# Administration The admin area is where organization admins manage account settings, team members, API access, tags, and subscription. These pages are accessible from the navigation sidebar to users with the Organization Admin role. ## Organization The Organization page shows your organization's name, when it was created, and its settings: the timezone used for usage reporting, the default delivery method new partners start with (Webhooks or Polling, changeable per partner afterwards), and whether inactivity alerts are on for every partner (see Inactivity Alerts in the partners documentation). Organization admins also turn the two-factor requirement on or off from this page. To update the settings, click **Edit organization**, make your changes, and save. ## Users ### Roles There are two roles: - **User**: can use the platform but cannot manage other users or access admin settings. - **Organization Admin**: can invite and remove users, manage API keys, tags, and subscription settings. ### Managing Users The Users page has three tabs: - **Active Users**: all current members of your organization. - **Invitations**: pending invitations that have not yet been accepted. - **Removed Users**: users who have been removed. You can restore a removed user to give them access again. ### Inviting a User 1. Click **Invite User** 2. Enter the user's email address 3. Select a role: **User** or **Organization Admin** 4. Click **Send Invitation** The user receives an email with a link to create their account. ### Editing a User Click a user from the Active Users list to open the edit panel. You can update: - **Name**: the user's display name. - **Role**: User or Organization Admin. You cannot change your own role. - **Notification Preferences**: toggle email notifications, error notifications, warning notifications, and usage/billing alerts independently. Warning notifications are off by default; when on, the digest email adds a Warnings section summarizing the warnings raised on documents that were still delivered, such as a failed inbound mapping. ## Two-Factor Authentication Two-factor authentication adds a code from an authenticator app to your password at sign-in. Anyone can turn it on for their own account, and an organization admin can require it for everyone. Set it up from your account settings: scan the QR code with an authenticator app, then enter the six-digit code it shows. Turning it on signs out your other sessions. Replacing an authenticator is the same flow. You are given ten single-use recovery codes when you finish. Each one gets you in once if your authenticator is unavailable, so store them somewhere safe. They are shown once and cannot be retrieved afterwards, so you have to confirm you have saved them before you can carry on. Account settings shows how many are left and lets you generate a new set, after a confirmation step, which invalidates the old one. Organization admins can require two-factor authentication for every member from the Organization page. Members without it are asked to set it up on their next request, and cannot turn it off while the requirement is on. You have to set it up on your own account before you can require it of others. Five incorrect codes in a row locks an account for 15 minutes. ## API Keys API keys authenticate requests to the Tediware platform API, such as the partner endpoints used to submit data for outbound EDI processing (`/platform/partners/ACME/ts/810`), to provide access to coding agents via [MCP](/resources/api-docs/mcp) or to authenticate with the [CLI](/tools/cli). The list shows each key's scope. You can create a **standard** key or a **read-only** key. You should: - use *standard* when the key is used to integrate Tediware with a platform that sends and receives EDI - use *standard* if you want full access for yourself when using the CLI - use *standard* when the key is used to authenticate a coding agent that should be able to send data (frequently useful during configuration, trading partner onboarding, and testing) - use *read-only* when the key is used to integrate Tediware with a platform that only shows data and cannot send - use *read-only* when the key is used to authenticate a coding agent that should only be able to read data, such as an agent in a support role that only answers questions An agent with a standard key can send documents to your trading partners without asking you. If you connect an agent through the [CLI](/tools/cli), you can keep a read-only key and a standard key in separate profiles and turn on the standard one only when a task needs to send. [Switching between read-only and standard](/resources/api-docs/mcp#switching-between-read-only-and-standard) walks through the setup. Scope is chosen when the key is created and cannot be changed. **Sandbox** keys are minted for you when you set up a sandbox webhook sink, and cannot reach organization-wide endpoints such as the feed or a resend. ### Creating an API Key 1. Click **Add API Key** 2. Enter a name for the key 3. Choose a scope: **Standard** or **Read-only** 4. Click **Submit** The key is displayed once after creation. Copy it immediately, since it cannot be retrieved later. If you lose a key, delete it and create a new one. ### Managing API Keys From the API Keys list you can: - **Edit**: update the key's name. - **Delete**: permanently revoke the key. Any requests using the deleted key will be rejected. Treat API keys like passwords. Do not share them in code repositories, logs, or unsecured channels. ## Tags Tags are color-coded labels for organizing items across your workspace: partners, mappings, flows, and implementations. ### Creating a Tag 1. Click **Add Tag** 2. Enter a name and pick a color 3. Click **Create** ### Editing and Deleting Tags Click **Edit** on any tag to change its name or color. Click **Delete** to remove it. Deleting a tag removes it from all items it was assigned to. ## Subscription The Subscription & Billing page shows your current plan and available options. Every plan includes AI features, API access, all X12 transaction sets, and unlimited trading partners. Each X12 transaction set you send or receive counts as one transaction, including 997 acknowledgments. To subscribe or change plans, click the button on the plan you want. Paid plans redirect to Stripe for checkout. ### Developer Tier Limit The Developer tier includes 800 transactions a month, counted per calendar month in UTC, so the count starts again on the 1st. Users with usage alerts turned on get an email at 80% of the limit and another when it is reached. Once the limit is reached, new documents fail with a usage limit error until the 1st of the next month, or until you upgrade to a paid plan. Paid plans do not stop at their included transactions; usage above them is billed as overage. ### Managing Your Subscription Click **Manage Subscription** to open the Stripe billing portal, where you can update payment methods, view invoices, or cancel your subscription. When you cancel, you retain access to your current plan until the end of the billing period. After that, your organization is downgraded to the Developer tier. If you change your mind before the period ends, you can re-subscribe from the billing portal. ### AS2 Add-on AS2 is available as an add-on to paid plans. To activate, click **Subscribe to AS2** on the Subscription page. The Developer tier does not support AS2, so upgrade to a paid plan first. To remove the add-on, click **Remove Add-on**. Removing it shuts down all existing AS2 connections immediately.