Aller au contenu
Hekkos

Your team

Ce contenu n’est pas encore disponible dans votre langue.

For org admins.

Who can use your Hekkos org comes down to one setting: the membership mode. This guide covers the three modes, how to invite people, what admins and members can each do, and how to mirror membership from your GitHub org or your SSO provider.

How membership works

Every org is in exactly one of three membership modes. New orgs start in Manual.

  • Manual — nothing syncs automatically. You add people one at a time with invite links, and remove them from the Members page. It’s the only mode that works with every sign-in method, and where invites are the whole membership mechanism.
  • GitHub org (mirrored) — membership mirrors your connected GitHub org’s live membership. Anyone in that GitHub org appears in Hekkos after their first sign-in with GitHub, with their role taken from their GitHub org role (org admins become Hekkos admins). Removals apply the same way: someone taken out of the GitHub org loses access at their next sign-in.
  • SSO groups (mirrored) — membership mirrors your OIDC identity provider. Anyone who signs in through your configured SSO joins automatically; they get the admin role if their group claims include one of your configured Admin Groups, member otherwise, re-evaluated on every sign-in. You must first verify each email domain your people sign in with — add the domain under Settings → Verified email domains and publish the DNS TXT record we give you. SSO logins at an unverified domain are refused (this is what stops another organization’s identity provider from ever asserting your users’ emails). Once a domain is verified, anyone at that domain signs in — including a person who already has a Hekkos account under that email (say from GitHub or another org), who is safely linked to their existing account. A mirrored member must reach the org through SSO — signing in with GitHub (even to an account that also exists in the org) will not grant access to an SSO-groups org, so your identity provider stays the single gate on who gets in. For someone whose email your SSO can’t cover — a contractor or consultant on an outside domain — use an invite link (see below); an invited member keeps access through any sign-in method, and their mirrored teammates are unaffected.

The mirrored modes sync at each member’s next sign-in — never instantly. Switching modes only changes which login path is allowed to manage membership going forward; it does not trigger an immediate bulk sync.

Inviting people

Invites live on the Members page (and inline in the setup wizard’s Team step). They’re available in Manual mode — where they’re the whole membership mechanism — and in SSO groups mode, where they’re the way to grant access to someone your SSO domain can’t cover (an off-domain contractor or consultant). In GitHub org mode there are no invites: add the person to the GitHub org instead, since a manually-invited member would be dropped at their next sign-in by the GitHub sync. To invite someone:

  1. Enter their email address, pick a role (member or admin), and generate an invite link.
  2. Copy the link and share it yourself — Hekkos never sends the email. The link is shown once: the token is stored hashed, so it can’t be displayed again after you leave the page — copy it while it’s on screen.
  3. The link expires after 7 days. Generating a new invite for the same email replaces the old link.

Whoever opens the link signs in with any login method — GitHub or SSO — and is added as long as the email on the account they sign in with matches the invited email (capitalization doesn’t matter). If the emails differ, the invite is refused; re-invite the address they actually sign in with.

Pending invites are listed with their expiry. Each row has two actions:

  • Regenerate issues a fresh link for that invitee — use it when the original link was lost (it can’t be re-shown). The new link appears at the top of the panel to copy, and it supersedes the old one.
  • Revoking deletes the invite and the link stops working immediately; an invite that’s already been accepted can’t be revoked — remove the member instead.

Invites work in Manual and SSO-groups mode. If the org switches to GitHub org mode, outstanding links stop being accepted (its membership is mirrored from GitHub). An invitee always joins bound to the account they sign in with, and only when its verified email matches — so an invite can never grant access to an address the person doesn’t control.

Roles

There are two roles:

  • Members can use Hekkos — chat, browse repos, drift, and suggestions — and can view Standards and the Repositories page (the merged repos-and-projects governance surface) as a read-only map: they see how repositories are grouped into projects and can open any repo’s governance view, but get no create/edit/delete or assign/enroll controls. Org settings, members, and billing are admin-only.
  • Admins can additionally change everything: org settings, standards, policies, membership mode, invites, other members’ roles, billing, and org deletion. On the Repositories page they create, rename, and delete projects, assign repositories to them, and enroll knowledge sources at project scope.

Admins change roles on the Members page, and remove members there too. You can’t change or remove your own row — ask another admin.

Hekkos enforces last-admin protection on the server: the only remaining admin can’t be demoted or removed, so an org can never lock itself out. Promote another member first — the Members page warns you when you’re down to one admin.

Mirroring from GitHub or SSO

Use a mirrored mode when your team already lives in a GitHub org or behind an identity provider and you want joiners and leavers handled for you instead of by invite.

Where to switch: Settings → Membership — pick a mode and confirm — or the setup wizard’s Team step while onboarding. After you save working SSO settings while still in manual mode, Hekkos also offers the switch to SSO groups inline.

Eligibility:

  • GitHub org (mirrored) needs a connected GitHub source — that’s the org membership mirrors.
  • SSO groups (mirrored) needs SSO configured: the SSO / OIDC section in Settings takes your issuer URL, client ID, client secret, and the Admin Groups whose members get the admin role.

You can select a mirrored mode before its backer exists — Hekkos warns instead of blocking — but nobody can sync in until it does (see Troubleshooting).

Switching back to Manual is always safe: syncing stops, current members keep their access, and you manage the list by invite again.

Troubleshooting: “Nobody can currently join”

If the Members page shows the amber banner “Nobody can currently join this organization.”, the org is in a mirrored mode whose backer is missing — membership can’t sync and invites are disabled in mirrored modes, so there is genuinely no way in. Fix whichever applies:

  • GitHub org (mirrored) with no connected GitHub source → connect a GitHub source, or
  • SSO groups (mirrored) with SSO not configured → fill in and save the SSO / OIDC settings, or
  • switch the org to Manual and use invite links instead.

Existing members are unaffected by the banner — it’s about new people getting in. And remember the mirrored modes fill in gradually: a freshly mirrored org shows zero members until each person signs in.

Where next

Sécurité Changelog Soutien Statut Conditions Confidentialité DPA Contact