Skip to main content
Access in OTO answers two questions separately: what kind of user is this, and what is that particular person allowed to do. Getting the first right takes a moment; getting the second right is what stops a picker seeing your margins.

​
The two layers

​
User types

​
Role templates

A role template is a named set of permissions you define once and apply to as many people as you like, at Settings → Management → Role Templates. The list shows each template and how many users currently hold it, which is the number to look at before you change one. Add Template asks for a name and then presents the permission tree. It has three columns — Name, Type and Permission — and a search box, which you will want: the tree covers 22 top-level areas, from Shipments and Dashboard through Warehouses, Payments, OTO FLEX and Customer Service to Profile Settings.

​
Pages and actions

Every permission is one of two kinds, and the distinction is the useful part. The tree nests, so permissions get more specific as you go down. Shipments is a page; inside it Pending Orders is a page; inside that, With My Rates and Edit Order Admin are actions. Warehouses breaks down the same way into Add, Edit, View and Activate/Deactivate.
Separating seeing from doing is what makes least privilege practicalWithout it, access is all-or-nothing per screen, and the path of least resistance is to grant the whole screen to anyone who needs any part of it.With it, a customer-service agent can open an order and read its history without being able to edit it, cancel it or see what it cost you. That is the difference between a role you can hand out freely and one that needs a conversation first.

​
Assigning and adjusting

On the Users screen, the Roles menu carries three operations, and they do different jobs. A user holds one role template at a time. There is no stacking of templates, which keeps “what can this person do” answerable by looking in one place.
Has Custom Role is the column that keeps this honestThe user list carries a Has Custom Role flag showing everyone whose permissions no longer match their template. That is the audit answer to the question every access review asks.Permission drift is undramatic and cumulative: someone needs one extra action for one busy week, it is granted individually, and nobody takes it away. Filtering on this column periodically — and using Restore Roles on anyone whose exception has expired — is a five-minute habit that prevents a long afternoon before an audit.

​
Adding a user

Settings → Management → Users → Add User. On save, an invitation email goes out carrying a password reset link, and the new user chooses their own password. Nobody sets a password on someone else’s behalf, and no password travels by message. If the invitation is lost, an administrator can send the link again from the user’s Tools menu rather than issuing a password.

​
The user list

Every column filters, so “who has admin access”, “who is not on a template” and “who has no second factor” are all one filter away.
Run the 2FA filter before anyone asks you toA security questionnaire will eventually ask what proportion of your users have multi-factor authentication enabled. This column is the answer, and it is better discovered on a quiet Tuesday than during a procurement review.

​
Leavers

Users are deactivated, not deleted. Tools → Deactivate User revokes access immediately; Activate User restores it.
Not deleting people is the correct behavior, not a limitationOrders, shipments, picks and status changes carry the identity of whoever performed them. Deleting the person would either break those records or quietly detach them, and a fulfillment history you cannot attribute is not much of a history.Deactivation ends the access and keeps the trail. When someone leaves, deactivate the account and regenerate any API credential they had access to — the refresh token does not expire on its own. See API authentication.

​
Scoping people to places

Beyond permissions, warehouse and branch staff are scoped to the sites they actually work in. The effect is that a picker at one site sees one site’s queue. Scope and permission are different controls and both apply: a permission says what kind of work someone may do, and scope says where.

​
Passwords and two-factor authentication

Each person manages their own credentials at Settings → My Profile.
Passkeys are the stronger option where the device supports themA passkey cannot be phished, because there is no code to read out and no password to type into a convincing imitation of the login page. It is the one authentication change that removes a whole category of attack rather than making it harder.It is worth offering to administrators and anyone with financial visibility first, since those are the accounts an attacker would want.
Authenticator codes rather than SMS, and store the backup codes properlyApp-generated codes are not vulnerable to SIM swapping or to an intercepted message, which is why they are the method here.The trade-off is that a lost phone locks the person out, and the backup codes are the only way back. Saving them into a password manager at the moment 2FA is enabled takes a few seconds; recovering an account without them does not.