FirstPromoter lets you control what each team member can access and manage within your account.
Team access is organized into three main areas: Team Members, Groups, and Roles. You can manage all three from the Team section of your FirstPromoter account.
Team Members
The Team Members tab lists everyone with access to your dashboard. The table shows:
User – name and email. A lock shield icon indicates the account is secured by OTP (two-factor authentication) or Google Login.
Role – the member's effective role. Custom roles show a C badge. If the member is in a group, the role shown is the group's role.
Group – the group the member belongs to, if any.
Allowed campaigns—the campaigns the member can see data for.
Member statuses
Status | Meaning |
Pending Invitation | The member hasn't accepted their invite email yet |
Deactivated | The account is suspended — they cannot log in |
Inviting a team member
Click "Invite" in the top-right corner.
Enter the member's email address.
Optionally assign them to a Group — the group's role will be applied automatically.
If no group is selected, choose a Role from the dropdown.
Set Campaigns access — choose specific campaigns or leave as all campaigns.
Click Send.
An invitation email is sent. The member appears with a Pending Invitation badge until they accept.
Editing a team member
Click the Edit action to change their role, group, or campaign access at any time.
Deactivating and reactivating
Deactivating a member prevents them from logging in. Their data is preserved.
To deactivate: select Deactivate from the action menu and confirm.
To reactivate: select Activate from the action menu.
Removing a team member
Select Delete from the action menu. This cannot be undone.
Resending an invitation
If a member hasn't accepted their invite, select Resend invite from their action menu.
Exporting the team list
Click the Download button (top-right) to export all team members as a CSV file.
Filtering and searching
Search by name or email. Use Filters to narrow by Role or Status (Active, Pending, Deactivated).
Requiring two-factor authentication for all team members
The account owner can make two-factor authentication (2FA) mandatory for everyone on the team.
Open your User Settings and go to the Two-factor authentication section.
Turn on Require two-factor authentication for team members.
Confirm in the dialog.
Once this is on:
Every team member must use 2FA to sign in. This includes existing members, not only new ones.
Members who haven't set up an authenticator app get their sign-in codes by email.
Members can't turn 2FA off for their own account while the requirement is on.
Only the account owner can change this setting. Other team members can see whether it's on, but the toggle is disabled for them.
Groups
Groups let you organise team members and apply a shared role to all of them at once. When a member belongs to a group, the group's role overrides their individual role assignment.
The Groups table shows each group's name, description, assigned role, and member count.
Creating a group
Go to Settings → Team → Groups.
Click Create Group.
Enter a Group Name (e.g. "Marketing Team", "Finance").
Optionally add a Description.
Select a Group Role — only custom roles can be assigned to groups.
Click Create Group.
Groups require a custom role. If you haven't created one yet, go to the Roles tab first.
Assigning a member to a group
When inviting or editing a team member, select the group from the Group dropdown. Their role is automatically set to the group's role and the individual Role field is disabled. The group name appears in the Team column of the team members table.
Changing a group's role
Edit the group and select a different role. The change applies to all members in the group immediately.
Removing a member from a group
Edit the team member and clear the Group field. Their role reverts to their individual assignment.
Deleting a group
Click the Delete icon on the group row. Members in the group are not deleted — they remain active but fall back to their individual role.
Roles
The Roles tab shows two sections: Built-in Roles and Custom Roles.
Built-in roles
There are five pre-built roles. Click the eye icon on any to view its full permission set. These cannot be modified.
Role | Description |
Super Admin | Full access to everything. Intended for account owners. |
Admin Plus | Broad access including destructive actions (delete). Can manage all resources, settings, and integrations. |
Admin | Full resource management. Cannot delete campaigns. Read/update access to settings. Read-only on integrations. |
Manager | Mostly read-only. Can read all main resources. Can create contests. No access to integrations or activity logs. |
Affiliate Manager | Manages only the promoters assigned to them. Can read the main affiliate resources and update the promoters, commissions and payouts that belong to them. Has no access to the rest of your account. |
Assigning promoters to an Affiliate Manager
The Affiliate Manager role works differently from the others. Instead of seeing your whole program, an Affiliate Manager only sees and manages the promoters you assign to them. This is useful when you want someone to look after a specific set of affiliates without giving them access to the rest of your account.
To assign promoters to an Affiliate Manager:
Go to Team.
Set the member's role to Affiliate Manager, using Assign role in the menu behind the three dots on the right of their row.
Assign the promoters they should manage, in one of two ways:
Open the menu next to the member (the three dots) and click Assign promoters, choose the promoters, then save, or
Go to the Promoters page, select the promoters you want, and click Assign to manager.
The number shown next to the member tells you how many promoters are assigned to them.
Once assigned, the Affiliate Manager only sees those promoters when they log in. On the Promoters page you can also filter by Assigned to and pick a team member, to see which promoters each manager looks after.
Built-in role permission matrix
CRUD = create, read, update, delete.
R = read only.
CRU = create, read, update.
CR = create and read.
A dash (–) = no access.
Resource | Super Admin | Admin Plus | Admin | Manager |
Campaigns | CRUD | CRUD | CRU | R |
Rewards | CRUD | CRUD | CRUD | R |
Products & Prices | CRUD | CRUD | CRU | R |
Contests | CRUD | CRUD | CRUD | CR |
Promoters | CRUD | CRUD | CRUD | R |
Impersonate | R | R | R | – |
Referrals | CRUD | CRUD | CRUD | R |
Commissions | CRUD | CRUD | CRUD | R |
Payouts | CRUD | CRUD | CRUD | R |
Promoter Payout Methods | CRUD | CRUD | CRUD | R |
Assets | CRUD | CRUD | CRUD | R |
Emails | CRUD | CRUD | CRUD | R |
Agreements | CRUD | CRUD | CRUD | R |
Team Members | CRUD | CRUD | CRUD | R |
Roles | CRUD | CRUD | R | R |
Reports | CRUD | R | R | R |
Billing | CRUD | R | R | R |
Settings | CRUD | CRUD | RU | R |
Integrations | CRUD | CRUD | R | – |
Activity Logs | CRUD | – | – | – |
AI Assistant | CRUD | R | R | R |
Reports, Billing, and Activity Logs are read-only resources. Even in custom roles, only the Read permission is available for these — create, update, and delete cannot be granted.
Custom roles
Custom roles let you define exactly which permissions a team member has across every resource.
To create a custom role:
Click Create Role on the Roles tab.
Enter a Role Name (e.g. "Finance Manager", "Campaign Reviewer").
Optionally add a Description and pick a Color for the role badge.
Set permissions in the matrix — check each resource and action combination you want to allow.
Click Create Role.
Copy from shortcut: Use the Copy from dropdown to start from any existing role's permissions, then click Apply to load them into the matrix. Adjust as needed. Click Clear to reset back to empty.
Editing a custom role: Click the Edit icon. Changes apply immediately to all members with that role.
Deleting a custom role: Click the Delete icon and confirm. The role must not be assigned to any team members or groups before it can be deleted.
When to use a custom role:
Built-in roles cover the most common access patterns, but they're fixed. Use a custom role whenever you need a combination they don't offer, for example a built-in role minus one resource, or a built-in role plus one extra permission.
Example: You want to give a team member all the permissions of a Super Admin except access to Billing. Admin Plus comes close, but it also reduces access to some other features you might want to keep. The cleanest fix is a custom role:
Click Create Role.
Name it something like "Super Admin (no billing)".
Use the Copy from dropdown and select Super Admin, then click Apply to load its permissions into the matrix.
Uncheck the Billing row.
Click Create Role.
The new role has full Super Admin access everywhere except Billing.
The same pattern works in reverse. To give a Manager extra access to one resource, copy Manager's permissions, then check the rows you want to add.
What each permission resource controls
When setting up custom roles, here is what each resource covers:
Resource | What it controls |
Campaigns | Creating and managing affiliate/referral campaigns, their settings, reward structure, and signup pages |
Rewards | Commission rules, reward tiers, and performance bonuses |
Products & Prices | Products, prices, and plan IDs used for plan-based campaign rewards |
Contests | Leaderboard-style competitions for promoters |
Promoters | Affiliate/promoter profiles, referral links, and promo codes |
Impersonate | Logging in to the affiliate portal as a promoter (read-only — requires Promoters read) |
Referrals | Leads referred by promoters — sign-ups, trial starts, and their status |
Commissions | Sales and conversion events that generate earnings for promoters |
Payouts | Payments issued to promoters |
Promoter Payout Methods | The payout methods (PayPal, bank transfer, etc.) configured by promoters |
Assets | Marketing materials, images, and files shared with promoters via the affiliate portal |
Emails | Email templates and automated notifications sent to promoters |
Agreements | Contract documents that promoters are required to sign |
Team Members | Inviting, editing, deactivating, and removing dashboard users |
Roles | Creating and managing custom permission roles |
Reports | Performance dashboards and analytics (read-only — no write access possible) |
Billing | Your FirstPromoter subscription and billing details (read-only — no write access possible) |
Settings | Account-level and campaign-level settings |
Integrations | Third-party integrations such as Stripe, Paddle, Chargebee, and webhooks |
Activity Logs | Full audit trail of all actions in the account (read-only — Enterprise plan only, must be enabled at account level, visible to Super Admins by default) |
AI Assistant | Access to the in-dashboard AI assistant (read-only — the AI assistant must also be enabled for your account) |
Sub-resources
Some resources are not listed in the permission matrix but are controlled by their parent:
Sub-resource | Controlled by |
Promo codes | Promoters |
Webhooks | Integrations |
Postbacks | Integrations / Promoters |
Invoices | Billing / Payouts |
Events and custom referral statuses | Referrals |
Dashboards | Reports |
Leaderboards | Contests |
Asset categories | Assets |
Email events | Emails |