Customer contacts

Many B2B customers have multiple people who need to log in — a purchasing manager, an AP clerk, a receiver. Customer contacts let you grant those people their own login without creating separate customer accounts.

Everyone shares the same order history, shipping addresses, and custom pricing. What differs is permissions: each contact has an ADMIN, BUYER, or VIEWER role that governs what they can do on the storefront.

For the role model itself — what ADMIN, BUYER, and VIEWER can each do — see Concepts → Customer contacts. This page covers the dashboard-side workflow.

Managing contacts from the dashboard

Open a customer at /dashboard/customers/{id} and scroll to the Contacts section. You'll see the primary account, every contact, and inline controls to add, remove, and change roles.

Adding a contact

Click Add contact in the Contacts panel header. Fill in:

Save — the contact appears in the list immediately. An audit-log entry is written with action CustomerContactCreated.

After you create a contact

They need to set a password before they can log in. Point them at:

/store/{your-slug}/setup-password

They enter their email and a new password (8–100 chars, confirm field must match). If the email matches an active contact who hasn't set a password yet, Distribu securely stores the password and redirects them to the login page. From then on they log in at /store/{your-slug}/login like any other storefront user.

If they try to set up a password for an email that isn't a pending contact — either it doesn't exist or it already has a password — they see:

"No pending account found for this email. Please contact your distributor."

So the setup-password link is one-shot. Once used, future password changes go through the normal login/reset flow.

Distribu doesn't send an automatic invite email when you add a contact today — you need to tell them the URL. A real email invite flow is on the roadmap.

Changing a contact's role

Click the role dropdown next to the contact's name and pick a new role. The change takes effect on their next request — no re-login required. An audit log entry captures the from and to roles.

Removing a contact

Click Remove next to the contact. This deletes the contact but doesn't touch the parent customer or any of their orders. The contact can't log in after removal — their session cookie, if they have one active, becomes invalid the moment their record is gone.

Duplicate-email handling

A contact's email has to be unique within a single customer. You can't add two contacts with billing@acme.com to the same Acme account.

Across different customers, emails are independent — billing@acme.com can be a contact under Acme and a separate contact under Blue Plate Diner. At login, Distribu matches the email + password pair, so a collision doesn't cause ambiguity as long as the two contacts have different passwords.

Limits

Contacts don't count against your plan's customer limit — one customer with 10 contacts counts as 1.

Next: Price overrides.