Platform permissions
Built-in permissions that control access to the Userbox console and management surfaces.
Platform permissions
Platform permissions control access to Userbox itself — the management console, user administration, and API key management. They are distinct from app permissions, which control access within your application.
API naming note: In the Userbox API, platform permissions have type: internal. In this documentation we call them "Platform permissions" for clarity. See ADR-0015 for the rationale behind this naming decision.
Built-in platform permissions
Userbox ships with eight platform permissions. These are stable and cannot be deleted or renamed.
| Permission key | What it controls |
|---|---|
userbox.console.access | Sign in to the Userbox console |
userbox.users.invite | Invite new users to the tenant |
userbox.users.remove | Remove users from the tenant |
userbox.workspace.update | Update workspace configuration |
userbox.groups.manage | Create, edit, and delete groups |
userbox.roles.manage | Create, edit, and delete roles |
userbox.permissions.manage | Create and delete app permissions |
userbox.api_keys.manage | Create, rotate, and revoke API keys |
Assigning platform permissions
Platform permissions are assigned directly to users, not through workspace membership. This is because console operators — such as developers or account admins — may manage the tenant without being members of any workspace.
To assign a platform permission:
- Navigate to Users in the Userbox console.
- Select the user.
- Open the Platform permissions tab.
- Toggle the permissions you want to grant.
Most teams assign the full set to their developer accounts during initial setup and review it once before going to production.