> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apostra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Give a client access to one advertiser

> Invite a person at a client company to work in one of your advertisers without giving them an account of their own, and approve, change or end their access.

Client access lets you give a person at a client company a way into one of your
advertisers. They do not get an Apostra account, and they do not join your
organization. They sign in, and they can work only in that one advertiser, with
the role you chose. You approve them, and you can suspend or end their access at
any time.

## Who can do this

Only an organization administrator of your Seller Account who is signed in
directly can invite a client or change a client's access. An API key, a service
token, an agent acting for someone else, a Scope3 support session and a session
that reaches your account through a parent account are all refused. Client
access must also be turned on for your account. If it is not, the Client access
section tells you so and the invitation form does not appear.

An advertiser can have one client invited at a time. You can invite someone only for an
advertiser you run yourself that is live, and only while your storefront is
published with a verified company domain. An advertiser that Apostra operates
for you has no client access to manage. When you cannot invite, the section says
why in its own words.

## Invite a client

Invitations are sent from the page, not from an agent. `save_advertiser_access`
is a page-only tool: it is not in an agent's tool list, the HTTP API or the
SDKs. An agent can read who has access and send you to the page to make the
change.

1. Open **Advertiser settings** for the advertiser, from the pencil beside it in
   the left rail or from its row on the Advertisers Page.
2. In **Client access**, choose **Invite someone from the client**.
3. Enter their work email, their company's website (for example `acme.com`; we
   do not guess it from their email) and what they can do. Then choose **Send
   invite**.

| Role | What the person can do |
| - | - |
| Can view | Read |
| Can edit | Read and write |
| Admin | Read, write and administer the advertiser |

None of the roles includes billing or payment.

Apostra emails the person a one-time link that works for seven days. The page
shows whether the email was sent or failed. If it failed, send the same
invitation again; that does not create a second invitation.

## What the client does

The client opens the link and signs in with the exact email address that
received it. A different address is refused, even at the same company. They then
choose **Claim invitation**. Claiming records who they are and adds them as a
limited member of your organization with no permissions of their own. It does not
give them access to the advertiser yet.

## Approve, suspend or end access

After the client has claimed, **Approve** appears next to their name with a
status of **Waiting for your approval**. Approving gives them the role you
chose, for that advertiser only. The advertiser then runs in self-serve mode.

After that, each person shows only the buttons that apply right now.

| Button | What it does |
| - | - |
| **Approve** | Gives a client who has claimed their access. |
| **Suspend** | Stops their access now. **Reactivate** brings it back. |
| **Revoke access** | Ends their access. Campaigns and history stay. |
| **Change role** | Moves an approved client between the three roles. |

Suspend and revoke ask you to confirm first. If a change is refused, the section
shows the reason Apostra gave. If a result is lost, reload the advertiser before
trying again; a change that already went through never repeats.

## What the client can and cannot do

A client works only in the one advertiser you approved them for, within their
role. They do not have an account of their own, and they cannot see your
organization's members or settings, your other advertisers, or your billing. If
you remove their access, their work in the advertiser stays where it is.

## Finding you is not the same as getting access

Your own domain, a Slack app or a ChatGPT listing can help buyers find your
storefront. None of them gives anyone access to an advertiser. Access begins with
an invitation you send and an approval you give. Letting a client sign up on their
own from your storefront is not available.

## Read who has access

An agent reads the same state the page shows with `get` and
`kind: "advertiser_access"`. See
[Read client access for an advertiser](https://docs.apostra.com/v2/buyer/advertisers/tasks/read-advertiser-client-access.md)
for the fields, and
[Invite and manage a client's access](https://docs.apostra.com/v2/buyer/advertisers/tasks/save-advertiser-client-access.md)
for every refusal and what to do about it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.