Team access, roles & passkey login
Role-based access per website, passkey login without passwords, team invitations by email and an activity log per login.
XICTRAQ is built for teams — not single-person accounts shared across the whole agency. Every team member gets their own login, their own role (admin, editor or viewer), optionally different per website. Client access can be restricted to selected websites. For login we support passkeys per the WebAuthn standard — phishing-resistant, password-free, with Touch ID, Face ID or hardware tokens (YubiKey). Sign-ins, changes, deletions and downloads are recorded in the activity log of each login — kept for 12 months, filterable and exportable as CSV.
Team access, roles & passkey login features
Team invitations by email
Invite colleagues or clients by email address. They receive an invite link valid for 7 days and can register with passkey, password or social login.
Roles: admin, editor, viewer, client access
The owner manages account and billing · admins also manage the team · editors change websites, monitors and settings · viewers see all websites of the account read-only · client access sees only the websites assigned to it, also read-only.
Per-website permissions
You assign client access exactly the websites it may see. Ideal for agencies: client A sees only their own sites, client B only theirs. Team members get their own role per website.
Passkey login (WebAuthn)
Phishing-resistant login without password via Touch ID, Face ID, Windows Hello or YubiKey. Multi-device support: one passkey per device, any number per account.
Social login (Google)
Optional: sign in via OAuth 2.0 / OIDC with Google. Strong 2FA runs on the provider side. Account linking can be removed at any time.
Activity log
Sign-ins, changed settings, deletions and downloads with time, result, device, location and IP address. Available under Settings → Activity log, filterable by period and area, exportable as CSV.
How it works
Invite team member
Under Settings → Team choose email and role; client access is additionally assigned the websites it may see. The invitee receives a link by email and can register in under a minute.
Register a passkey
On first login: click "Add passkey" → browser prompts for Touch ID/Face ID/hardware token → done. Passwords stay optional as fallback.
Review access
In the activity log every login sees what happened under it, when and from where. On suspicion of a compromised account, every user ends their active sessions under Settings → Security; a password change automatically invalidates all other sessions.