# Invite people and SSO

Under single sign-on an invitation does not create an account. It grants a role to an email address, and the person signs in with their own AdPix Account. Knowing that difference answers most of the "I invited them and they see nothing" questions.

## Identity lives elsewhere, access lives here

AdPix separates the two deliberately:

- **Identity** — who you are, your password, your sign-in — is held by the AdPix Account.
- **Access** — what you can see — is held by this product, as a membership on an organization, an account or a property.

The consequence for you is that "inviting someone" is really **granting a role to an email address**, not creating a user account for them. If that address never signs in, the grant sits dormant; if they sign in with a different address, the invitation never reaches them.

The mechanics of sign-in and sessions are covered in [single sign-on and sessions](account/sign-in/single-sign-on-and-sessions) and are not repeated here.

## Two buttons, two different outcomes

Both access panels — **Property access management** and **Account access management** — carry a **Member email** field, a **Role** list and two buttons:

| Button | What happens | Sends an email? |
| --- | --- | --- |
| **Add** | The membership is created immediately and the row appears in the member list at once, even if the person has never signed in to AdPix | No |
| **Invite by email** | An invitation is recorded and the accept link is sent to that address | Yes |

The end state of both is identical: a membership with that role at that level. The difference is only that **Add** is silent and **Invite by email** tells the person.

The panel steps and how to revoke access are in [invite people](account/teams/invite-people); this page is about the life cycle of the invitation itself.

## What an invitation actually is

**Invite by email** records a real row, not just an email. That row locks four things together:

| What is recorded | Why it matters |
| --- | --- |
| The email address | The invitation is bound to it and cannot be transferred to another address |
| The scope (property or account) | Access applies at exactly that level and everything beneath it |
| The role | The one you picked in the list |
| The accept token | Only a hashed form is stored; the token itself is never kept in the database |

An invitation lives for **seven days** from creation. After that the accept link is no longer valid and you have to invite again.

The grant ceiling applies here too: you cannot invite a role above your own effective rank at that scope. An invitation is not a way around it — see [roles and capabilities](analytics/admin/roles-and-capabilities).

> **The accept link is a key**
>
> After you select **Invite by email**, the panel also prints the accept link on screen. That link carries the invitation token; anyone who opens it can activate that role for that email address. If you copy it to send another way, treat it like a password and keep it out of shared channels.

## Under SSO, no password is created

If your organization signs in with an AdPix Account — the default — accepting an invitation mints no local credential. The path is:

1. The person opens the accept link and sees the **Accept your invitation** page, with the product name and the role you set aside for them.
2. The page has one button, **Continue with AdPix Account**, and a **Decline** link under it. There is no password field.
3. They sign in with their AdPix Account — or create one on the way through if they have none.
4. On that first sign-in, AdPix turns every pending invitation for their email address into a real membership and marks each one accepted.
5. They land in the console with access already in place.

Two practical consequences worth knowing:

- **Step four does not depend on opening the link.** If they never saw the email but signed in to the console with that same address for any other reason, their pending invitations are applied right there.
- **Several invitations are applied together.** If you sent one address invitations on several properties, all of them become memberships on that single first sign-in.

If local sign-in (the operator break-glass mode) is enabled instead, the same accept page asks for **Your name** and a password of at least eight characters, then sends the person to the sign-in page. Most organizations do not run in that mode.

## An invitation you sent cannot be pulled back from the console

Know this limit before you send:

- An unaccepted invitation is **not a membership**, so it does not appear in the member list.
- The console today has neither a list of pending invitations nor a cancel button.
- Its only end is the seven-day expiry.

If you sent one by mistake and are worried it will be accepted, the practical move is to wait, and remove the row from the member list the moment it appears there.

## When an invitation does not work

| Symptom | What happened | What to do |
| --- | --- | --- |
| The page says the invitation is invalid or expired | More than seven days passed, or this invitation was already accepted | Invite again |
| They signed in but see nothing | They signed in with a different email address | Have them sign in with the address you invited, or send a fresh invitation to their real address |
| No email arrived | Email delivery is outside the console's control | Send them the accept link the panel displays, another way |
| It says their account has been disabled | An AdPix platform administrator disabled the account, and accepting an invitation does not undo that | Contact support |
| They are in the member list but see no reports | Their role is below the action, or the feature is tied to that property's plan | Check [roles and capabilities](analytics/admin/roles-and-capabilities) |

## What removing a member does not do

Removing a member from one level only takes away their access at that level. Their AdPix Account, their ability to sign in, and their memberships at other levels are untouched, and no data is deleted.

To leave someone with no access anywhere in the organization, remove every membership they hold, at every level. Closing an account entirely at the platform level is an AdPix platform administrator's action.

> **A new member starts with the least data access**
>
> Anyone added or invited from an access panel, whatever their role, sees no raw events and gets user identifiers masked — unless their role is Property admin or above, in which case they see their own business's identifiers. The full rule is in [roles and data restrictions](concepts/governance/roles-and-data-restrictions).

## Next

Before inviting a whole team, read [roles and capabilities](analytics/admin/roles-and-capabilities) once, so the role you pick is the role you meant — changing it later is easy, but over-granting is not as easy to notice.

## Frequently asked questions

### How long is an invitation valid?

Seven days from the moment it is created. After that the accept link stops working and you have to invite again. Until it is accepted the invitee does not appear in the member list.

### Can I cancel an invitation I already sent?

Not from the console — an unaccepted invitation is not a membership, so it does not appear in the member list and has no cancel button. It expires by itself after seven days. If the person accepts before it expires, remove their new membership from the access panel.

### Does the person need to sign up for AdPix first?

No. If they have an AdPix Account they just sign in; if they do not, they create one on the way in. The only requirement is that they sign in with the same email address you invited.

### Why does the accept page not ask me for a password?

Because your organization signs in with an AdPix Account. Under single sign-on no local password is created: the accept page offers Continue with AdPix Account and a Decline link, and access is applied on that first sign-in.

## Related

- [Invite people to your team](https://docs.adpix.io/en/account/teams/invite-people/)
- [Single sign-on and sessions](https://docs.adpix.io/en/account/sign-in/single-sign-on-and-sessions/)
- [Roles and capabilities](https://docs.adpix.io/en/analytics/admin/roles-and-capabilities/)
- [Roles and data restrictions](https://docs.adpix.io/en/concepts/governance/roles-and-data-restrictions/)

---

[Docs](https://docs.adpix.io/en/analytics/admin/invite-people-and-sso/) · AdPix