People and invitations

On Mac, open a hub in Devices to find People and Invitations. These sections require a build with the Watchpost account service. Sign in to your Watchpost account and keep the hub’s admin token on this Mac to give access. The list records access issued from this Mac; it is not a complete directory of everyone who can reach the hub.

This workflow shares access to selected sites through the hub. It does not give the recipient your hub’s admin token or router private key. Hik-Connect sharing has separate permissions.

Send an invitation

1. In People, choose Invite….
2. Enter Their email and select at least one site using this hub.
3. Choose an Access lasts term: 7, 30 or 90 days, or No end.
4. Choose Send Invitation.

The invitation stays open for 30 days. The access term starts when you grant access, not when you send the invitation. The invitation contains no device passwords or access token.

The recipient opens the invitation in Inbox and accepts or declines it. Acceptance leaves you another step: Give Access…. Cameras do not appear for them yet.

Give access after acceptance

Open Give Access… from the accepted invitation. Check the hub, site list and term. If this Mac does not recognize the invitation’s hub, choose a managed hub. Sites no longer associated with it appear in a warning and are left out; review the resulting list.

Set Name on the hub, up to 40 characters without slashes. The suggested name comes from the recipient’s email address. Passwords of devices is off initially. With it off, the recipient must enter device passwords themselves. With it on, they receive your device logins, and Watchpost asks you to confirm sharing them with the system owner-authentication prompt.

Choose Give the Access. Watchpost prepares personal access, seals a device package for the recipient’s installations and sends it to their Inbox. The package includes devices from the selected sites and the required route information. It leaves out your router private key, hub admin token and configuration snapshots. This flow does not include site-plan layout.

The recipient reviews and adds the package through Inbox. They may need to select cameras for viewing and enter missing passwords. A route received this way has limited editing controls: see Site connection paths.

If sending fails after access has been prepared, the form offers Send Again for the same package or Take the Access Back. Closing the form does not itself undo already prepared access. Read the reported step before retrying. Finish the retry or take-back during this app session; pending send state does not survive a restart.

Follow invitations and delivery

An invitation’s acceptance status and its email-delivery status are separate. A delivered letter does not mean the person accepted or added devices. In Invitations, waiting items may offer Send Letter Again; accepted items offer Give Access…. Declined, revoked or expired invitations can offer Invite Again….

Revoking a waiting invitation stops that invitation. To remove access already issued, use the person’s Revoke action in People.

Extend or revoke access

A person row shows email, sites and the term. Extend adds 7, 30 or 90 days from the current end, or from today if that end has passed. No end removes the end date. For access managed by the center, read any update error: a changed date on this Mac alone does not prove the center accepted it.

Choose Revoke, review the confirmation and choose Revoke Access. The app attempts to revoke access to the listed sites. If some requests fail, Cutting off and Try Again indicate unfinished work; keep the app running and retry when connectivity returns.

Two mechanisms can govern the term:

• With a legacy token issued directly by the relay, this Mac must contact the hub to remove it. If Watchpost is closed or the hub is unreachable, the token can keep working past the local term until removal succeeds.
• With center-managed access, the center stops issuing tokens after expiry or revocation. Tokens already issued last at most seven days, and the center limits them to the access end date. For earlier revocation, the owner’s app sends a revocation list to the hub. If that update cannot reach the hub, an existing token can remain usable until its own expiry. A successful center revocation alone does not prove an immediate disconnection at the hub.

Revocation closes the shared hub path when enforced. The recipient keeps imported devices and any passwords they received. Those credentials may still work on the site’s own network; change device passwords separately if that access must end too. Removing a local device or route does not revoke the recipient’s access.

Mobile and direct relay tokens

The Mac People/Invitations management screens are not available on iPhone, iPad or Android. Mobile Inbox can receive invitations and packages where the account service is available; that is a separate capability from granting access. Packages that rely on center-issued route tokens currently need Mac to obtain and renew those tokens. Adding such a package on mobile does not provide the same working hub path.

The hub’s server inventory may also show individual relay-token users with Cut Off. That action concerns a token on one server site. Use People to manage the term and sites of an access issued through this invitation workflow.

For the recipient steps and the choice between hub invitations, Hik-Connect and files, see Share access to devices.