Skip to content
Hekkos

Your team

For org admins.

Who can use your Hekkos org comes down to one setting: the membership mode. This guide covers the three modes, how to invite people, what admins and members can each do, and how to mirror membership from your GitHub org or your SSO provider.

How membership works

Every org is in exactly one of three membership modes. New orgs start in Manual.

  • Manual — nothing syncs automatically. You add people one at a time with invite links, and remove them from the Members page. This is the only mode where invites exist, and the only one that works with every sign-in method.
  • GitHub org (mirrored) — membership mirrors your connected GitHub org’s live membership. Anyone in that GitHub org appears in Hekkos after their first sign-in with GitHub, with their role taken from their GitHub org role (org admins become Hekkos admins). Removals apply the same way: someone taken out of the GitHub org loses access at their next sign-in.
  • SSO groups (mirrored) — membership mirrors your OIDC identity provider. Anyone who signs in through your configured SSO joins automatically; they get the admin role if their group claims include one of your configured Admin Groups, member otherwise, re-evaluated on every sign-in.

The mirrored modes sync at each member’s next sign-in — never instantly. Switching modes only changes which login path is allowed to manage membership going forward; it does not trigger an immediate bulk sync.

Inviting people (manual mode)

Invites live on the Members page (and inline in the setup wizard’s Team step). To invite someone:

  1. Enter their email address, pick a role (member or admin), and generate an invite link.
  2. Copy the link and share it yourself — Hekkos never sends the email.
  3. The link expires after 7 days. Generating a new invite for the same email replaces the old link.

Whoever opens the link signs in with any login method — GitHub or SSO — and is added as long as the email on the account they sign in with matches the invited email (capitalization doesn’t matter). If the emails differ, the invite is refused; re-invite the address they actually sign in with.

Pending invites are listed with their expiry. Revoking deletes the invite and the link stops working immediately; an invite that’s already been accepted can’t be revoked — remove the member instead. Invites are a manual-mode feature: if the org switches to a mirrored mode, outstanding links stop being accepted.

Roles

There are two roles:

  • Members can use Hekkos — chat, browse repos, drift, and suggestions — and can view Standards and Sources; org settings, members, and billing are admin-only.
  • Admins can additionally change everything: org settings, standards, sources, membership mode, invites, other members’ roles, billing, and org deletion.

Admins change roles on the Members page, and remove members there too. You can’t change or remove your own row — ask another admin.

Hekkos enforces last-admin protection on the server: the only remaining admin can’t be demoted or removed, so an org can never lock itself out. Promote another member first — the Members page warns you when you’re down to one admin.

Mirroring from GitHub or SSO

Use a mirrored mode when your team already lives in a GitHub org or behind an identity provider and you want joiners and leavers handled for you instead of by invite.

Where to switch: Settings → Membership — pick a mode and confirm — or the setup wizard’s Team step while onboarding. After you save working SSO settings while still in manual mode, Hekkos also offers the switch to SSO groups inline.

Eligibility:

  • GitHub org (mirrored) needs a connected GitHub source — that’s the org membership mirrors.
  • SSO groups (mirrored) needs SSO configured: the SSO / OIDC section in Settings takes your issuer URL, client ID, client secret, and the Admin Groups whose members get the admin role.

You can select a mirrored mode before its backer exists — Hekkos warns instead of blocking — but nobody can sync in until it does (see Troubleshooting).

Switching back to Manual is always safe: syncing stops, current members keep their access, and you manage the list by invite again.

Troubleshooting: “Nobody can currently join”

If the Members page shows the amber banner “Nobody can currently join this organization.”, the org is in a mirrored mode whose backer is missing — membership can’t sync and invites are disabled in mirrored modes, so there is genuinely no way in. Fix whichever applies:

  • GitHub org (mirrored) with no connected GitHub source → connect a GitHub source, or
  • SSO groups (mirrored) with SSO not configured → fill in and save the SSO / OIDC settings, or
  • switch the org to Manual and use invite links instead.

Existing members are unaffected by the banner — it’s about new people getting in. And remember the mirrored modes fill in gradually: a freshly mirrored org shows zero members until each person signs in.

Where next

Security Changelog Support Status Terms Privacy DPA Contact