Account Access and Roles
Approov account access is role-based. Roles control what a user can do with the Approov CLI, and help separate everyday development work from operations that could affect production traffic.
Use this page for the role model. Use Operations > User Management when you need to add, expire, revoke, or resend access. Use CLI Reference > Account and User Commands when you need exact command syntax.
Role Types
| Role | Purpose | Typical use |
|---|---|---|
dev | Day-to-day development and integration access. | Adding API domains, registering apps, checking metrics, and performing common setup tasks. |
admin | Elevated account administration. | User management, changing security policy, rotating secrets, and production-impacting account changes. |
delegate | Limited access for a third party responsible for app registration or app-related setup. | Independent app developers or partner teams working against an account they do not own. |
pentest | Restricted access for device-specific security testing. | Pentesters who need to adjust policy for their own test devices without seeing broader account state. |
automation | Scripted access for CI and other automated systems. | Build pipelines that need to download SDK assets, get configuration, or create registrations. |
Selecting a Role
After CLI initialization, list available local roles with:
approov role
On Linux and macOS, select a role using the command shown by the CLI, for example:
eval `approov role admin`
The command uses eval so the CLI can set the APPROOV_ROLE environment variable for the current shell. Each terminal session can therefore use a different role without affecting other open terminals.
On Windows, use the set APPROOV_ROLE=... command shown by approov role.
If you have initialized access to multiple Approov accounts, include the account name when selecting a role, as shown by the approov role output.
Password-Protected Sessions
Approov roles are normally password protected. The password is never stored by the CLI. When you enter it successfully, the active session lasts for up to one hour, after which the CLI asks for the password again.
Password protection reduces the impact of a compromised machine account and adds message integrity protection over the TLS channel used between the CLI and the Approov cloud service.
Selecting a role again refreshes the session back to a full hour. You can also use approov role . to refresh the currently active role.
Checking Active Access
Check the active role and account with:
approov whoami
This helps confirm which account and permission level a terminal session is using before running commands with production impact.
Recovery and Expired Access
If all admin access is lost, the account access recovery flow can send a refreshed onboarding email to the email address associated with the role. You need the recovery PIN shown during the original CLI initialization.
If another team member still has admin access, they can resend an onboarding email instead. If access is expired or revoked, the role may still appear locally but can no longer be used until fresh access is initialized.
Operational Guidance
Keep admin access limited to the smallest practical group. Most users should work with dev roles, and each person should have their own role rather than sharing credentials.
For team access tasks, see User Management. For password reset, role selection, initialization, and account command syntax, see Account and User Commands.