Account, team and access

Everything to do with who gets into Shara and with what permissions: company activation, two-step verification, invitations and removing access. It is the part worth getting right on day one, because it decides who can approve a payment.

Activating the company

Activation happens once and is done by one person, who becomes the company’s owner inside Shara (shown as CEO in the app).

Open the desktop app (if you don’t have it yet, download it for Windows, macOS or Linux) and, on the sign-in screen, click Activate with company key. The key is redeemed in the app, not on the web.
Paste the activation key you received when you signed up, in the format SHARA-XXXX-XXXX-XXXX-XXXX. The app shows you the company and plan it belongs to; enter your name and a password of at least 10 characters and click Activate account.
Follow the setup wizard, which opens by itself: company details (trade name, sector and team size), key team, quarter goals, tone and initial agents. You can skip it and set it up later from Settings.
Define the business hours and the time zone in Settings → Business hours. Those hours aren’t decorative: outside them the agents automatically drop to a lower model to spend less.
Set up two-step verification, which is optional but worth putting in place on day one: without it you won’t be able to invite your team (more below).

The owner role is assigned at activation and can’t be handed out from the team screen. There is always at least one owner, and it is the only role that reaches everything.

Two-step verification (2FA)

Two-step verification by time-based code (TOTP) is optional: each person decides whether to enable it, in My account → Two-step verification. There are two cases where it is required:

If the company asks for it. Owners and administrators can require it of the whole team, as explained below.
On sensitive operations by those who administer. Owners and administrators need to have the second factor configured to invite or revoke invitations, create API keys, edit an agent’s identity, enter the administration panel, change the password or remove their own 2FA. Without it, those operations don’t run until it is configured.

Once you have it on, the second factor (or a passkey sign-in) is required across the whole application: on every request, on the real-time channel, in connector settings and when approving actions, not only on sensitive operations. Anyone who doesn’t have it on, and whose company doesn’t require it, signs in with a password.

How it is set up: you scan the QR code with any standard authenticator app (Google Authenticator, Authy, 1Password) and enter the six-digit code. When you finish you receive a set of single-use recovery codes. Save them in a password manager the same day: they are your way back in if you lose your phone.

Requiring it of the whole staff. From Settings → Security (Require 2FA for the whole team) the company can require two-step verification of all its members, across the whole application: we ask each person for it at their next sign-in and, until they configure it, they only see the screens of the enrollment itself, so nobody is locked out completely. Before turning the switch on, enable yours: otherwise the change would lock you out. It is required of every member also when they sign in from another company. With the switch off, each person decides whether to use it, except for the administrators’ operations above.

Removing your 2FA requires the session to be already validated with the second factor. This is deliberate: someone who steals your password can’t remove your 2FA with it.

Inviting your team

You invite only from Team → Add employee: enter the email, the name, the department(s) (more than one is fine), the working schedule and the role, and send. The person receives a link that lets them create their account: the email is already filled in and can’t be changed, and they only enter their name and a password. Two-factor authentication is optional unless the company requires it. They are in with exactly the permissions you assigned. If you are an owner or administrator, you need to have your two-step verification enabled to be able to invite.

In Settings → Members you only see the members and edit their roles; you don’t invite from there.

The link expires after 7 days. After that you have to issue another.
It can be revoked at any time before they accept it.
Registration is closed: nobody gets in on their own. Either there is a contract, or there is an invitation.

The six roles and what each one reaches are in Roles and permissions. The practical rule: start with the lowest role that lets that person work. Raising permissions is easy; recovering what someone did with too many permissions is not.

Who sees what

The desktop app is for everyone, each person on their own surface: the director resolves their inbox and the operator works with their agent. What each role reaches is in Roles and permissions.

The role is read at the moment of each request, not when the session started. If you downgrade someone, they lose access on their next click; there is no need to wait for anything to expire.

Removing someone

Remove access from Team the same day the person leaves. The effect is immediate. What they did while inside stays in the audit log, which is what you want: removal withdraws access, it doesn’t erase the trail.

Open sessions

In Settings → Security you have the list of active sessions on your account, with the device, IP address and approximate city of each, and the access history. From there you can sign out all other sessions at once and keep only the one you are using.

If you see an access you don’t recognize: sign out the other sessions, change the password and review the audit log for that period.

Common mistakes

Inviting everyone as administrator. The administrator approves payments. Almost nobody needs that.
Saving the recovery codes “for later”. There is no later: the screen that shows them doesn’t come back.
Leaving business hours at the default. If it doesn’t match your real working day, low-spend mode kicks in when it shouldn’t, or doesn’t when it should.
Leaving accounts of people who are no longer there. It is the cheapest way in there is.

More on permissions, encryption and audit in Security and compliance. To install the application, Desktop app and agent.