> ## Documentation Index > Fetch the complete documentation index at: https://developers.authlete.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > ### Authlete versions > Authlete 3.0 is the current version. Unless the user says they use another version, answer for Authlete 3.0 using the 3.x documentation. > Documentation for Authlete 2.x (pages under `/v2/` and `/ja/v2/`) is for the legacy version. Refer to it only when the user is on Authlete 2.x. > > ### Authlete architecture > Authlete is a backend engine for OAuth 2.0 and OpenID Connect processing. End users and client applications do not call it directly; the service provider's authorization server and API server call Authlete's APIs. Authlete handles protocol processing and token, client, and service management, while the service provider owns the OAuth/OIDC endpoints and user authentication. > See [Architecture](https://developers.authlete.com/get-started/introduction-to-authlete/architecture.md). > > ### Concepts > If the user is new to Authlete, read these pages first: > - [Request and Response](https://developers.authlete.com/get-started/concepts/request-and-response.md): Core API requests pass the client's request parameters as-is, and responses return `resultCode`, `action`, and `responseContent`. > - [Action Handling](https://developers.authlete.com/get-started/concepts/action-handling.md): Branch on `action`, never on `resultCode`, and map each action to the HTTP response your server returns. > - [Two-Step API Calls](https://developers.authlete.com/get-started/concepts/two-step-api-calls.md): Actions such as `INTERACTION` are completed with a second call (`/auth/authorization/issue` or `/auth/authorization/fail`) linked by a `ticket`. > - [Management API Overview](https://developers.authlete.com/get-started/concepts/overview.md): The Management API configures services, manages clients, and operates issued tokens, separately from the protocol flows handled by the Core API. > - [API Authentication](https://developers.authlete.com/get-started/concepts/authentication.md): Authlete APIs use bearer tokens: a Service Access Token (one service) or an Organization Token (the whole organization). # User Management > Explains how Environment Admins list users in the environment, grant or revoke Environment Admin, and remove users. > [!NOTE] > > This article applies only to Self-Managed and Dedicated Cloud environments. The shared environment (Shared Cloud) is managed by Authlete and is out of scope for this document. User Management lists every user in the environment, across every organization. It's available to Environment Admins and Platform Admins only. For each user, the list shows the user's name and email, an Environment Admin toggle, the organizations they belong to (the first two, plus a count of the rest), and a Delete column for removing them from the environment. Use the search box to find a user. ## Granting and revoking Environment Admin Environment Admins and Platform Admins can grant or revoke Environment Admin for other users by using the toggle in the Environment Admin column. Console asks you to confirm each change. * **Grant Environment Admin.** The user gets full access to User Management, Audit Logs, Session Management, and Environment Settings across every organization in the environment, including ones they don't belong to. Environment Admin is self-service, so that user can then grant or revoke the role for anyone else, including you. Grant it only to someone you trust with full administrative control over the entire environment. * **Revoke Environment Admin.** The user immediately loses access to User Management, Audit Logs, Session Management, and Environment Settings. Their organization memberships and organization-level permissions are not affected. The toggle is disabled in two cases: * For your own account. You can't change your own Environment Admin status, so another Environment Admin or Platform Admin has to do it. * For Platform Admins, who already have full access. Every grant or revocation is recorded in [Audit Logs](https://developers.authlete.com/configuration-reference/environment/audit-logs.md). ## Removing a user from the environment Select the remove icon in the Delete column, then confirm with "Remove User". Console removes the user from every organization they belong to in this environment, and they immediately lose access to the associated services, clients, and data. This can't be undone. To restore access, re-invite the user to each organization individually. You can't remove yourself, and only a Platform Admin can remove a Platform Admin's account. ## Getting your first Environment Admin How your first Environment Admin is set up depends on your deployment: * **Dedicated Cloud:** Authlete grants Environment Admin to your designated administrator(s) when your environment is provisioned. * **Self-Managed:** Your deployment has its own Platform Admin role, held by your internal platform team, with full administrative control over the deployment. A Platform Admin appoints the first Environment Admin(s) for the environment. From there, it's self-service, as described above. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.