Organization and roles
Everything in LutraID belongs to an organization. Each organization has a Sandbox and a Production environment, and four roles decide what each team member can open.
Sandbox and Production
Every organization has two environments: Sandbox, for testing with documents that chain to a test trust root, and Production, for real documents. Switch between them with the environment chip in the top bar.
Issuers, verifiers, documents, checks, API keys and records belong to one environment. Production starts empty; nothing is copied from Sandbox. Test in Sandbox first, then follow Production setup. For local integration testing, see Testing.
Sidebar
| Area | Pages | Applies to |
|---|---|---|
| Top | Home, Issue document, Verify document, Records, Analytics | One environment |
| Setup | Issuers, Verifiers, Documents, Checks, Counter tasks | One environment |
| Team | Team members and invitations | Whole organization |
| Settings | Organization, Admin activity, Legal identity, Billing | Whole organization |
| Developers | Overview, API keys, Webhooks, Customer sign-in, Data sources | One environment |
| Labs | Request QES | One environment |
Billing and Labs appear only on the hosted service. Pages a role can't open are hidden from the sidebar.
Roles
| Role | What it can do |
|---|---|
owner | Everything, including the legal identity, ownership and deleting the organization |
admin | Sets up issuers, verifiers, documents, checks, keys, billing and people. Can't change the legal identity |
member | Issues and checks documents. Sees all records and Analytics. Can read setup, but can't change it |
operator | Runs counter tasks. Sees only their own records |
In more detail:
| Page | Owner | Admin | Member | Operator |
|---|---|---|---|---|
| Home, Issue document, Verify document, Records | Yes | Yes | Yes | Yes (own records only) |
| Analytics | Yes | Yes | Yes | No |
| Setup → Issuers, Setup → Verifiers | Yes | Yes | Read-only | No |
| Setup → Documents, Checks, Counter tasks | Yes | Yes | No | No |
| Team, Settings → Organization | Yes | Yes | Read-only | No |
| Settings → Admin activity, Legal identity, Billing | Yes | Yes | No | No |
| Developers, Production setup, Labs | Yes | Yes | No | No |
Only owners can change the legal identity; admins see it read-only.
Inviting your team
Owners and admins invite people from Team → Invite team member: enter an email address and a role, then Send invitation. The email links to a page where the invited person signs in or creates an account with the invited address, then joins the organization or clicks Decline. Invitations expire; pending ones are listed under Invitations on Team, where you can resend or cancel them. To use company sign-in for your team, owners and admins set up Team sign-in (SSO) from Team.
Signing in
After sign-in you land on your organization's Home, usually in Sandbox. If you don't belong to an organization yet, you go to your invitation if you have one, to My organizations if you have several, or to onboarding to create an organization.
Your own profile, email, password, linked accounts and sessions are under Account settings in the user menu.