Team & organizations
Every Tick user belongs to an organization. Registering creates a personal org with you as its owner; clients, projects, tasks, tags and entries all live inside the org, so everything in this guide is shared with the people you invite.
Roles
| Role | Can do |
|---|---|
owner | Everything: rename the org, manage members and roles, create and revoke invites — including inviting and managing other owners. The last owner can never be demoted or removed (the API refuses with a 409). |
admin | The same day-to-day powers, with one boundary: admins cannot touch owner accounts, and cannot grant the owner role. Attempts get a 403. |
member | Track time and use the catalog; no member/org management. |
Roles are enforced on the server, and the caller's role is re-read from the database on every request — demote or remove someone and it takes effect on their very next click, not at their next login.
Members & roles
Settings → Members & roles lists everyone in the org with name, email, role and rate. Owners and admins can:
- Change a member's role (within the boundary above).
- Set a per-member rate override (see below).
- Remove a member from the org. Their time entries stay — removal drops the membership, not the history.
Rates per member
Each membership can carry its own $/h rate. It slots into the Rule 2 inheritance chain between client rate and the user's personal default:
entry override → project → client → org member → user default
So a team can price one person differently across the whole org without touching any project, and each user still has a personal default (Settings → Profile) as the final fallback.
Invites
Invite member takes an email and a role and creates an invite that is valid for 7 days and works once.
- An owner or admin creates the invite. Only owners may pick the
ownerrole; inviting an address that is already a member is refused with a 409. - If SMTP is configured, the invitee gets an email with the join link and the dialog says so. If not, the dialog shows the
…/register?invite=TOKENlink with a copy button — send it however you like. - The register page looks the token up, prefills the email, and shows which org and role the invite is for. Registering with the token joins the existing org with the invite's role instead of creating a personal one.
Pending invites — unaccepted and unexpired — are listed with an "expires in nd" label, a copy-link action and Revoke. Revoking asks for confirmation first, because it kills a live signup link; afterwards the link returns a clear "expired or already used" message. Used and expired invites drop off the list on their own.
NUXT_PUBLIC_REGISTRATION is open by default, and should be invite or closed on anything exposed to the internet. See registration modes.Passwords
Changing your own
Settings → Profile has the password form: current password, then the new one (8 characters minimum). A wrong current password gets a deliberately vague 403.
A successful change logs out your other sessions and keeps the one you are using. That is the intended way to kick a stolen or forgotten device out of a workspace.
Forgotten passwords
The login page links to Forgot password, which is a three-step flow:
- You submit an email address. The reply is always the same "Check your email — if an account exists for that address, a reset link is on its way" — Tick will not tell a stranger whether an account exists.
- If the address does match a user, a single-use token valid for one hour is created and a reset link is emailed. With no SMTP configured, the link is written to the server console instead (
docker compose logs app) so a self-hoster can still recover an account. - The link opens
/reset-password?token=…, where you set a new password. Used, expired and unknown tokens all get the same "invalid or expired — request a new one" page.
Finishing a reset invalidates every session for that user, and voids any other reset links they had outstanding.