Invite and manage the team
Open Team while signed in as an administrator or owner. Owners may invite administrators, operators, or viewers; administrators may invite operators or viewers. Invitations arrive by email, expire after 48 hours by default, and can be resent or revoked. An invitee chooses a new password, and an existing email address is never moved silently to another account.
Use viewers for read-only access, operators for daily fleet work, administrators for team and account administration, and owners for the highest customer authority. Changing a member's role or active state revokes that member's browser sessions. It does not revoke account integration keys or computer keys, so review those separately when access changes.
Enable console two-step verification
Go to Settings → Security, enter the current password, add the displayed secret to an authenticator app, and confirm a six-digit code. Save the ten recovery codes after activation; PrintHook shows them only once. Store them outside the browser and outside the computer used for daily sign-in. Administrators and owners should enable this protection before managing teammates or live credentials.
Authenticator codes use 30-second time steps and a successfully used code cannot be reused. Replacing recovery codes or disabling two-step verification requires the password and a fresh authenticator or recovery code, then signs other browser sessions out. Password reset does not remove two-step verification.
Separate browser, integration, and computer access
A browser session represents a person. An integration key belongs to an account and should be created for one server-side integration, stored in a secret manager, and rotated when exposure is suspected. A computer key is agent-scoped: it can register printers, receive jobs, and post states, but cannot browse the account or create jobs. Revoke a computer key when retiring or losing a machine.
Never share passwords, API keys, computer keys, authenticator secrets, recovery codes, or invitation links in Support. The agent uses a password only during its one-time enrollment exchange and does not retain it. Diagnostics redact the computer key and omit job content, but you should still review where a bundle is uploaded.
Review Audit history
Administrators and owners can open Audit to review recorded activity for the account: actor user or key ID, action, object, time, source IP, and safe metadata. Search by action, actor, object type, or date. Credential creation and revocation, team changes, security changes, account settings, and manual webhook Replay actions are included.
Passwords, authenticator secrets, recovery codes, and invitation tokens are never audit fields. Audit is an operational history, not an immutable compliance archive, and older events that were not recorded cannot be reconstructed.
Prepare for recovery
Use a recovery code if the authenticator is unavailable. If both the authenticator and recovery codes are lost, there is no email-only bypass and no customer administrator button that removes the factor. Email support for guidance on a separately verified recovery process. Support will not ask you to send a password or one-time code.
For a rejected computer key, sign in again from the local PrintHook app or paste a new computer key from Computers → Add computer. Console two-step verification and computer enrollment are separate security boundaries. See agent installation and enrollment for the exact flow.