ShipRev runs the accounts of your end users and the sign-in in front of your product: the account pool, sign-in itself, buyer organizations and the session tokens your backend verifies. Your application keeps its own interface and its own data, and decides on every request with the Server SDK.
What ShipRev runs
| Part | What it covers |
|---|---|
| End-user accounts | Accounts with email and password, or with Google or GitHub. Signing up creates the account, a buyer organization and the membership between them; an end user who signs up from an invitation joins the inviting organization instead of creating one |
| Buyer organizations | Your customers, each with its members. Members are invited, accept, and can be removed; an end user who belongs to several organizations switches between them |
| Sign-in gate and brand domains | The sign-in your end users go through, on a domain of yours. A gate serves one application by default, or several of your applications so that one sign-in covers them |
| Session tokens | Issued at sign-in, naming the account, the buyer organization and the application. Your backend verifies them locally with the Server SDK |
| Your team | Your own organization's members, with the roles owner, admin, member and viewer, for all of your applications or for one |
| Machine credentials | The SDK key your backend uses, and management API keys for your own systems: created, narrowed to one application, rotated and revoked |
Your team and your end users are two separate pools of accounts. The operator console does not accept end-user credentials, and your end users' sign-in does not accept your team's.
What stays in your application
- Your interface. Your product's pages stay yours. End users reach ShipRev's sign-in through the hosted pages on your brand domain, or through the React components inside your own pages.
- Every decision on a request. Your backend verifies the session token and rules on what the caller's organization may do, inside its own process. Nothing in the browser decides; see Where the rules run.
- Your own data. What your product stores about its users is yours. Use
account_idandorganization_idfrom the verified token to tie it to ShipRev's accounts and organizations.
How end users reach sign-in
You choose who owns the sign-in page and whether you want ready-made self-service pages:
| Way | End users see |
|---|---|
| Hosted sign-in, back to your app | The hosted sign-in page on your brand domain, then your application |
| Hosted sign-in and the customer portal | The hosted sign-in page, then the portal for subscription, billing, usage and members |
| Your own sign-in page | Your own pages, built with the React components or the Public API |
Hosted pages, components or your own helps you choose, and Three ways to connect your end users sets each one up.
Where to go from here
Sign-in methods
Hosted pages, components or your own
Gates and brand domains
Sessions and tokens
Buyer organizations
Your team and keys
The endpoints behind sign-in, organizations, members and invitations are in the Public API reference, and the claims of a verified token in the Server SDK reference. The objects of this product, and how they meet the other three on one buyer organization, are in How ShipRev works. The product page is Identity.