​
Inviting someone

Settings → Team → Invite. Give them a name, an email and a role. They get a password to sign in with, shown to you once at the moment you create them. You can change someone’s role later, or suspend them. The account owner cannot be removed — somebody has to be able to let people back in.

​
Roles

A role is a starting point, not a cage — you can grant or withhold individual permissions on top of it for anyone on your team.

​
Why something might be locked

This is the part worth understanding, because the same padlock has two entirely different fixes. There are two layers, and what a person can actually do is the overlap:
So when a page is locked, the portal tells you which layer is responsible:
Your business has this capability — the person signed in has not been given it. Whoever owns the account can grant it under Settings → Team.Nothing to do with DINARI.
Your business does not have the capability at all, so nobody at your business has it, including the owner. Granting it to a person changes nothing until DINARI enables it for the account.The two usually in this state are identity verification (KYC), which costs money per check, and requesting payouts, which cannot be undone once a transfer leaves.
Granting someone a permission your business does not hold is harmless and does nothing — it becomes live the day DINARI enables the capability. And if DINARI ever removes a capability from your account, it goes from everybody at once, including the owner.

​
Developer access

Developers → API keys issues keys for talking to DINARI from your own software.
  • Keys are named and separate. Create one per thing — production app, staging, warehouse script — so you can revoke one without breaking the others.
  • The secret is shown once, when you create it. There is no way to read it back; if it is lost, revoke that key and issue another.
  • Revoked keys stay in the list. The visible prefix is what lets a log line be traced back to the key that made it.
Developers → Webhooks is where you add URLs to be notified at when a payment completes. See Webhooks for the events and how to check a signature.
An API key can take payments in your name. Treat it like a password: never put one in client-side code, a public repository, or a screenshot.