Your customers, and who can sign in
Your customers are the people who sign in to the things your business offers them — a client area, a page showing their own order, a members-only corner of your site. Who they are, and what each of them can reach, lives together in one place under Settings → Customers.
These are not your mailing list
Worth saying plainly, because it is the mix-up almost everyone makes: the contacts in Email Marketing and the people here are two separate lists, and neither feeds the other. Email Marketing holds addresses that agreed to hear from you. This holds people who can sign in and see something of their own. Someone can easily be on one list and not the other, and inviting somebody here never subscribes them to anything.
Why the area is there — and why another founder may not see it
It shows up once your business offers its customers something to sign in to and customer sign-in is turned on for your business (see "Customer sign-in isn't turned on yet"). Your business offers its customers something once I build you an app they sign in to — just ask, and see "Letting your customers use part of your business". Until then I keep the area out of your way, which is why another founder may not see it.
Inviting someone
Give me their email address and pick what they should be able to use. They get an email from your business with a link to your sign-in page — no password, and no code in the message, so it does no harm if it gets forwarded to the wrong person.
Their access is not live until they follow that link and sign in once. Until then it is genuinely an invitation, not a key. So when somebody tells you they were invited and can see nothing, the first question is whether they have signed in yet.
You get a copy in your own inbox, so you can check an invitation really went out. Inviting the same person again is safe, and is also how you resend one that never arrived.
They don't have to retype the address you sent it to
Following the link, they see the address the invitation went to already filled in, and press one button for their code. Nothing is sent until they press it: email scanners open links before people do, and a page that sent a code just for being opened would burn theirs first.
The address is not in the link. The link carries a meaningless reference only I can look up, so forwarding it exposes nobody, and no crafted link can make your business email a stranger.
Re-invite someone and only the newest link fills the address in. An older one still works — it just asks them to type it, as does any link after a month or so.
An invitation needs somewhere to send them back to
A sign-in link has to land somewhere afterwards, and that somewhere is your website. If your business has no published site, and no site of your own that you have told me to allow, I turn the invitation down rather than send a link that goes nowhere.
Two ways out: publish your website, or, if you already have a site you like, ask me to allow it — see "Letting your customers use part of your business".
Three ways to take access away
They are not interchangeable, and the differences are the whole point:
- Sign them out everywhere ends the sign-ins they have open right now and changes nothing else — for a shared laptop, or a phone left on a train. They can sign straight back in.
- Remove one thing takes away their access to a single part of your business and leaves everything else they use alone.
- Switch them off — suspending — shuts the door on signing in at all, and ends their live sign-ins in the same act.
The last two take effect on the customer's very next action. There is no waiting period and no window where an old session still works, because I check who someone is and what they are allowed on every single request they make.
Switching someone off is fully reversible: nothing is deleted, and switching them back on gives them exactly what they had — minus anything you removed separately, which I will not hand back on my own. Removing one thing is not the same as switching someone off, and does not stop them signing in.
What each decision does and does not touch is laid out in "Inviting a customer, and switching their access off".
Somebody with an account and nothing to use
Take away the last thing a person could use and they keep their account, can still sign in, and find nothing waiting for them. That is a real state rather than a fault, and the list says so plainly. Invite them to something again and they are back.