Reference
Permissions
Reference for owner, admin, and member capabilities.
Prolifto enforces permissions on the server. Roles are assigned per organization (store) through Better Auth.
Roles
| Role | Summary |
|---|---|
owner | Full control, including deleting the store and catalog records |
admin | Day-to-day management, members, API keys, and settings |
member | Catalog and order work with fewer destructive permissions |
Capability matrix
| Capability | Owner | Admin | Member |
|---|---|---|---|
| View analytics | Yes | Yes | Yes |
| Create/update products | Yes | Yes | Yes |
| Delete products permanently | Yes | — | — |
| Create/update categories and collections | Yes | Yes | — |
| Delete categories and collections | Yes | — | — |
| Update variants | Yes | Yes | Yes |
| Create/update/delete options | Yes | Yes | Create/update |
| Create/update/delete media | Yes | Yes | Create/update |
| Manage inventory | Yes | Yes | Yes |
| Create orders | Yes | Yes | — |
| Update orders | Yes | Yes | Yes |
| Create/update customers | Yes | Yes | Yes |
| Manage coupons | Yes | Yes | — |
| Manage shipping rates | Yes | Yes | — |
| Manage store settings | Yes | Yes | — |
| Manage storefront domains | Yes | Yes | — |
| Manage integrations | Yes | Yes | Read |
| Read invoices/receipts | Yes | Yes | Yes |
| Update/void invoices/receipts | Yes | Yes | — |
| Manage API keys | Yes | Yes | — |
| Manage members/invitations | Yes | Yes | — |
| Manage billing | Yes | Yes | — |
| Delete the store | Yes | — | — |
| Seed demo data | Yes | — | — |
API keys
API keys bypass the role permission check. They are scoped to the organization and are intended for server-to-server integrations. Treat an API key as having the store's full API access, and revoke it immediately if leaked.
Where permissions live
- Statements and role assignments:
packages/auth/src/utils/permissions.ts. - Procedure-to-permission mapping:
apps/admin/orpc/permissions.ts. - UI checks: the admin's permission hooks and guards.
Procedures without a mapping fail closed. When adding an endpoint, add the mapping and a coverage test.