Owner & Admin Guide
Everything you need to manage your organization in Tinker Tone
Roles & Permissions
Tinker Tone uses three roles to control access across your organization:
Full control over the organization. Can manage billing, SSO, BYOK, and all admin features. There is exactly one Owner per organization.
- All Admin capabilities
- Manage billing & subscription
- Configure SSO (Azure AD, Okta, Google)
- Configure BYOK (Bring Your Own Key)
- Transfer ownership
- Delete organization
Manages users, profiles, and usage. Cannot modify billing or security settings.
- View admin dashboard & analytics
- Invite and remove team members
- Change member roles (Admin/Member)
- Approve or reject personal voices
- Manage team profiles
- View audit logs
- Create signup links
- View usage analytics
Standard user who can create profiles, rewrite content, and manage their own voices.
- Create and manage personal profiles
- Use all rewrite modes and quick actions
- Create and submit personal voices for approval
- Use approved team profiles
- View personal usage stats
- Manage account settings
Admin Dashboard
The admin dashboard provides a real-time overview of your organization's Tinker Tone usage. Access it from the sidebar by clicking Admin.
Key Metrics
- Total Users — Number of team members (with active count)
- Total Rewrites — Cumulative rewrites across all users
- Usage % — Current month usage vs. plan limit
- Profiles — Total active voice profiles
Quick Links
- Usage Analytics — Detailed charts and trend data
- User Management — Invite, edit, and remove members
- Audit Log — Full activity history with search and filters
Audit Logs
Every action in your organization is logged. The audit log shows who did what and when. You can search by user, action type, or resource. Logs are retained based on your subscription tier.
User Management
Inviting Team Members
- Go to Admin → Users
- Click Invite User
- Enter the team member's email address
- Select a role: Admin or Member
- Click Send Invite — they'll receive an email with a signup link
Managing Existing Users
- Change Role — Click the user menu (⋮) → Edit Role
- Remove User — Click the user menu (⋮) → Remove. Their profiles and data will be deleted.
Tip: Use the Team page from the main sidebar for a richer view with pending invitations, member activity, and bulk actions.
Signup Links
Create temporary signup links to onboard multiple users without sending individual invites. Useful for team rollouts and onboarding events.
- Go to Admin → Signup Links
- Click Create Link
- Set a label (e.g., "Q1 Onboarding"), max uses, and expiration
- Share the generated URL with your team
Each link shows real-time usage stats (used/max), creation date, and can be deactivated at any time.
Voice Approval Workflow
When team members create personal voices, they can submit them for admin approval before the voice becomes active.
Voice Lifecycle
Approving or Rejecting
- Go to Admin → Voices
- Review pending voices at the top of the page
- Click Approve to allow the voice, or Reject with a reason
- Approved voices can be activated (finalized) by the member
Note: Rejected voices include a reason visible to the member. They can edit and resubmit.
Team Profiles
Team profiles are shared voice profiles that all members can use. They ensure consistent messaging across your organization.
- Only Owners and Admins can create team profiles
- Team profiles appear with a Team badge in every member's profile list
- Members cannot edit or delete team profiles
- Team profiles use the same 5-trait system (warmth, directness, formality, enthusiasm, empathy)
SSO Configuration
Single Sign-On lets your team authenticate with your organization's identity provider. Available on the Business plan.
Supported Providers
- Azure AD (Microsoft Entra ID)
- Okta
- Google Workspace
Setup Steps
- Go to Admin → SSO
- Select your identity provider
- Enter your SSO entry point URL, issuer, and certificate
- Configure attribute mapping (email, name, first/last name)
- Optionally enforce SSO to require all users to sign in via SSO
- Click Save Configuration
BYOK (Bring Your Own Key)
BYOK lets your organization use its own AI provider API keys instead of Tinker Tone's shared keys. This gives you full control over costs and data routing.
Supported Providers
- Anthropic (Claude)
- OpenAI (GPT)
- Azure OpenAI (with custom endpoint and deployment)
Setup Steps
- Go to Admin → BYOK
- Select your AI provider
- Enter your API key (and endpoint/deployment for Azure)
- Click Test Key to verify it works
- Click Save to activate BYOK
Benefit: With BYOK enabled, your organization's rewrites bypass Tinker Tone's monthly limits entirely. You only pay your AI provider directly.