User accounts and access

The types of user accounts and access you need depends on the role you have on your team and the type of work you need to do.

When a new application is created, a member of WPVIP will make sure that at least one member of your organization has access to the application’s GitHub repository, WordPress installation, and VIP Dashboard. That team member is usually a primary contact for the organization. Those individuals will be given a user role for each account that has the capability to manage user access for their team members.

You will receive an automated email if a user account for GitHub, WordPress, or the VIP Dashboard is created for you. The email will provide you with instructions for creating a password and logging in.

WordPress Admin dashboard

A user account for the WordPress Admin dashboard (WP Admin) is typically needed by team members who create or edit content for a site or manage site settings.

When a new user is added to a WordPress site, they should be assigned one of the predefined WordPress roles that only has the capabilities needed by the user (e.g., Author, Editor, Administrator).

Users who have an Administrator or Super Admin role on your WordPress application are responsible for:

Adding, removing, and managing all other users on that WordPress application.
Resetting password for user accounts when needed, and resetting two-factor authentication (2FA) for locked out WordPress users.

If you have determined that you need a WordPress user account for your application and you do not yet have one, request access from a team member who has a Super Admin or Administrator role.

GitHub repository

A user account with access to the application’s GitHub repository is typically needed by team members who develop code, or are responsible for managing plugins or themes for the application.

Only a user with Admin access to an application’s GitHub repository can invite other users. To develop code for an application a user only needs a role with Write access.

If you have determined that you need access to your application’s GitHub repository, request access from a team member with a GitHub Admin role.

VIP Dashboard

The VIP Dashboard is a portal for monitoring activity on an organization’s applications, and managing an organization’s members, applications, and environments.

A user account for an organization’s VIP Dashboard is typically needed by team members who are involved with application development, security, governance, or billing.

An existing user who has an Org admin role is responsible for inviting other team members to have access to an organization and its applications in the VIP Dashboard. When the Org admin invites other users, they will assign a role to that user that defines how much access they have to an application, and what permissions they have to perform various actions.

If you have determined that you need access to your organization’s VIP Dashboard, request access from a team member with an Org admin role.

Logging in to the VIP Dashboard

After you receive an invitation to the VIP Dashboard, the VIP Authentication process will require you to choose an authentication method for logging in and an MFA method.

You can use your GitHub user account or WordPress.com user account for authentication. Whichever user account you use for authentication, it must be registered with the same email address to which the VIP Dashboard invitation was sent.

If you use GitHub or WordPress.com for authentication, whichever method you choose must be the method you use to log in every time. The methods are not interchangeable.
A GitHub user account does not need access to the application’s GitHub repository in order to be used for authentication.

After authenticating with either GitHub or WordPress.com, you will be prompted to configure an MFA method in a panel titled “Keep Your Account Safe“. At least one MFA method must be configured in order for a user to verify their identity and gain access to the VIP Dashboard.

Some organizations might have a Single Sign-On (SSO) option configured. Depending on how it is configured, SSO could be an additional authentication option to GitHub or WordPress.com, or it might be enforced as the only authentication option. If you have questions, reach out to the primary contact of your team to find out if SSO is an option for you.

VIP-CLI

VIP-CLI is a command library that enables a user to perform many of the same actions as the VIP Dashboard to manage environments.

VIP-CLI is typically used by team members who are comfortable with the command line and who are involved with application development, management, and security.

In order to complete the installation process for VIP-CLI, you must have accepted an invitation to an organization’s VIP Dashboard and successfully logged in. The Org role that is assigned to your VIP Dashboard account will determine the permissions that you have to perform VIP-CLI commands against the organization’s environments.

User accounts and security best practices

When giving team members access to any type of account for application management, it is important that they follow strong security practices. At the most basic, every user should create strong, unique passwords for each of their accounts and enable Two-Factor authentication (2FA) whenever possible.

The number of team members who are granted any type of user accounts with admin level access should be kept to a minimum.

You and every member of your team should read and follow WPVIP’s security recommendations for users.

Read WPVIP’s security recommendations for users

Last updated: November 25, 2024