User Management

Overview

Each Canvas app with Clerk authentication gets a dedicated Clerk organization. This organization is the single source of truth for who has access to the app and what role they hold. User management lets you:

List members of a Canvas app
Invite users by email with a specific role
Update roles (admin or member)
Remove users to revoke access immediately
Manage invitations — list pending and revoke unused invitations

User management requires auth_config.mode set to "clerk". Apps using public, password, or other auth modes do not have per-user access control.

Enabling User Management

Set your app’s auth mode to clerk. Mixpeek automatically provisions a Clerk organization for the app:

from mixpeek import Mixpeek

client = Mixpeek(api_key="your-api-key")

client.apps.update(
    app_id="app_abc123",
    auth_config={"mode": "clerk"},
)

curl -X PATCH https://api.mixpeek.com/v1/apps/$APP_ID \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{"auth_config": {"mode": "clerk"}}'

Once enabled, the Users tab appears in the Studio app detail page.

Roles

Each member has one of two roles:

Role	Slug	Description
Member	`org:member`	Standard access to the app
Admin	`org:admin`	Full access including user management

API Reference

All user management endpoints are scoped to a single app and require your API key with namespace header.

List Members

Returns all users in the app’s Clerk organization.

curl https://api.mixpeek.com/v1/apps/$APP_ID/users \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID"

Response:

{
  "users": [
    {
      "user_id": "user_abc123",
      "membership_id": "mem_xyz789",
      "email": "jane@example.com",
      "name": "Jane Smith",
      "avatar_url": "https://img.clerk.com/...",
      "role": "org:admin",
      "joined_at": "2026-03-15T10:30:00Z"
    }
  ],
  "total": 1
}

Invite a User

Send an email invitation to join the app’s organization.

import httpx

resp = httpx.post(
    f"https://api.mixpeek.com/v1/apps/{app_id}/users/invite",
    headers={
        "Authorization": f"Bearer {api_key}",
        "X-Namespace": namespace_id,
    },
    json={
        "email_address": "newuser@example.com",
        "role": "org:member",
    },
)
print(resp.json())

curl -X POST https://api.mixpeek.com/v1/apps/$APP_ID/users/invite \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "email_address": "newuser@example.com",
    "role": "org:member"
  }'

Response:

{
  "invitation_id": "inv_abc123",
  "email_address": "newuser@example.com",
  "role": "org:member",
  "status": "pending",
  "created_at": "2026-03-27T14:00:00Z"
}

Update a User’s Role

Change a member’s role between org:member and org:admin.

curl -X PATCH https://api.mixpeek.com/v1/apps/$APP_ID/users/$USER_ID/role \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{"role": "org:admin"}'

Remove a User

Immediately revokes the user’s access to the app.

curl -X DELETE https://api.mixpeek.com/v1/apps/$APP_ID/users/$USER_ID \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID"

List Pending Invitations

curl https://api.mixpeek.com/v1/apps/$APP_ID/users/invitations \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID"

Response:

{
  "invitations": [
    {
      "invitation_id": "inv_abc123",
      "email_address": "pending@example.com",
      "role": "org:member",
      "status": "pending",
      "created_at": "2026-03-27T14:00:00Z"
    }
  ],
  "total": 1
}

Revoke an Invitation

Cancel a pending invitation before the recipient accepts it.

curl -X DELETE https://api.mixpeek.com/v1/apps/$APP_ID/users/invitations/$INVITATION_ID \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Namespace: $NAMESPACE_ID"

Studio

When a Canvas app has auth_config.mode = "clerk", a Users tab appears in the app detail page. From there you can:

View members — see all users with their name, email, avatar, and role
Invite users — click Invite, enter an email and role, then send
Change roles — use the role dropdown next to any member
Remove users — click the trash icon with a confirmation dialog
Manage invitations — view pending invitations and revoke them

How It Works

Each Canvas app maps to a Clerk organization. When you enable auth_config.mode = "clerk", Mixpeek auto-provisions a Clerk org and stores the clerk_org_id in the app record. All user management operations go directly to Clerk — there is no separate user database to maintain. Clerk is the single source of truth.

Your App (auth_config.mode = "clerk")
    └── Clerk Organization (auto-provisioned)
            ├── Members (org:admin, org:member)
            └── Pending Invitations

Removing a user revokes access immediately. The user will be signed out on their next request.

Authentication — enable Clerk auth and use the MixpeekAuth SDK
Apps overview — Canvas app architecture and quickstart
Custom Domains — add your own domain to a Canvas app

Get started

Connect your data

Extract features

Build retrievers

Enrich & organize

Integrate & operate

Resources

User Management

Overview

Enabling User Management

Roles

API Reference

List Members

Invite a User

Update a User’s Role

Remove a User

List Pending Invitations

Revoke an Invitation

Studio

How It Works

​Overview

​Enabling User Management

​Roles

​API Reference

​List Members

​Invite a User

​Update a User’s Role

​Remove a User

​List Pending Invitations

​Revoke an Invitation

​Studio

​How It Works

​Related

Overview

Enabling User Management

Roles

API Reference

List Members

Invite a User

Update a User’s Role

Remove a User

List Pending Invitations

Revoke an Invitation

Studio

How It Works

Related