User Management & Permissions

Control who can access your workspace and what they can do with different permission levels.

Aqui Aca uses a role-based permission system to control access to your workspace. Understanding these access levels helps you maintain security while giving your team the right level of access to manage attendance effectively.

Access Levels

Every user in your workspace has one of three access levels that determine what they can see and do:

Owner

Full administrative access - The workspace creator with complete control.

  • • Manage all workspace settings and configuration
  • • Invite, modify, and remove team members
  • • Take attendance and manage all student data
  • • Access all reports and export data
  • • Cannot be deleted by other users

Admin

Administrative privileges - Can manage the workspace and take attendance.

  • • Take attendance and modify student status
  • • Manage students, groups, and contacts
  • • Invite and manage other users (except owners)
  • • Access all reports and analytics
  • • Configure tags and closures

Standard

View-only access - Can see data but cannot make changes.

  • • View student attendance and status
  • • See student and contact information
  • • Access reports and analytics (read-only)
  • • Cannot take attendance or modify data
  • • Cannot manage other users or settings

Adding Team Members

1
Navigate to Team Settings

Go to Settings → Team in your workspace.

2
Click "Invite User"

Enter the person's full name and email address.

3
Choose Access Level

Select whether they should be an Admin or Standard user.

4
Send Invitation

The user will be added to your workspace and can log in immediately.

Access Level Guidelines

  • • Use Admin for: Teachers, administrators, and staff who need to take attendance
  • • Use Standard for: Substitute teachers, observers, or anyone who only needs to view data

Managing Existing Users

Changing Access Levels

  • • Go to Settings → Team to see all workspace users
  • • Click the dropdown next to a user's name to change their access level
  • • Changes take effect immediately - no restart required

Removing Users

  • • Click the "Delete" button next to a user's name
  • • Type their email address to confirm removal
  • • Removed users lose access immediately but data they created remains
  • • Owners cannot be deleted by other users

Important Security Notes

  • • Only give Admin access to trusted staff members who need to manage attendance
  • • Standard users can see all student data, so consider this when inviting observers
  • • Removed users cannot access your workspace, but you may want to change any shared passwords

Domain Restrictions

You can restrict who can be invited to your workspace by configuring allowed email domains.

Setting Up Domain Restrictions

  • • Go to Settings → Security in your workspace
  • • Add your school or organization's email domains (e.g., "myschool.edu")
  • • Only users with email addresses from these domains can be invited
  • • This helps prevent accidental invitations and improves security
Example

If you add "lincolnelementary.edu" as an allowed domain, you can only invite users with email addresses like "teacher@lincolnelementary.edu" or "principal@lincolnelementary.edu".

Automatic Access for School Email Addresses

Your workspace can be configured to automatically give Standard (view-only) access to anyone with your school's email address, without requiring explicit invitations.

  • • Enable "Just-in-Time Provisioning" in Settings → Security
  • • Anyone with an allowed domain email can log in and automatically get Standard access
  • • They will only have view-only permissions - they cannot take attendance or modify data
  • • This is perfect for substitute teachers, observers, or new staff who need immediate access
How This Works

Example scenario: Lincoln Elementary has "lincolnelementary.edu" as an allowed domain with automatic access enabled.

  1. 1. A substitute teacher gets hired with email "substitute@lincolnelementary.edu"
  2. 2. They visit Aqui Aca and log in with their school email
  3. 3. The system automatically creates their account with Standard access
  4. 4. They can immediately view student data and attendance without waiting for an invitation

API Keys

Users can create personal API keys for integrating Aqui Aca with other systems or automating tasks. API keys have the same permissions as the user who creates them, so they can access data and perform actions based on their access level.

Creating API Keys

  • • Go to your Account → API Keys page
  • • Click "Create API Key" and give it a descriptive name
  • • Copy the key immediately - it won't be shown again
  • • API keys inherit your access level and workspace permissions

API Key Security

Treat API keys like passwords. Store them securely and don't share them. Delete any keys you're no longer using.

Best Practices

  • ✓ Principle of least privilege: Give users the minimum access level they need
  • ✓ Regular review: Periodically review your team list and remove users who no longer need access
  • ✓ Use descriptive names: When inviting users, use their full names so they're easy to identify
  • ✓ Admin for attendance takers: Only give Admin access to people who actually need to take attendance
  • ✓ Standard for observers: Use Standard access for substitutes, student teachers, or administrators who only need to view data

← Back to Guides