Unified user management (end users)
Overview
User access in the OneStock platform is managed across three platforms: Store App, Order Management Center (OMC aka backoffice), and API. Users can be granted access to one or more of these platforms.
Users can be managed from the Order Management Center or from the Store App:
From the Order Management Center you are able to create, edit and delete users across the whole of OneStock. You will be able to grant access to Store App, Order Management Center and API as well.
From the Store App, you can only manager Store App users with individual access to the store you are logged at.
Management from the Order Management Center
The “Users” page is only accessible to Client Admin, Client Headquarters and Client Retail Directors
Access is granted per site and application. Rights per application depend on the role that is assigned to the user. Details about rights are detailed per application:
If a Store App user does not have an email for login credentials, a new user account with an email login must be generated to provide access to the OMC.
Multiple Site access
If the error “User already exists” appears when creating access for a user, it could be that he already has an account on another site.
A user can have access to multiple sites. To grant access to a new site, you need to be logged in with a user who already has access to one of the existing sites the user is authorized to access. Simply click on the "assign site" button and provide access to the new site.
Store App Access
Store app access details are provided in the following table.
Store App Roles
Roles / Right Category | vendor_manager | vendor |
|---|---|---|
Store App | Access the Store App Create and manage users in store* | Access the Store App Create and manage users in store* |
*As long as the page is allowed for the role in the Store App menu configuration
Access to all stock locations or some
Access can be granted to all stock locations or to a specific list.
Order Management Center (OMC) Access
OMC access details are provided in the following tables.
Order Management Center Roles
Role types
User type | Best for | Access summary |
|---|---|---|
Business stakeholders | Have visibility across modules for reporting or auditing with read access. | |
Data and performance teams | Access reportings dashboards and can handle orders and customer data. | |
Store agents and contact centre staff | Handle daily orders and customer requests. | |
Technical integrators and implementation consultants | Set up orchestration rules, buffers, delivery settings and orchestration, with access to customer or order data. | |
Head office, retail directors and platform administrators | Oversee operations across sites, manage users and adjust configurations. |
Viewer roles
Right Category / Roles | client_viewer | client_viewer_limited |
|---|---|---|
Reporting | Analytics | Analytics |
Operations | Orders read only Customer profile read only Delivery read only | Orders read only Customer profile read only Delivery read only |
Inventory | Stock Stock locations read only | Stock Stock locations read only |
Fulfillment | Orchestration read only |
|
Analytics roles
Right Category / Roles | client_service_analytics | client_analytics |
|---|---|---|
Reporting | Analytics BI Suite | Analytics BI Suite |
Operations | Orders Customer profile Appeasement |
|
Inventory | Stock Items |
|
Fulfillment |
|
|
Customer service role
Right Category / Roles | customer_service |
|---|---|
Reporting |
|
Operations | Orders Customer profile Appeasement |
Inventory | Stock Items |
Fulfillment |
|
Configuration roles
Right Category / Roles | customer_service_conf_manager | conf_manager |
|---|---|---|
Reporting |
|
|
Operations | Orders Customer profile Appeasement Delivery |
|
Inventory | Stock Buffers Stock locations Items | Stock Buffers Stock locations Items |
Fulfillment | Orchestration | Orchestration |
Global access
Right Category / Roles | client_admin | retail_director | headquarter |
|---|---|---|---|
Reporting | Analytics BI Suite | Analytics BI Suite | Analytics BI Suite |
Operations | Orders Customer profile Appeasement Workflows Delivery | Orders Customer profile Appeasement Workflows read only Delivery | Orders Customer profile Appeasement Workflows read only Delivery |
Inventory | Stock Buffers Stock locations Items | Stock Buffers Stock locations Items | Stock Buffers Stock locations Items |
Fulfillment | Orchestration Users Configuration Troubleshooting center | Orchestration Users Configuration Troubleshooting center | Orchestration Users Configuration Troubleshooting center |
Access to all sales channels or some
Access can be granted to all sales channels (default) or limited to a list of sales channels.
Impact of Sales Channel Limitations:
Orders Page: Only displays orders from accessible sales channels.
Analytics: Only displays data for accessible sales channels.
Stock Page: Only shows stock queries for accessible sales channels.
API Access
API Roles
Roles / Right Category | api_user | e_resa_front | pos_alerter | ssr_front |
|---|---|---|---|---|
API access | Access to all public routes in the API Portal | Access to the API routes required for e-reservation feature | Access to the API routes needed for alerter | Access to the API routes required for self service return feature |
Security
Users can be configured with:
Basic Authentication: User passwords stored in OneStock.
Backoffice will have to enter a second factor authentication that’s sent to their email.
Single Sign-On (SSO): A more secure option allowing authentication policies to be managed through an external dedicated Identity Provider. Learn more about SSO here.
Token Lifecycle Configuration Guide
Token lifespans is managed on a per-role basis to balance security and user experience. The wildcard key "*" defines a default lifecycle for roles without a dedicated configuration.
Expiration Types
Token validation and expiration behaviors are controlled by the expiration block using one of three strategies:
Inactivity: The token remains valid as long as the user is active. It automatically expires if it is not used for a specific duration. The
valueparameter defines this inactivity window in seconds (e.g.,1800for 30 minutes).Time-to-Live (TTL): The token is assigned a fixed lifespan at the moment of creation. It will automatically expire once this time elapsed, regardless of user activity. The
valueparameter defines this duration in seconds.Schedule: All active tokens are forced to expire simultaneously at a designated time every day. The
valueparameter represents the number of seconds elapsed since midnight (e.g., a value of84600triggers a global expiration at 23:30 / 11:30 PM).
Concurrent Sessions & Persistence
Beyond expiration, an additional parameters dictates how tokens are preserved and handled across devices:
Multisession: This boolean (
true/false) determines whether a single user account can hold multiple valid tokens at the same time. When disabled, logging into a new device will invalidate previous active tokens.
Accessing API as an SSO User
If you are a user with both access to the Order Management Center and API, and you authetication is setup to SSO, you can easily communicate with OneStock through API thanks to a token. You will just have to pass the token in your API calls in the token field.
Generating a API token
Generate a token from your information page in the OMC.
The token is displayed only once; store it securely.
Ensure the user has both OMC access and API access for this feature to be accessible.
Disable users
Easily disable or enable a user’s access to OneStock as needed.
This feature is ideal when working with external integrators who require access only at specific times. You can disable their user account and re-enable it when they need access again.
Important: Disabling a user revokes all access to OneStock, including the OMC, SA, and API. The user will be logged out immediately upon disabling.
Multi Factor Authentication (MFA) for Backoffice access
To strengthen login security, Backoffice users logging in with basic authentication are required to complete a second-factor authentication, ensuring it’s truly the authorized user accessing the system. This second factor, a unique code sent to the user’s registered email, must be entered in the login prompt to proceed.
MFA can be deactivated on a per-user basis directly from the Backoffice. However, we recommend minimizing deactivations, as users are more vulnerable to unauthorized access without MFA protection.
For users on Single Sign-On (SSO), MFA prompts do not apply since login security is managed entirely by your Identity Provider (IdP). If you wish to enable MFA for SSO users, please contact your IdP directly.
Good to know
Email Requirement: A user must have an email as their login to be granted rights to access the OMC. If a Store App user lacks an email login, a new user must be created.
Multi-Site User Modification: In a multi-site scenario, if you want to modify the list of sales channels or stock locations for a user with access to multiple sites, you need to be logged into the specific site you want to modify. For example, to make changes for Site Fashion Market, you must be in Fashion Market in the OMC. You cannot make this modification from another site, even if you have access to both sites.