Users & permissions
Control who has access to your workspace and what they can do by managing users and assigning roles.
Roles overview
Each user in a workspace has a role that determines what they can see and do.
| Role | What they can do |
|---|---|
| Owner | Full access to everything, including billing and workspace settings. Each workspace has one owner. |
| Admin | Manage employees, organization units, integrations, and most settings. Cannot change billing or transfer ownership. |
| Manager | View and manage employees in their team. Access depends on their organization unit assignment. |
| Employee | View their own data, request time off, and manage personal settings. |
| Developer | Access API settings, service users, and API keys. Intended for technical users setting up integrations or automations. |
Inviting users
- Go to
- Click Invite user
- Enter the person’s email address
- Select a role for the new user
- Click Send invitation
The person will receive an email with a link to join the workspace. Invitations expire after 7 days.
Resending an invitation
If an invitation has expired or the person didn’t receive it:
A new invitation email is sent with a fresh 7-day expiry.
Editing user roles
Reviewing what changed on a user
Changing a user’s role, status or linked employee changes what they can see and do, so mTime keeps a record of every such change.
The panel lists each change newest first, showing what changed, who made it and when — so you can answer questions like who gave this person the Owner role? or when was this user suspended, and by whom?
Some entries look slightly different:
- System — the change was made automatically rather than by a person. Automatic user provisioning, the data retention job and account name synchronisation all appear this way.
- Removed user — the change was made by someone who has since been removed from the workspace.
- Created, by System, dated when the user was added — every user that already existed when your workspace was updated to this release gets one of these. It records what the user looked like at that point, so later changes can be compared against it.
Removing a user is recorded separately: lists deleted users along with who deleted them.
Suspending and reactivating users
Suspend a user to revoke their access without deleting their account. This is useful when someone leaves the organization or should temporarily lose access.
Suspending a user
Suspended users cannot sign in to the workspace. Their data is preserved.
Reactivating a user
The user can sign in again with their previous role and settings.
Service users and API keys
Service users are special accounts used for API access and automations rather than interactive sign-in.
Creating a service user
- Go to
- Click Create service user
- Give the service user a descriptive name (e.g., “Payroll export” or “Integration sync”)
- Click Create
Managing API keys
Each service user can have API keys for authenticating API requests.
- Open the service user
- Click Create API key
- Copy the key immediately — it is only shown once
Revoking an API key
- Open the service user
- Find the key you want to revoke
- Click Revoke
Revoked keys stop working immediately. Any automations using the key will need to be updated.
Linking users to employee records
A user account and an employee record are separate things in mTime. Linking them connects a person’s sign-in account to their employee data.
- Go to
- Click the user you want to link
- In the Linked employee field, select the matching employee record
- Click Save
This link enables features like viewing personal time-off balances and seeing the team calendar filtered to the user’s team.
Why can’t a user see the Timesheet menu or time registration widgets?
If a user is an Admin or Owner in a workspace but the Timesheet menu is not visible in the sidebar, and the time-off and time tracking widgets are missing from the dashboard, their user account is not linked to an employee record. Link it following the steps above.
If the employee record does not exist yet, create an employee profile first, then link it to the user account.
Test profiles
On a test workspace you can give one sign-in several profiles, so a single login can act as different people while you try things out — for example, submit time as an employee and then approve it as their manager, without juggling separate accounts.
Adding a profile
- Go to
- Find the existing user you want extra profiles for
- Open the row’s actions menu and click Add profile
- Choose a different employee to link (each profile must be linked to its own employee record) and select the roles for that profile
- Click Add test profile
The new profile is added straight away — no second invitation email is sent, because the account already exists.
Switching between profiles
When your account has more than one profile in the current workspace, a Switch profile option appears in your account menu.
- Open your account menu (your name, at the bottom of the sidebar)
- Click Switch profile
- Choose the profile you want to act as
The app reloads with that profile’s employee, roles, and permissions.
While you are on a profile other than your default one, the account button is highlighted in amber with a switch icon, so it is always clear which profile you are currently acting as. The sidebar and the dashboard greeting also name that profile rather than you, and switching back to your default profile restores your own name.
