Roles and permissions

Areca has two kinds of access. Agency admin is an account-wide flag for the people who run the agency's work on Areca. Owner and Editor are roles inside one client, and each person can have a different role in each client. In the interface, the client roles are called Owner and Editor.

Every role is enforced on the server. A client editor who calls an owner-only action directly gets a "Forbidden" response and nothing changes.

Agency adminCopy Anchor Link

Agency admins work across all clients from one place. They can see and act in every client without being a member of it.

Agency admins can:

• Create, rename and delete clients, and add, configure and delete sites.
• Define and change content types (the UI may say "content type" for a collection), including their fields and routes.
• Create, change, enable, disable and delete site content sections (single sections of copy, such as company details), including their fields, SEO setting and preview path.
• Set the deployment target for each site and store the deployment credentials for each client.
• Create and rotate site tokens for the site projects.
• Manage branding and AI settings for the whole instance.
• Invite people, change anyone's role, and see the instance-wide activity log.
• Make other people agency admins, or remove that status.
• Approve AI apps connected to a site, and create personal AI keys. Each needs a fresh authenticator code, and an app or key approved by an agency admin can also change content types.

Two rules apply to agency admins specifically:

• They must have two-factor authentication turned on before they can use admin functions. See two-factor authentication and step-up.
• The first account created during setup is an agency admin. Areca does not let you remove the last agency admin.

Client ownerCopy Anchor Link

An owner runs publishing for one client. Owners can do everything an editor can, and also:

• Mark entries as ready, move them back to draft, schedule and cancel schedules, archive them, and delete them.
• Mark site content sections as ready, and schedule them. Owners can also restore earlier versions of a section.
• Restore an earlier version of an entry.
• Go live, roll back to an earlier release, and cancel a build that is still queued.
• Delete files from the client's Library.
• Invite people to the client, change their roles, remove them, and resend or revoke invitations.
• See the client's activity log.
• Connect AI apps and create personal AI keys, allow them to publish, and see, disconnect and revoke every connected app and AI key on the site.

Owners cannot change content types, site settings, deployment targets, deployment credentials, or AI settings. Those belong to agency admins.

Client editorCopy Anchor Link

An editor writes content for one client:

• See the client's content types and entries, and create new entries.
• Edit and save drafts, and open a preview of a draft.
• Edit site content sections, discard their drafts and preview them.
• Upload files to the Library and edit their descriptions, including alt text.
• Ask for AI SEO suggestions and alt text.
• Connect an AI app to the site by approving it on the consent screen, or with a personal key. The app does what the editor can do, and the editor can disconnect it or revoke the key at any time. See Connect AI.

Editors cannot mark entries or site content as ready, schedule, archive, delete, restore, or go live. They cannot see People, Settings, or the activity log.

SummaryCopy Anchor Link

For the action-by-action breakdown, including the actions that need a fresh authenticator code, see the permissions matrix.

Access to other clientsCopy Anchor Link

If you are not a member of a client, Areca does not show you its sites, entries or files. When you try to open one of its sites, entries, files, builds or invitations by ID, you get the same "not found" answer as for an ID that does not exist, so people cannot discover which IDs exist in other clients. Actions that take a client's own ID, such as listing its members, answer "Forbidden" to non-members.

RelatedCopy Anchor Link

• Permissions matrix
• Two-factor authentication and step-up
• People and invitations explains how to invite someone and choose their role.
• Connect AI explains connected apps, personal AI keys and what they can do for each role.