# Invite your team

Each technician signs in with their own Blink account. Inviting someone takes two steps: create their account, which gives you an invite link to send them, then give them a role so they can reach your organization.

You need the **Manage users** permission. As the instance owner, you have it.

## 1. Create the user

1. In the sidebar, go to **Users**.
2. Click **New user**.
3. Enter their **Email**, and optionally their **First name** and **Last name**.
4. Click **Create and get link**.
5. The **Invite link** dialog shows the link. Click **Copy link** and send it to them, by email or chat.
6. Click **Done**.

:::caution[The link is shown once]
The invite link works once, for 7 days. The dialog shows the exact date. Blink does not show the link again and does not email it for you. If it gets lost or expires, an instance owner opens the user's row under **Users** and clicks **New invite link**.
:::

:::note[Each user takes a technician seat]
Every user takes one of the technician seats in your plan, including people who have not accepted their invite yet. The top of the **Users** page shows how many are in use. If **New user** is greyed out, all seats are in use: disable a user you no longer need, or ask for more seats. See [Technician seats](/configure/plans-and-limits/#technician-seats).
:::

## 2. Give them a role

A new user cannot reach any organization until you give them a role. The simplest way is to add them to the organization's team:

1. Select the organization in the top bar.
2. In the sidebar, go to **Team**.
3. Click **Add member**.
4. Enter their **Email**.
5. Choose a **Role**. The text under the list describes what the role allows.
6. Click **Add member**.

The person must already have a Blink account, which step 1 created. You can add them before they have accepted the invite.

New instances come with these roles. **Owner** is built in; the others are starter roles that administrators can edit or delete:

| Role | What it allows |
| --- | --- |
| **Owner** | Everything in the organization. |
| **Admin** | Everything except renaming or deleting the organization, managing owners, terminal access and backstage as SYSTEM. |
| **Technician** | Support and Access sessions, device control and recordings. This is the default choice. |
| **Viewer** | Watch sessions, see devices, play recordings and read logs. |
| **Member (group access only)** | Nothing organization-wide. They reach only the device groups you give them a role on, under **Groups**. |

:::tip[Someone who works across all your customers]
To give a person the same role in every organization, including ones you add later, go to **Users**, open their row, and click **Give a role**. Choose **All organizations, including future ones**, pick the role and click **Save**.
:::

## What your teammate does

1. They open the invite link. The page shows **Set up your account**, with their email already filled in.
2. They choose a password of at least 8 characters, type it twice and click **Set password**.
3. On **Set up two-factor**, they add the setup key to an authenticator app, enter the 6-digit code and click **Verify and enable**.
4. They save their 10 recovery codes and click **I've saved them, continue**.

The console opens. From then on they sign in at `/login` on your Blink address.

If the link was already used, has expired or was not copied whole, they see **Invite link not valid**. Make them a new one as described above.

## When someone forgets their password

Blink has no self-service password reset. An instance owner opens the user's row under **Users** and clicks **Reset sign-in**. This removes their password, two-factor and recovery codes, signs them out everywhere, and gives you a new invite link to send them.

See [Configure](/configure/) for more on users, roles, groups and sign-in security.