Admins and roles

Invite the people who manage your organization in the console, choose what each of them can do, and set how they sign in.

Admins are separate from your users. They sign in to the console at app.fob.so with a Fob account on id.fob.so, and one account can be an admin of several organizations. Someone who is both an admin and a user has two accounts.

Create an organization

Choose New organization in the organization menu at the top of the console. You become its owner.

Field	Rules
Name	Up to 200 characters.
Address	The slug in your URLs, such as acme for https://acme.fobauth.com and app.fob.so/acme. Lowercase letters, digits and hyphens. Some names Fob uses itself are reserved, such as admin, api and www.

Warning

You can't change an organization's address later.

Users see your organization's name on sign-in pages and in emails, such as Acme ID. To change it, open Settings > Branding.

Rename or delete an organization

To rename the organization, open Settings > General. Its address stays the same. Renaming needs Change security settings.

Only owners can delete an organization. Choose Delete organization on Settings > General and type the organization's address to confirm. If you last signed in more than 10 minutes ago, Fob asks you to sign in again first.

Warning

Deleting an organization deletes all its users, apps, server access and logs. It can't be undone.

Invite admins

Permission

Needs Manage admins.

1. Open Settings > Admins and choose Invite admin.
2. Enter their email and, optionally, their name.
3. Choose their role.

Fob emails them. They become an admin once they accept the invitation, the next time they sign in to the console. If they don't have a Fob account yet, the email asks them to create one first. That link works for 7 days.

To change someone's role, or remove them, use the menu on their row: Change role or Remove from organization. To change the role of someone who hasn't accepted yet, remove them and invite them again.

Every organization keeps at least one owner. To remove or demote the last owner, make someone else an owner first.

Roles and permissions

Each admin has one role. Every admin can see the organization's settings, apps, groups, signing keys and admins. Roles add permissions on top of that.

Role	What it can do
Owner	Everything, including managing other owners.
Admin	Everything except managing owners.
Support	See people and logs, and impersonate people.
Viewer	See people, logs and settings.
Custom	The permissions you choose. See Custom roles.

Permission	Code	Allows	Owner	Admin	Support	Viewer
See people	users.read	View users, their sessions and group memberships, check app access, and export users	Yes	Yes	Yes	Yes
Manage people	users.write	Invite, edit, disable, delete and sign out users, reset their MFA, and unlock them	Yes	Yes
Impersonate people	users.impersonate	Sign in as a user	Yes	Yes	Yes
Manage apps	applications.write	Create and change apps, assignments, sign-on policies and networks	Yes	Yes
Manage groups	groups.write	Create and delete groups and change their members	Yes	Yes
Change sign-in, branding, domains and keys	config.write	Sign-in methods, password and session settings, branding, emails, domains, signing keys, profile attributes and identity providers	Yes	Yes
Manage API keys and webhooks	developers.write	Create and revoke API keys and SCIM tokens, and manage webhooks	Yes	Yes
See sign-in and audit logs	logs.read	Read the sign-in log, the audit log, webhook messages and SSH sessions	Yes	Yes	Yes	Yes
Manage admins	members.manage	Invite, change and remove admins	Yes	Yes
Change security settings	org.security	Rename the organization, change how admins sign in, and run Access	Yes	Yes

Assigning a user to an app or a group by email also needs See people.

Custom roles

To define your own role, open Settings > Admins and choose New role under Admin roles. Give it a name, an optional description and at least one permission. Only owners and admins can manage custom roles.

Changes to a custom role apply straight away to everyone who has it. You can't delete a role while admins have it.

An admin can't give anyone a permission they don't have themselves, and can't change or remove an admin who has a permission they lack.

API key scopes

Whoever creates an API key can only give it scopes their own permissions cover.

Scope	Needs
users:read, groups:read	See people
users:write	Manage people
groups:write	Manage groups
applications:read	Nothing more
scim	See people, Manage people and Manage groups

How admins sign in

Choose how admins sign in to the console on Settings > Admins. Every admin can see these settings.

Permission

Needs Change security settings.

Setting	What it does
Require multi-factor	Admins must use a second factor. Admins without one set it up the next time they sign in.
Sign in again after	How often admins must sign in again, from 1 to 12 hours. The default is 12.
Passwords	The password policy for admins. It has the same options as the user password policy.
Single sign-on	Admins on your domains sign in through your identity provider. See Console single sign-on.
Allowed email domains	New admins must have an email at one of these domains. Leave it empty to allow any domain.

These rules follow the admin across Fob. If any of their organizations requires MFA, they need it to sign in at all, and their password must meet the strictest policy among their organizations. An admin who doesn't want an organization's rules can leave it.

If you add Allowed email domains later, admins outside them lose access until you add their domain. Owners always keep access.

Console single sign-on

Send your admins to your own identity provider, such as Okta or Entra ID, when they sign in to the console.

1. Open Settings > Admins and go to Single sign-on.

2. Enter your domain, such as acme.com, and choose Add domain.

3. Add the TXT record the console shows to your DNS, then choose Verify.

4. Add a connection over OpenID Connect or SAML for your verified domains.

5. Give your identity provider the values the console shows:

   Protocol	Value
   OpenID Connect	Redirect URI https://id.fob.so/sso/callback/<connection-id>
   SAML	Entity ID https://id.fob.so/sso/saml/<connection-id>
   SAML	ACS URL https://id.fob.so/sso/saml/<connection-id>/acs
   SAML	Metadata URL https://id.fob.so/sso/saml/<connection-id>/metadata

By default the connection is required: admins with an email on your domains must sign in through it, and their password stops working.

Signing in through the connection doesn't make someone an admin. You still invite them.

An admin who signs in through your identity provider sees only your organization in that session. To use their other organizations, they sign in another way.

Console domains are separate from your users' email domains, so you can verify the same domain for both.