page not ask me for a password?
Because your organization signs in with an AdPix Account. Under single sign-on no local password is created: the accept page offers Continue with AdPix Account and a Decline link, and access is applied on that first sign-in.
Thanks — your feedback helps us improve the docs.