> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paylead.fr/llms.txt
> Use this file to discover all available pages before exploring further.
# Give each teammate the right access
> Sign in to Shift, manage your own account, and invite teammates with the exact roles their job needs.
export const SHIFT_SANDBOX_URL = "https://shift.sandbox.paylead.tech";
export const SHIFT_PRODUCTION_URL = "https://shift.paylead.fr";
Every member of your team signs in to [Shift](/glossary#shift) with their own account. Each account carries one or more **roles**, and a role decides which sections of Shift that account can open. Signing in and reading your own settings need no role. Inviting teammates and assigning their roles need the Administration role.
## Sign in
Each environment has its own sign-in URL:
| Environment | Sign-in URL |
| ----------- | ----------------------------------- |
| Sandbox | {SHIFT_SANDBOX_URL} |
| Production | {SHIFT_PRODUCTION_URL} |
Sandbox and production are isolated environments with separate URLs and separate credentials. Paylead provisions both during onboarding.
Enter the email address and password Paylead provisioned for your [Program Manager](/glossary#program-manager) account, then click **Sign In**. Shift lands you on **Performances**, a section every account can open regardless of its roles.
Two elements of that form are worth knowing about:
* **Remember me** keeps you signed in for 90 days. Left clear, your session follows the shorter default and you sign in again sooner. Tick it on a machine only you use, never on a shared one.
* After a failed attempt, Shift may add a reCAPTCHA challenge before it accepts another try. Solve it and submit again.
If Shift greets you with "Your password is not strong enough. Please change it to secure your account.", the sign-in worked. Paylead checks the password you just typed against its current rules, and asks you to update it under **My account** > **Settings**.
If you forget your password, use **Forget your password?** on the sign-in page. Paylead emails you a reset link; opening it takes you to a screen where you set the new password, and you then come back to Shift to sign in. If the email does not arrive, check that the address you typed is the one registered on your Shift account.
### Sign in with SSO
When Paylead has connected your Program to your bank's identity provider, the credentials form is not your entry point. Click **SSO Login** at the bottom of the sign-in page: the **Single Sign-on** screen asks for your email address only, then hands the browser over to your identity provider, which authenticates you and sends you back into Shift. **Regular login** returns to the credentials form. Your Program also gets its own base URL for each environment, which replaces the standard URLs above.
See [Shift with SSO](#shift-with-sso) for what this mode removes from the interface once you are in.
## Manage your account settings
Open **My account** > **Settings** to review and edit your personal credentials. Every signed-in user reaches this page, whatever their roles.
| Field | Editable | Description |
| ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Created** | No | Date your account was created. |
| **Name** | Yes | Your first and last name. Click **Edit** to open the **First name** and **Last name** fields, both required. **Cancel** restores what was there when you opened them. |
| **Email** | Yes | Your sign-in email. Click **Edit** to change it. |
| **Password** | Yes | Click **Edit**, confirm your **Old password**, then fill in **Password** and **Retype your password**. |
Each block saves on its own. Shift confirms with "Your settings have been updated." and refreshes your session, so a name or email change takes effect without signing out and back in.
### Password requirements
Shift lists these rules under the password fields and marks each one as you type:
* Minimum 14 characters
* 1 lowercase
* 1 uppercase
* 1 digit
* 1 special
* No company name or one of our product names
* No username (firstname or lastname)
### Email notifications
A second card sits under the settings card on the same page, titled **Notifications**. It holds your personal email subscriptions, and every one of them concerns a [Campaign](/glossary#campaign) event. That is why Shift shows the card only to users who hold the **Offers** role: a teammate without that role never sees it.
Six subscriptions are offered:
* **New campaign available**
* **Campaign ending soon**
* **Campaign extension**
* **Campaign shortened**
* **New visual available**
* **Boosted rate phase available**
Each row carries a toggle and a `?` icon that describes the event on hover. The **Apply to all** toggle at the top of the card switches every subscription on or off in one move. The card has no **Save** button: each toggle takes effect the moment you flip it. For what each notification tells you, see [Stay notified about Campaigns](/program/shift/publish-offers#stay-notified-about-campaigns).
Subscriptions are personal: they follow your account, not your Program, so each teammate sets their own. Use them to decide who gets alerted when the catalog needs attention, rather than routing every Campaign email to one shared mailbox.
## Manage users
A **user** is anyone with an active Shift account in your [Program](/glossary#program). **My account** > **Users** lists every user, their last activity, and their assigned roles. Search the list by name or email.
### Roles
A role defines which sections of Shift a user can open. A user can hold several roles at once. Roles do not nest: Administration opens **Users** and nothing else, so an administrator who also needs the technical screens must hold **Technical** too.
Two areas stay open to every signed-in user, whatever their roles: **Performances** and **My account** > **Settings**.
| Role | Sections it opens |
| -------------------- | ---------------------------------------------------------------------------------------- |
| **Administration** | Users |
| **Financial** | Invoices, [Ventilation](/glossary#ventilation) |
| **Gifts** | [Gifts](/glossary#gift) |
| **Offers** | [Offers](/glossary#offer), [Campaigns](/glossary#campaign), Brands, Coupons, Integration |
| **Reporting** | Reporting, Brands, Ventilation |
| **Consumer support** | [Consumers](/glossary#consumer), Segments |
| **Technical** | Program, Developers (Event logs, Hooks, API Keys) |
Three of these sections depend on how Paylead configured your Program, on top of the role: Coupons, Ventilation, and Integration. If one of them is missing for a user who holds the matching role, ask Paylead from the **Support** button in Shift whether it is enabled on your Program.
### Choose the roles for a new teammate
Start from the job, not from the matrix. Ask what the person is accountable for, grant the roles that cover it, and add more later when they hit a wall.
| Their job | Roles to grant |
| -------------------------------------------------------------------------------- | -------------------- |
| Runs the Offer catalog: reviews what Paylead proposes and publishes it | **Offers** |
| Answers Consumer questions about their [Rewards](/glossary#reward) and sync | **Consumer support** |
| Reconciles invoices and payouts | **Financial** |
| Builds and reads performance reports | **Reporting** |
| Runs the [Gift](/glossary#gift) catalog | **Gifts** |
| Owns the integration: API keys, [Webhooks](/glossary#webhooks), Program settings | **Technical** |
| Onboards and off-boards teammates | **Administration** |
Combine them when one person covers several jobs: someone who both manages the catalog and reconciles payouts needs **Offers** and **Financial**. Grant **Administration** on top of a working role, unless the person does nothing but manage accounts.
Give at least two people the **Administration** role. It is the only role that can invite and deactivate users, and no account can change its own roles or deactivate itself.
### Invite a user
In **My account** > **Users**, click **Invite a user**.
Enter the **First name**, **Last name**, and a valid **Email** address. The invited person signs in with that email.
Open the **Roles** selector and pick every role the new user needs. At least one role is required. You can change the selection later.
Click **Invite**. Paylead emails the new user a link to create their account. The user appears in the list once they complete the flow.
### Edit a user
In the users list, click the pencil icon next to a user to open their record. Update their **First name**, **Last name**, or **Roles**, then click **Save**. Shift confirms with "User successfully edited." and returns to the list. **Cancel** goes back without saving, and leaving the page with unsaved edits raises "You're leaving this page without saving your modifications."
The email address is read-only here. It identifies the account, so only its owner changes it, from **My account** > **Settings**.
**Roles** is a required field: a user always holds at least one, so off-board someone with **Deactivate user** rather than by emptying their roles. The field is hidden when you open your own record. Ask another holder of the **Administration** role to change your roles.
Shift reads a user's roles when it loads, so a teammate who already has Shift open keeps the old menu until they reload the page.
### Deactivate a user
In **My account** > **Users**, click the pencil icon next to the user to off-board.
Click **Deactivate user**, then confirm in the dialog. Shift returns to the users list and confirms the deactivation.
Deactivation is permanent. You cannot deactivate your own account: ask another holder of the **Administration** role.
## Shift with SSO
Paylead can connect Shift to your bank's identity provider instead of issuing credentials itself. When SSO is enabled on your Program, the identity provider owns accounts, credentials, and sessions, and Shift removes every control that would compete with it. Several procedures on this page no longer apply in that mode.
| Control | Where it normally sits | With SSO enabled |
| --------------------------------------- | ----------------------------- | -------------------------------------------------------------------------------- |
| **Sign Out** | Bottom of the main sidebar | Hidden. End your session from your identity provider. |
| **Edit** next to **Name** and **Email** | **My account** > **Settings** | Hidden. |
| **Password** | **My account** > **Settings** | Removed, along with the change-password form. |
| **Invite a user** | **My account** > **Users** | Hidden, so the invite flow cannot be started. |
| Pencil icon at the end of a user row | **My account** > **Users** | Hidden, which also puts the user edit form and **Deactivate user** out of reach. |
Everything else behaves the same. You still read your account settings and your email notification subscriptions, browse the users list with each user's roles and last activity, and open every section your roles grant. Ask Paylead from the **Support** button in Shift for anything the identity provider does not cover.
## What's next
Group your Consumers by targeting criteria for audience-specific Offers.
Review the Campaigns Paylead proposes and publish them as Consumer-facing Offers.