Support/Using Your App/Administer your tenant account
/

Using Your App

Administer your tenant account

Manage users, DataRoles, locations, sign-in visibility, and an account-scoped developer kit.

Who
Active account owners
Data scope
One AppAccount only
Developer kit
Generated on request

An active account owner can open Admin from the application top bar. This is the operating console for that tenant account—not the SaaS builder control plane. Every read and write derives the SaaS app, AppAccount, user, DataRoles, and database route from the signed-in server identity. The browser cannot choose another account by supplying an ID.

What an account owner can see

  • Account status, primary contact information, creation date, and current module inventory.
  • Total and active users, each user’s User Type, assigned DataRoles, location scope, status, and most recent successful login.
  • Active and inactive DataRoles, their record capabilities, AI-read/export/trust/billing flags, and named action-permission keys.
  • Locations, codes, addresses, time zones, managers, ordering, and active state.

What an account owner can change

  • Add a real external/headless TenantUser, selecting its User Type, DataRoles, and either specific locations or all-location scope.
  • Activate or deactivate non-owner users with optimistic revision protection.
  • Create DataRoles and explicitly select record, AI, export, billing, trust, disbursement, and named action permissions.
  • Create locations and deactivate an unassigned location. An assigned location is refused rather than silently changing a user’s security meaning.
Important

The account owner cannot deactivate the active owner or a DataRole assigned to an active owner. A concurrent edit returns a conflict and must be reloaded; it is never silently overwritten.

External users versus hosted sign-in

The Add user form creates a passwordless external identity for delegated/headless API use. The owner supplies the stable external user ID used by their own identity provider. BuildWithHQ stores no invented password and does not return a reusable per-user secret. Their backend exchanges or delegates identity through the supported user-token path, and every operation runs through that TenantUser’s real DataRole and location envelope.

Note

This page does not pretend to send a hosted invitation. A separate verified invitation and password-setup contract is required before an external user can sign into the hosted tenant UI with a BuildWithHQ password.

Download the tenant-account developer kit

Open Admin → Developer kit and choose Download ZIP. The ZIP is assembled in memory only after the server re-verifies the active owner. It contains:

  • account.json with this account’s safe SaaS/AppAccount identity and no credential;
  • capabilities.json filtered to modules active for this account at download time;
  • a working same-origin TenantAccountClient.ts for the owner endpoints;
  • a copyable React account-administration starter;
  • pinned package/typecheck configuration and a SHA-256 manifest.

The archive never contains a tenant access token, password, database name, SQL connection, raw customer data, or a way to widen permissions. The included AppAccount ID is configuration—not authorization. A current tenant session is still required on every call.

When to download it again

Download a fresh kit after the SaaS builder changes this account’s installed modules or after the tenant API contract version changes. The manifest makes the exact contents reviewable and reproducible.