How organisations work

We create your organisation when your self-service onboarding application is accepted. From then on, people in that organisation sign in at sandbox.nuvante.io with WorkOS.

Each person who signs in is either a tenant admin or a member of a participant. The participant's kind is either clearing_member or stablecoin_issuer. What someone can do comes from a capability map based on that role. You never send a role string on API calls.

A tenant admin is a user with role: admin who's attached to a participant. A Nuvanté platform operator is also an admin, with no participant attached, so the two are easy to tell apart.

Tenant admins usually hold manageApiKeys, plus capabilities that depend on the participant kind, such as initiateTransaction for clearing members or viewReserves for issuers. They also hold manageOwnTeam and runOwnConformancePack for their own organisation.

Members of the same organisation can create API keys and, at a clearing member, initiate transactions. They can't invite teammates or run the conformance pack.

A sandbox API key belongs to the participant, so it isn't tied to any one person. Keys never get manageApiKeys, manageOwnTeam or runOwnConformancePack. People use the portal, and your integrations send nvt_sandbox_ Bearer tokens.