Settings & team

The settings section covers everything about you and your team: your profile and security, the accounts you belong to and who's in them, and the developer credentials your account exposes to other systems. Settings pages share a second sub-sidebar with three groups — Account (Profile, Password, Connected Accounts), Organization (Accounts), and Developer (API, Integrations, Webhooks — visible to account admins only).

Profile

Your profile page holds the basics:

Account deletion

There is no self-service account deletion. The "Cancel my account" control is reserved for system administrators; everyone else sees: "Accounts can't be deleted from here. Please contact support to close your account."

Password & two-factor

The password page asks for your current password plus the new password and its confirmation.

The same page carries the two-factor authentication section. Enabling it walks you through: generate and save your backup codes, then scan the QR code with an authenticator app and verify a code to confirm the pairing. Once enabled, the same section lets you disable it. Members with two-factor enabled get a shield marker next to their name in the member table.

Accounts

The Accounts index lists every account you belong to — each with its avatar, a Personal badge where applicable, its member count, and either a Switch button or a Current Account badge for the one you're in. Admins can create additional team accounts with Create an Account; a new sign-up gets a team named "{name}'s Team" automatically.

An account's page

Opening an account shows its members and pending invitations, with the page actions in the header band: Switch, Edit Account, and — on team accounts, for admins — Invite A User.

The member table shows, per member:

• User — avatar and name, "(you)" on your own row, and a shield icon when two-factor is enabled
• Email
• Roles
• Edit — visible to admins

Roles

There is exactly one role: admin. Everyone without it is implicitly a member. Admins can download ISOs and manage device tokens, mint API tokens, configure integrations and webhooks, and manage the account itself (edit, invite, transfer); members get the dashboard, inventory, wipes, certificates, changelog, notifications, and their own profile settings.

The account owner's admin checkbox is disabled — the "role cannot be removed for the account owner."

Invitations

Inviting someone sends them an email: "{inviter} invited you to {account}". The recipient lands on a "Join {account}" page with Accept and Decline. Until they respond, the invitation sits in the account's pending list with an Awaiting response badge and three actions: Resend, Copy link (hand the invite URL over any channel you like), and Edit.

Because sign-up is invitation-only, this flow is also how brand-new users get their AVERASE login — accepting the invitation is what creates the account for someone who doesn't have one yet.

Transfer ownership

An account can be handed to another member. The confirmation reads: "Are you sure you want to transfer this account?"

API tokens

API tokens authenticate external systems against the public API. They live under the Developer group and are admin-only.

Tokens are account-owned, not personal: any admin of the account can create or revoke any of them, and each token reads exactly this one account's data — nothing else, regardless of which admin minted it.

• Index — every token with its Name, Created by, Last Used, and Created columns.
• New — a single field: Token Name. Name it after the system that will hold it (for example, the integration or auditor it's for).
• Show — the secret, in a blurred click-to-copy block, together with a usage example:

GET /api/v1/me.json
Accept: application/json
Authorization: Bearer <token>

The token page's header band carries Edit and Revoke. Revoking asks: "Are you sure you want to revoke this API token?" — revocation is immediate, and any system still holding the token starts receiving 401 on its next request.

Developer settings

The Developer group in the sub-sidebar gathers the three pages that connect AVERASE to other systems — all admin-only:

• API — the account's API tokens, covered above.
• Integrations — first-party connections such as RazorERP. See Integrations.
• Webhooks — push wipe and certificate events to your own endpoints as they happen. See Webhooks.