Manage organizations & users

Manage a NervesHub organization: invite users, assign roles, and maintain firmware signing keys and certificate authorities.

Written By Josh Kalderimis

Last updated About 2 months ago

An organization is the top-level tenant. It owns products, users, firmware signing keys, and certificate authorities, and it isolates your fleet from other organizations.

Users and roles

Add people to an organization by inviting them, then give each a role. Roles are hierarchical: a higher role includes everything below it.

Role

Can do

view

Read-only access to the organization and its products.

manage

Everything view can, plus change device state and manage resources (firmware, deployments, devices).

admin

Everything manage can, plus manage members, signing keys, certificates, and organization settings.

Manage members in the web UI under the organization's Settings → Users, or from the CLI:

nh org user list
nh org user add <username> <role>
nh org user update <username> <role>
nh org user remove <username>

If an action like opening a device console isn't available to you, it's usually because your role doesn't include it. Ask an organization admin.

Firmware signing keys

Signing keys belong to the organization and are used to sign and verify firmware. Manage them under Settings → Signing Keys, or with the CLI:

nh key create <name>
nh key list
nh key delete <name>

See Firmware signing & fwup for how signing works, and guard the private key carefully.

Certificate authorities (Signer CAs)

For certificate-based device auth, you register your Signer CA with the organization so NervesHub can verify device certificates. Manage CAs under Settings → Certificates, or with the CLI:

nh cacert register <cert-path>
nh cacert list
nh cacert unregister <serial>

CAs can optionally be enabled for Just-In-Time Provisioning on a product. See Device authentication & mTLS and Production setup with NervesKey.

Organization settings and deletion

Organization admins can update settings and, if needed, delete the organization from Settings. Deleting an organization removes its products, devices, and associated data, so treat it with care.

Related