Skip to main content
Client access lets you give a person at a client company a way into one of your advertisers. They do not get an Apostra account, and they do not join your organization. They sign in, and they can work only in that one advertiser, with the role you chose. You approve them, and you can suspend or end their access at any time.

​
Who can do this

Only an organization administrator of your Seller Account who is signed in directly can invite a client or change a client’s access. An API key, a service token, an agent acting for someone else, a Scope3 support session and a session that reaches your account through a parent account are all refused. Client access must also be turned on for your account. If it is not, the Client access section tells you so and the invitation form does not appear. An advertiser can have one client invited at a time. You can invite someone only for an advertiser you run yourself that is live, and only while your storefront is published with a verified company domain. An advertiser that Apostra operates for you has no client access to manage. When you cannot invite, the section says why in its own words.

​
Invite a client

Invitations are sent from the page, not from an agent. save_advertiser_access is a page-only tool: it is not in an agent’s tool list, the HTTP API or the SDKs. An agent can read who has access and send you to the page to make the change.
  1. Open Advertiser settings for the advertiser, from the pencil beside it in the left rail or from its row on the Advertisers Page.
  2. In Client access, choose Invite someone from the client.
  3. Enter their work email, their company’s website (for example acme.com; we do not guess it from their email) and what they can do. Then choose Send invite.
None of the roles includes billing or payment. Apostra emails the person a one-time link that works for seven days. The page shows whether the email was sent or failed. If it failed, send the same invitation again; that does not create a second invitation.

​
What the client does

The client opens the link and signs in with the exact email address that received it. A different address is refused, even at the same company. They then choose Claim invitation. Claiming records who they are and adds them as a limited member of your organization with no permissions of their own. It does not give them access to the advertiser yet.

​
Approve, suspend or end access

After the client has claimed, Approve appears next to their name with a status of Waiting for your approval. Approving gives them the role you chose, for that advertiser only. The advertiser then runs in self-serve mode. After that, each person shows only the buttons that apply right now. Suspend and revoke ask you to confirm first. If a change is refused, the section shows the reason Apostra gave. If a result is lost, reload the advertiser before trying again; a change that already went through never repeats.

​
What the client can and cannot do

A client works only in the one advertiser you approved them for, within their role. They do not have an account of their own, and they cannot see your organization’s members or settings, your other advertisers, or your billing. If you remove their access, their work in the advertiser stays where it is.

​
Finding you is not the same as getting access

Your own domain, a Slack app or a ChatGPT listing can help buyers find your storefront. None of them gives anyone access to an advertiser. Access begins with an invitation you send and an approval you give. Letting a client sign up on their own from your storefront is not available.

​
Read who has access

An agent reads the same state the page shows with get and kind: "advertiser_access". See Read client access for an advertiser for the fields, and Invite and manage a client’s access for every refusal and what to do about it.